Skip to main content
ControlFrameby LockedIn Labs
Framework library

Requirements & evidence

CMS Acceptable Risk Safeguards

CMS's minimum security and privacy control baseline for CMS information systems and CMS contractors. It is distinct from the Marketplace-focused ARC-AMPE baseline.

Edition on record
ARS 5.2
Edition published
Source last checked

Understand the scope

What the framework covers.

The library records this framework for federal healthcare, CMS contractors, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.

Areas of requirement

  • NIST SP 800-53 control families
  • Zero Trust implementation expectations
  • High Value Asset overlay
  • Federal Tax Information overlay
  • MAC ARS

The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.

Prepare with context

The evidence behind
the requirements.

Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.

A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.

ControlFrame availability

Framework reference available

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

How availability is determined

CMS Acceptable Risk Safeguards is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.

Metadata only; the ARS 5.2 catalog, overlays, and organizational parameters have not been ingested or modelled.

Follow the source

Editions and transitions.

These are the editions recorded in the library, checked August 28, 2026. Confirm the applicable edition with the authority before beginning an assessment.

  • ARS 5.2Current edition on record · Replaces ARS 5.1
  • ARS 5.1Superseded edition
Recorded change history

· CMS Acceptable Risk Safeguards ARS 5.2 supersedes ARS 5.1 and is the current edition.

Check the basis

Sources you can follow.

Verified against the issuing authority’s own publication. Source verification was recorded on August 28, 2026.

Catalog provenance and record details

Framework record: cms-ars-5-2.

Source artifact: acquisition required.

Parsed catalog: Not ingested.

Control families as published: NIST SP 800-53 control families · Zero Trust implementation expectations · High Value Asset overlay · Federal Tax Information overlay · MAC ARS.

Record last updated: August 28, 2026.

Common questions

A closer look.

What is CMS Acceptable Risk Safeguards?

CMS's minimum security and privacy control baseline for CMS information systems and CMS contractors. It is distinct from the Marketplace-focused ARC-AMPE baseline.

Who does CMS Acceptable Risk Safeguards apply to?

CMS Acceptable Risk Safeguards applies to federal healthcare, CMS contractors, US, per CMS Information Security and Privacy Program.

What is the current version of CMS Acceptable Risk Safeguards?

The current edition is ARS 5.2, issued by CMS Information Security and Privacy Program and published 2026-07-01. Source: https://security.cms.gov/policy-guidance/cms-acceptable-risk-safeguards-ars.

What does an assessment under CMS Acceptable Risk Safeguards require?

No control catalog has been ingested for CMS Acceptable Risk Safeguards yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.

At a glance

CMS Acceptable Risk Safeguards

ARS 5.2

Framework reference
Authority and edition tracked
Evidence preparation
Framework reference available
Source confidence
Primary authority

A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.

Continue exploring

Related frameworks.

IRS Publication 1075

Also applies to CMS contractors · The IRS's safeguard requirements for any agency, contractor, or state/local entity that receives federal tax information — relevant to any government contractor or CMS-adjacent SaaS vendor handling federal tax data.

GAO Green Book

Same framework family · The federal internal-control standard for designing, implementing, operating, and evaluating controls over operations, reporting, and compliance. It supplies auditable criteria for federal entities; it is not an organizational certification.

GovRAMP (formerly StateRAMP)

Same framework family · A standardized assessment, authorization, and continuous-monitoring program for cloud services used by state and local governments, built on NIST SP 800-53 Rev. 5. Core, Ready, and Authorized are service-offering statuses—not company-wide certifications. StateRAMP rebranded to GovRAMP on 2025-02-14; StateRAMP, Inc. remains the legal entity operating under the GovRAMP name.

NIST SP 800-172

Same framework family · Enhanced security requirements for protecting controlled unclassified information tied to critical programs and high-value assets against advanced threats. It supplements SP 800-171 and does not apply to every CUI environment by default.

Make the requirements
part of the work.

Explore how ControlFrame can organize CMS Acceptable Risk Safeguards requirements, evidence preparation, and review for your assessment scope.

Request a walkthrough
CMS Acceptable Risk Safeguards | ControlFrame