Information Security and Privacy Library

Information Security and Privacy Library

The Information Security and Privacy Library is intended to serve as a one-stop resource for all of your information security needs.  The library contains a comprehensive listing of policy guidance, standards, regulations, laws, and other documentation related to the CMS Information Security and Privacy Program.  Use the convenient search tool below to quickly locate relevant policies, procedures and guidelines.

If you experience any difficulties in finding the appropriate document or have a general security question, please feel free to send an email to the CISO Team at CISO@cms.hhs.gov.

Title Version Date
Acceptable Risk Safeguards 5.1x
5.1x
2023-07-26
ARS 3.0 High Differential Analysis
1.2
2017-04-26
ARS 3.0 Low Differential Analysis
1.1
2017-04-26
ARS 3.0 Moderate Differential Analysis
1.3
2017-04-26
ARS 3.1 Excel Export
1.0
2018-01-19
ARS 3.1 FAQ
1.1
2021-03-23
ARS 3.1 Publication
3.1
2021-03-29
Business Impact Analysis (BIA) Process and Template
2.0
2021-02-16
Business Partner System Security Manual (BPSSM)
14
2018-06-15
CIO Memorandum CMS Strategy for Encrypting Sensitive Information
1.0
2021-05-06
CIO Memorandum: Recovery Time Objective Requirements
1
2020-07-22
CISO Memorandum 18-01 - AC-2 Account Management
2018-08-02
CISO Memorandum 20-01: CMS Implementation of the HHS Plan of Action and Milestones
1
2020-08-05
CISO Memorandum 21-01: Best Practices and Guidance for the Use of Approved CMS Collaboration Tools
1.0
2021-03-31
CISO Memorandum 21-02 HVA Identification Criteria
1
2021-08-17
CMS Information Security Contract Clause / Provision (Legacy)
1.0
2013-04-09
CMS Information Security Risk Acceptance Template
2018-10-19
CMS Information Systems Security and Privacy Policy (IS2P2)
3.0
2022-06-16
CMS Penetration Testing Rules of Engagement Template
1.0
2019-01-09
CMS Privacy Handbook
2.0
2022-05-12
CMS Privacy Impact Assessment (PIA) Standard Operating Procedures (SOP)
1.0
2019-08-08
CMS Required Control Baselines Quick Reference Guide (QRG)
1.1
2017-12-05
CMS Security and Privacy Language for Procurements
1.9
2020-12-16
CMS System ATO Request Form
4.3
2021-04-08
DevSecOps Checklist
20200702
2021-04-20
HHS Department Waiver/Risk-Based Decision Form
2
2019-07-10
HHS End of Life Operating Systems, Software, and Applications Policy, Updated
2
2016-05-19
HHS PIA and PTA Writers' Handbook
2.0
2018-10-10
HHS Rules of Behavior for Use of HHS Information and IT Resources Policy
2.2
2020-02-14
HHS Standard for Encryption of Computing Devices and Information
2
2016-12-14
Information System Risk Assessment Template
4.1
2018-10-19
Interconnection Security Agreement (ISA)Template
1.3
2019-01-09
IS2P2 2.0 Updates
2019-07-30
ISPG Training Catalog
2023
2023-02-06
ISSO Letter, Guide, Welcome Packet
1.0
2020-06-18
Key Enterprise System Security Lifecycle (KESSeL) Artifacts
1.0
2020-06-18
Key Management Program Manual
V1
2022-11-17
Memorandum of Understanding (MOU) Template
1.2
2019-01-09
NIST Information System Contingency Plan Template
2019-02-13
Plan of Action and Milestones Process Guide
1.1
2021-03-23
Privacy Program Manual
v1
2022-11-17
RMH Chapter 01 Access Control
1.0
2020-12-01
RMH Chapter 05 Configuration Management
1.3
2021-03-23
RMH Chapter 08 Incident Response
2.1
2021-03-23
RMH Chapter 08 Incident Response - Incident Preparation Checklist
1.0
2020-07-29
RMH Chapter 08 Incident Response - Incident Report Template
1.0
2021-07-19
RMH Chapter 08 Incident Response - Tabletop Exercise Template
1.0
2020-07-29
RMH Chapter 09 Maintenance
1.0
2020-04-07
RMH Chapter 10 Media Protection
1.0
2019-08-06
RMH Chapter 11 Physical and Environmental Protection
1.1
2021-03-23
RMH Chapter 12 Security and Privacy Planning
2.1
2021-03-17
RMH Chapter 13 Personnel Security
1.0
2019-11-12
RMH Chapter 14 Risk Assessment
1.3
2021-04-13
RMH Chapter 15 System and Services Acquisition
1.0
2020-04-07
RMH Chapter 16 System and Communications Protection
1.0
2020-07-10
RMH Chapter 19 Privacy
1.0
2018-10-26
RMH Chapter 2 Awareness and Training
1.0
2019-02-27
RMH Chapter 4 Security Assessment and Authorization
1.1
2020-12-07
RMH Chapter 6 Contingency Planning
1.4
2021-05-25
RMH Chapter 6 Supplemental Contingency Planning Exercise Procedures
1.1
2019-04-12
Security Assessment Plan Template
3.0
2019-01-09
Security Assessment Report Template
2.0
2019-01-09
Security Impact Analysis Template and One Pager
1.0
2020-02-04
Tool: System Categorization Worksheet
1.2
2021-01-19
Use of Government Furnished Equipment (GFE) During Foreign Travel
As Amended
2018-12-27
Vulnerability Disclosure Policy Program
1.0
2021-02-26
Page Last Modified:
09/06/2023 04:57 PM
Help with File Formats and Plug-Ins