CMS Enhanced Direct Enrollment

A project opens into working evidence lanes, and collection runs against a real target — a registered test plan or a production release path.

Blueprint with 9 evidence lanes. 6 of 6 registered test plans run against a real target. Sealed-package release route with a controlled evidence corpus behind it (MarketLink CMS EDE controlled UAT collection).

Engagement

CMS EDE Year 9

Control set

Nine CMS EDE evidence lanes with a source-native requirement set (Application UI Toolkit items, Eligibility Results Toolkit cases, Partner Test Case Suite ids, API FIT ids, Communications Toolkit requirement numbers). CMS publishes the audit guidelines as PDFs; verbatim requirement text is not ingested, so there is no checksummed control catalog for this regime.

Native identifiers

Application UI Toolkit UI Questions Item #, Eligibility Results Toolkit IDs, Partner Test Case Suite IDs, API Functional Integration Toolkit IDs, Communications Toolkit requirement numbers, ARC-AMPE / NIST / CMS control IDs.

Evidence lanes

1. 01Application UI Toolkitconsumer flow screenshots · broker flow screenshots · agent flow screenshots · source-row evidence index · applicationAnswers JSON
2. 02Eligibility Results Toolkiteligibility result screenshots · raw eligibility JSON · test scenario result CSV
3. 03Partner Test Case SuiteCMS UAT test run log · test case screenshots · raw hub responses · auditor-ready package manifest
4. 04API Functional Integration Toolkitrequest/response JSON · API scenario result CSV · mTLS/certificate evidence · payload security evidence
5. 05Communications Toolkitlegal page screenshots · notice text extracts · Spanish-language option evidence · source mapping CSV
6. 06Eligibility Determination Noticesgenerated EDN PDFs · notice metadata JSON · delivery/archive proof
7. 07Identity Proofingconsumer identity-proofing screenshots · RBA/GetRecord response evidence · IDM/Okta configuration evidence · fallback/documentation path proof
8. 08Registration and Onboardingagent registration screenshots · broker registration screenshots · MFA setup evidence · approval gate evidence
9. 09Security Controls - ARC-AMPE / MARS-ESSPP · SAR · POA&M · ISA · security control screenshots · configuration exports

Registry status

Roadmap · modelledWe model the regime — control families and at least one crosswalk map on disk — but no control catalog is ingested.

Control units

Not on record — no catalog ingested and no authority-published count cited.

Control families

Application UI · API FIT · Language access · Accessibility · ARC-AMPE baseline

Applies to

healthcare · insurance · US

Verification

Secondary — corroborated across independent sources; the authority blocks automated fetch or does not state it plainly. checked 2026-08-06

Pending change

The Year 9 audit submission window closed 2026-07-01. CMS has said it intends to publish updated guidelines for calendar-year 2026 audit submissions (Year 10); no Year 10 document was found at this check.Expected: Unannounced