U.S. CMS MARS-E v2.0

Why does it matter?

MARS-E was the condition for connecting state eligibility and enrollment systems to the Federal Data Services Hub: CMS relied on an Administering Entity's System Security Plan, assessment results, penetration test results, plan of action and milestones and privacy impact assessment to make the risk-based Authority to Connect decision (ARC-AMPE Volume I, section 2.1). Behind it stand 45 CFR 155.260, which requires each Exchange to implement standards consistent with eight named principles and to monitor and periodically assess its controls, and 45 CFR 155.280, under which HHS may audit, investigate and pursue civil, criminal or administrative action. Since March 4, 2026 the same obligations are evidenced under ARC-AMPE, so MARS-E matters as the lineage of the controls an entity already runs.

Key benefits include:

• A regulatory baseline, not a voluntary one

45 CFR 155.260(a)(3) obliges every Exchange, and through 155.260(e) the Medicaid, CHIP and BHP agencies that share eligibility data, to implement standards consistent with the rule's principles; MARS-E was CMS's specification of them.

• Common language with federal agencies

Volume III mirrored NIST SP 800-53 Rev. 4 control families, with Appendix A of Volume II showing each control against MARS-E 1.0, the NIST Moderate baseline and CMS ARS 2.0 plus two ACA-specific controls, SC-ACA-1 and SC-ACA-2.

• Traceability to the rule

Appendix B of Volume II crosswalks 45 CFR 155.260 to the security controls, so an assessor could show which control satisfied which regulatory requirement.

• Federal tax information handled separately

FTI safeguards under IRS Publication 1075 moved out of individual controls in 2.0 into Appendix A of Volume IV, because not all Administering Entity systems process FTI (Volume II, section 2).

• A documented path to the current standard

Version 2.2 announced that the next major release would adopt NIST SP 800-53 Rev. 5; ARC-AMPE delivered that step and absorbed the Non-Exchange Entity GRC Framework, so MARS-E records map directly into the successor.

How does it work?

Volume II explains the standards. Section 1 ties them to section 1411(g) of the ACA and the HHS Exchange rule of March 12, 2012 (amended in 2014): 155.260(a)(3) requires each Exchange to establish privacy and security standards, and 155.260(e) extends the same to agencies administering Medicaid, CHIP or the Basic Health Program that exchange eligibility information. Section 1.1 binds Administering Entity employees, contractors, subcontractors and facilities to the Volume III controls. Section 2 states the design assumption: every applicable system is categorized Moderate and processes or stores personally identifiable information, so the catalog was built from the NIST SP 800-53 Rev. 4 Moderate controls as tailored by CMS; system owners may strengthen controls or inherit them from parent systems.

The 45 CFR 155.260 principles that the controls serve are individual access, correction, openness and transparency, individual choice, collection, use and disclosure limitations, data quality and integrity, safeguards and accountability (155.260(a)(3)(i) to (viii)). Paragraph (a)(4) requires operational, technical, administrative and physical safeguards for confidentiality, integrity and availability, including confidentiality of return information under section 6103 of the Internal Revenue Code and secure destruction; (a)(5) requires monitoring, periodic assessment and updating of controls; (a)(6) secure electronic interfaces; (b) binds non-Exchange entities by contract to standards at least as protective; and (g) sets a civil money penalty of up to $25,000 per person per use or disclosure, adjusted annually, for knowing and willful misuse under section 1411(g).

Version 2.2 (February 23, 2021) was an interim release: two volumes instead of four (Harmonized Security and Privacy Framework; ACA Administering Entity System Security and Privacy Plan), Information System Continuous Monitoring guidelines under OMB Circular A-130, HHS remediation deadlines in CA-5, RA-5 and SI-2, e-authentication from NIST SP 800-63-3 and CMS ARS 3.1 wording. ARC-AMPE 1.0 (March 4, 2025; Volume I now 1.02 of April 10, 2025) then replaced MARS-E and the NEE GRC Framework: it rests on the CMS ARS and NIST SP 800-53 Rev. 5, integrates enterprise risk management (Volume I, section 2.2) and its Volume II overlays give each user type a tailored control set that ACA Administering Entities and select Partner Entities must implement (section 3.1).

