Search | CMS Information Security and Privacy Program

Skip to main content

Policy Documents
CMS Cyber Risk Management Plan (CRMP)
A plan that defines the overarching strategy for managing risk associated with the operation of CMS FISMA systems.
Introduction The Centers for Medicare & Medicaid Services (CMS) operates …
General Information
Software Bill of Materials (SBOM)
A structured list of the components and modules that make up a piece of software, and the supply chain relationships between them
What is an SBOM? A “Software Bill of Materials” (SBOM …
General Information
Ongoing Authorization (OA)
Supporting the continuous compliance and safety of FISMA systems through proactive, ongoing monitoring activities
What is Ongoing Authorization (OA)? All FISMA systems must be …
Tools / Services
Continuous Diagnostics and Mitigation (CDM)
Automated scanning and risk analysis to strengthen the security posture of CMS FISMA systems
What is Continuous Diagnostics and Mitigation (CDM)? Continuous Diagnostics and …
Policy Documents
CMS Acceptable Risk Safeguards (ARS)
Standards for the minimum security and privacy controls required to mitigate risk for CMS information systems
Access the ARS Current version of the ARS: ARS 5 …
Policy Documents
Risk Management Handbook Chapter 13: Personnel Security (PS)
RMH Chapter 13 outlines policies to ensure that employees and contractors are safely accessing systems
Introduction The Risk Management Handbook Chapter 13: Personnel Security discusses …
Policy Documents
Risk Management Handbook Chapter 5: Configuration Management (CM)
RMH Chapter 5 provides information about the Configuration Management family of controls which determine the risk management requirements for CMS systems
Introduction This Handbook outlines procedures to help CMS staff and …
Landing Page
Risk Management and Reporting
Information about programs and tools that support the continuous assessment and mitigation of potential security and privacy risks to CMS information and system
Cyber risk management and reporting at CMS is how we …
General Information
Plan of Action and Milestones (POA&M)
A corrective action plan roadmap to address system weaknesses and the resources required to fix them
What is a POA&M? When regular audits are conducted …
General Information
CMS Information System Risk Assessment (ISRA)
Documentation of a system’s vulnerabilities, security controls, risk levels, and recommended safeguards for keeping information safe
What is an Information System Risk Assessment (ISRA)? An Information …