Data Management Self-Attestation Questionnaire

To ensure safeguards are in place for CMS Controlled Unclassified Information (CUI), CMS requires research organizations to complete an evidence-based data management plan, known as the Data Management Plan Self-Attestation Questionnaire (DMP SAQ) (DOCX).  

CMS’ Data Privacy Safeguard Program (DPSP) is responsible for reviewing and approving the completed DMP SAQ. The DPSP team can be contacted at DPSP@cms.hhs.gov.  

Standard DMP SAQ : The DMP SAQ (DOCX) is based on the CMS Acceptable Risk Safeguards (ARS) and documents the security and privacy controls implemented by the research organization. The DMP SAQ is a computing environment-level plan and all studies using the approved computing environment can be covered by a single DMP SAQ. 

Approved DMP SAQs are valid for one year, after which organizations will need to recertify and update the DMP SAQ to capture any changes to their environments. Any changes to an organization’s environment prior to the recertification date require notification to CMS within 15 days of the change.  
 

DMP SAQ for Federal Agencies: The DMP SAQ for Federal Agencies (DOCX) is for federal agencies interested in leveraging a system with a current Authority to Operate (ATO) from the agency’s Authorizing Official (AO). The requesting federal agency must provide the ATO letter as evidence as required in Section 3 of the DMP SAQ. DMP SAQs for Federal Agencies are valid for one year or until the expiration of the ATO, whatever comes first.  If an ATO does not exist, federal agencies can complete the standard DMP SAQ.
 

Standard DMP SAQ: To get started with the DMP SAQ (DOCX), refer to the following documents: 

DMP SAQ 5.1 

CMS has updated the DMP SAQ to reflect the latest security standards, CMS ARS 5.1. Organizations may begin using the DMP SAQ version 5.1 now, and it will be required starting August 11, 2026.