Key Elements

• Administering Entity (Volume II, Foreword)

Exchanges or Marketplaces, federal or state; state Medicaid agencies; CHIP agencies; state agencies administering the Basic Health Program; with their contractors and subcontractors under section 1.1.

• Four volumes of Version 2.0

Harmonized Security and Privacy Framework; Minimum Acceptable Risk Standards for Exchanges; Catalog of Minimum Acceptable Risk Security and Privacy Controls; ACA Administering Entity System Security Plan, which also carried the FTI requirements in its Appendix A.

• NIST SP 800-53 Rev. 4 Moderate basis (section 2)

Controls selected for Moderate systems holding PII, tailored by CMS through ARS 2.0, with implementation standards linked to CMS guidance on the CALT repository and two ACA-specific controls.

• Crosswalks (Volume II, Appendices A and B)

Appendix A compares each control with MARS-E 1.0, NIST Rev. 4 Moderate and CMS ARS 2.0; Appendix B maps 45 CFR 155.260 to the controls.

• Version 2.2 interim changes

Two volumes instead of four, continuous monitoring guidelines, remediation deadlines in CA-5, RA-5 and SI-2, SP 800-63-3 e-authentication, ARS 3.1 wording (Volume I, Foreword).

• Supersession by ARC-AMPE (Volume I, footnote 6)

Released March 4, 2025, compliance March 4, 2026; Volume I is guidance for all users and Volume II the System Security and Privacy Plan with required baseline controls for ACA AEs and select Partner Entities.

What does it cover?

MARS-E 2.0 applied to the information systems of ACA Administering Entities, Exchanges and Marketplaces whether federal or state, state Medicaid agencies, CHIP agencies and Basic Health Program agencies, and to the employees, contractors, subcontractors and facilities supporting those systems (Volume II, Foreword and section 1.1). It covered systems that create, collect, use or disclose personally identifiable information for eligibility and enrollment under 45 CFR 155.260, assumed a Moderate categorization and kept federal tax information duties in Volume IV. Non-Exchange entities such as web-brokers were bound through 155.260(b) contracts and, from 2019, the NEE GRC Framework. ARC-AMPE defines the same population as ACA AEs, Partner Entities (including Non-Exchange Entities and Service Providers) and State Healthcare Agencies (Volume I, section 1.3.2).

What are its objectives?

Volume II states the purpose of the suite as a risk-based security and privacy framework for the design and implementation of Exchange IT systems for which CMS has oversight responsibility, without imposing a single solution on states (section 1.1).

Implement the privacy and security principles and safeguards of 45 CFR 155.260 in every Administering Entity system that handles applicant and enrollee PII.

Establish a minimum acceptable risk posture built on the NIST SP 800-53 Rev. 4 Moderate baseline, which system owners may strengthen or inherit from parent systems.

Protect federal tax information in accordance with IRS Publication 1075 where systems process it.

Document the controls in a System Security Plan and the artifacts CMS needs for the Authority to Connect decision under 45 CFR 155.280 oversight.

Keep the controls current through periodic assessment and, from Version 2.2, information system continuous monitoring.

Framework in Context

MARS-E belongs to the CMS control baselines that descend from the CMS Acceptable Risk Safeguards and NIST SP 800-53: MARS-E for Exchanges and Medicaid, CHIP and BHP agencies, the Non-Exchange Entity GRC Framework of 2019 for web-brokers and direct enrollment entities, and now ARC-AMPE for both. The ACA entities also carry IRS Publication 1075 duties for federal tax information received through the Hub, HIPAA Security Rule duties where they are covered entities, and the Computer Matching provisions of the Privacy Act for eligibility data sharing under 155.260(e). CMS lists the current ARC-AMPE volumes, including a September 18, 2026 overlay for Independent Dispute Resolution Entities with a September 18, 2027 compliance date, on its Marketplace regulations and guidance page.

Common Framework Mappings

Organizations map MARS-E and its successor ARC-AMPE to the frameworks below because the control catalog is a tailored NIST SP 800-53 baseline and the same evidence serves HIPAA, IRS and audit obligations.

Mapped frameworks include:

CIS Controls v8.1

FedRAMP Security Assessment Framework

HIPAA (NIST SP 800-66 Rev. 2)

HITRUST CSF v11.5

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2