[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-357514-105":53,"doc-detail-357514-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","migration-from-mars-e-to-arc-ampe-assessment-authorization-and-monitoring-ca-controls","Migration from MARS-E to ARC-AMPE Assessment, Authorization, and Monitoring (CA) Controls","","White paper guidance for Administering Entities (AEs) to upgrade System Security and Privacy Plans (SSPPs) from MARS-E to ARC-AMPE controls. It explains how Affordable Care Act (ACA) marketplace operations rely on secure handling of consumer data, and how CMS oversight drives compliance expectations. The document focuses on the Assessment, Authorization, and Monitoring (CA) control family, including control mapping and requirements tailored for AE administration.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":46,"@type":70,"position":76},"https://docshare.wps.com/template/paper-templates/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/migration-from-mars-e-to-arc-ampe-assessment-authorization-and-monitoring-ca-controls/357514/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/migration-from-mars-e-to-arc-ampe-assessment-authorization-and-monitoring-ca-controls/357514.png","ImageObject",442,249,{"name":88,"@type":89},"Aditya","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-17","2026-09-23",true,{"@type":98,"interactionType":99,"userInteractionCount":79},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is the purpose of this white paper?","Question",{"text":108,"@type":109},"It guides Administering Entities (AEs) in upgrading System Security and Privacy Plans (SSPPs) from MARS-E to ARC-AMPE controls, focusing on CA requirements.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How does CMS oversee Administering Entities in the marketplace environment?",{"text":113,"@type":109},"CMS oversees AEs through audit and compliance expectations, data protection and cybersecurity control requirements, operational policy adherence, incident reporting and corrective actions, and annual renewal of Authority to Connect (ATC) or Authority to Operate (ATO).",{"name":115,"@type":106,"acceptedAnswer":116},"What does ARC-AMPE replace and how is it positioned?",{"text":117,"@type":109},"ARC-AMPE is a CMS framework published as a replacement for MARS-E security and privacy guidelines, with the content organized by volume and control families.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},357514,1791684660,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":45,"category_name":46,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":79,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":25,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":47},962085564549,"https://ap-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45","WHITE PAPER  \nMigration from MARS-E to ARC-AMPE Assessment, Authorization, and Monitoring (CA) Controls  \nCMS requirements for Administering Entities  \nJESSICA PAYNE, CONSULTANT  \nIAN WALTERS , PRINCIPAL  \n[877-224-8077](877-224-8077 | info@coalfire.com | Coalfire.com)[ |](877-224-8077 | info@coalfire.com | Coalfire.com)[ info@coalfire.com](877-224-8077 | info@coalfire.com | Coalfire.com)[ |](877-224-8077 | info@coalfire.com | Coalfire.com)[ Coalfire.com](877-224-8077 | info@coalfire.com | Coalfire.com)  \nTable of contents  \nPurpose.........................................................................................................................................................................................2  \nBackground ..................................................................................................................................................................................3  \nAffordable Care Act ....................................................................................................................................................................3  \nCMS oversight............................................................................................................................................................................3  \nARC-AMPE ................................................................................................................................................................................3  \nControl mapping ..........................................................................................................................................................................4  \nAssessment, Authorization, and Monitoring (CA) ......................................................................................................................5  \nReferences..................................................................................................................................................................................12  \nLegal disclaimer.........................................................................................................................................................................13  \nPurpose  \nThis white paper provides a guide for Administering Entities (AEs) to upgrade their System Security and Privacy Plans (SSPPs) from the Minimum Acceptable Risk Standards for Exchanges (MARS-E) to the Acceptable Risk Controls for ACA, Medicaid, and Provider Entities (ARC-AMPE) .  \nDue to the substantial number of controls, and to facilitate ease of use , this white paper is one of a series of 20 which divides the ARC-AMPE by control family. This white paper addresses the Assessment, Authorization, and Monitoring controls:  \n\n| ARC-AMPE Control Families |  |\n| --- | --- |\n| Control Family | Number of Controls |\n|  |  |\n| Access Control | 51 |\n| Awareness and Training | 9 |\n| Audit and Accountability | 19 |\n| Assessment, Authorization, and Monitoring (This Document) | 12 |\n| Configuration Management | 31 |\n| Contingency Planning | 23 |\n| Identification and Authentication | 24 |\n| Incident Response | 16 |\n| Maintenance | 16 |\n| Media Protection | 9 |\n| Physical and Environmental Protection | 19 |\n| Planning | 6 |\n| Program Management | 28 |\n| Personnel Security | 9 |\n| Personally Identifiable Information Processing and Transparency | 10 |\n| Risk Assessment | 12 |\n| System and Services Acquisition | 34 |\n| System and Communications Protection | 34 |\n| System and Information Integrity | 34 |\n| Supply Chain Risk Management | 6 |\n\nBackground  \nAffordable Care Act  \nThe Affordable Care Act (ACA) revolutionized access to healthcare in the United States by establishing Health Insurance Marketplaces (HIMs) . Enhanced Direct Enrollment (EDE) is an ACA innovation that allows third-party entities, such as insurers and web-brokers, to offer consumers a seamless application and enrollment experience directly through their platforms. This approach imp","cbCaic88EZoDuRPY","https://ap.wps.com/l/cbCaic88EZoDuRPY","pdf",346704,"English","# Purpose\n# Background\n## Affordable Care Act\n## CMS oversight\n## ARC-AMPE\n# Control mapping\n## Assessment, Authorization, and Monitoring (CA)\n# References\n# Legal disclaimer","[{\"question\":\"What is the purpose of this white paper?\",\"answer\":\"It guides Administering Entities (AEs) in upgrading System Security and Privacy Plans (SSPPs) from MARS-E to ARC-AMPE controls, focusing on CA requirements.\"},{\"question\":\"How does CMS oversee Administering Entities in the marketplace environment?\",\"answer\":\"CMS oversees AEs through audit and compliance expectations, data protection and cybersecurity control requirements, operational policy adherence, incident reporting and corrective actions, and annual renewal of Authority to Connect (ATC) or Authority to Operate (ATO).\"},{\"question\":\"What does ARC-AMPE replace and how is it positioned?\",\"answer\":\"ARC-AMPE is a CMS framework published as a replacement for MARS-E security and privacy guidelines, with the content organized by volume and control families.\"}]","Migration from MARS-E to ARC-AMPE Assessment, Authorization, and Monitoring (CA) Controls | PDF",1790130226]