ARC-AMPE
Acceptable Risk Controls for ACA, Medicaid, and Partner Entities is the CMS security and privacy control framework that replaced MARS-E for state-based marketplaces, state Medicaid and CHIP agencies, and Basic Health Program agencies (called Administering Entities), and replaced the separate EDE and DE security requirements for Direct Enrollment Entities.
CMS published version 1.0 on March 4, 2025. It rebases everything on NIST SP 800-53 Revision 5, merges privacy and security into one control set, and adds overlays for federal tax information.
Volume I explains the framework and roles; Volume II is the control catalog and doubles as the format for the System Security and Privacy Plan.
In writing, a covered entity needs the SSPP for each system, an information security risk assessment, a privacy impact assessment, an incident response plan, contingency plan, configuration management plan, and the policies behind every control family, plus an authorization package built on an independent assessment.
help
Who has to comply
Administering Entities: state-based marketplaces, state Medicaid and CHIP agencies, and Basic Health Program agencies that connect to the federal data services hub, plus their contractors. Direct Enrollment Entities: web brokers, issuers, and EDE partners that enroll consumers through the federal marketplace.
What the assessor asks to see
The assessor asks for the system boundary and data flow diagrams, the SSPP in Volume II format, the risk assessment and privacy impact assessment, policies and procedures for each control family, access control and audit log evidence, vulnerability scan and penetration test results, configuration baselines, the incident response and contingency plans with test records, training records, interconnection security agreements, and the open plan of action and milestones.
Transition from MARS-E
ARC-AMPE v1.0 was published March 4, 2025 with a one-year transition. On March 4, 2026 CMS retired MARS-E v2.2 for Administering Entities. Coalfire reports a version 1.03 update to the Administering Entities volume.
Who helps with ARC-AMPE
A specialized consulting market that grew up around MARS-E: security assessment firms, SSPP authors, and managed compliance providers for state agencies and DE partners. Engagements typically run a MARS-E to ARC-AMPE gap analysis, re-author the SSPP in the Volume II format, and prepare for the independent assessment.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Consultants
Be the first ARC-AMPE consultant listed here
The people reading this are working out who can help them get there.
Who assesses ARC-AMPE
Independent third-party security and privacy assessors engaged by the entity (security control assessment for Administering Entities; third-party auditors under the EDE program for Direct Enrollment Entities). CMS reviews the assessment package and grants the authority to connect or approval to operate. There is no certification body.
CMS defines assessor independence expectations and accepts or rejects packages.
Assessors
Be the first ARC-AMPE assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for ARC-AMPE
Tools that name this framework in their own material.
Tools
Be the first tool listed for ARC-AMPE
Buyers comparing software for this standard land here first.
Related reading
- MARS-E to ARC-AMPE: A Guide for State Medicaid AgenciesSets out the three changes that stop old MARS-E documentation being relabelled, and how to remap an existing control posture.Amazon Web Services
- CMS Publishes ARC-AMPEAn assessor's summary of the two volumes, the AE and DEE control counts, and the compliance dates for each entity type.Coalfire
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for ARC-AMPE
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with ARC-AMPE
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.