Bring your MARS-E controls and evidence together in one place

MARS-E 2.0 is the Minimum Acceptable Risk Standards for Exchanges, a CMS document suite of security and privacy requirements for Affordable Care Act systems, published on 10 November 2015. It has four volumes: a harmonised framework, the standards themselves, a catalogue of controls and a system security plan template. The controls adapt NIST SP 800-53 Rev. 4 and add ACA and IRS Publication 1075 requirements.

MARS-E applies to ACA Administering Entities: federal and state Exchanges or Marketplaces, state Medicaid agencies, Children's Health Insurance Program agencies and state agencies administering the Basic Health Program. Contractors that build or run systems for these entities are also expected to implement the controls. Compliance was a condition of CMS granting an Authority to Connect to the Data Services Hub.

No, MARS-E has been replaced. CMS issued MARS-E version 2.2 in 2021 and then published the Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE) in March 2025. ARC-AMPE states that it supersedes and replaces MARS-E and the Non-Exchange Entity GRC Framework, and it is based on NIST SP 800-53 Rev. 5. MARS-E remains relevant for legacy documentation and transition work.

The main consequence is losing or being refused access to federal data. CMS used evidence such as the system security and privacy plan, security assessment report, penetration test results and plan of actions and milestones to decide whether to approve an Authority to Connect to the Data Services Hub. Unresolved findings can delay or block that connection, which Exchanges and Medicaid agencies need for eligibility checks.

MARS-E 2.0 is built on NIST SP 800-53 Rev. 4. It uses the same 18 security control families and the 8 privacy families from Appendix J, then adds CMS implementation standards, ACA-specific controls such as email and fax usage, and IRS Publication 1075 requirements. If you already run an SP 800-53 programme, much of your existing control work carries across to MARS-E.

MARS-E is a separate CMS requirement, not a replacement for HIPAA or ISO 27001. HIPAA's Security Rule sets broader safeguards for health information, while MARS-E prescribes detailed NIST-based controls for ACA systems. ISO 27001 is a voluntary certifiable standard. Many controls overlap, such as access control, logging and incident response, so evidence can often be reused across all three.

You comply by implementing the Volume III controls, documenting them in the system security plan from Volume IV, and having them independently assessed. Typical artefacts include a security assessment report, vulnerability scans, penetration test results, a privacy impact assessment and a plan of actions and milestones for open findings. New programmes should now work to ARC-AMPE, which has replaced MARS-E.

Yes, on request. MARS-E 2.0 is mapped in OneClickComply's control library and available on request, rather than being a standard framework you can switch on today. Once enabled, you can track its controls, collect evidence automatically and reuse that evidence across mapped frameworks such as NIST SP 800-53, HIPAA and ISO 27001. OneClickComply does not grant CMS authorisations.