ARC AMPE & MARS-E Compliance

Learn what ACA, Medicaid, and partner organizations need to know about the new compliance framework.

ARC AMPE & MARS E Compliance

State Health Insurance Exchanges, Medicaid agencies, and partner entities must meet security and privacy requirements established by the Centers for Medicare & Medicaid Services (CMS) to protect sensitive Affordable Care Act (ACA) and Medicaid data.

CMS has introduced the ARC AMPE (Acceptable Risk Controls for ACA, Medicaid, and Partner Entities) framework to replace the legacy MARS E standard and align with NIST SP 800 53 Revision 5.

JANUS helps organizations navigate this transition with end-to-end cybersecurity assessment, advanced penetration testing, and ARC AMPE implementation support so you can meet CMS expectations with confidence.

Comparison Table: MARS-E vs. ARC-AMPE

Feature	MARS-E (Legacy)	ARC-AMPE (New/Current)
Full Name	Minimum Acceptable Risk Standards for Exchanges	Acceptable Risk Controls for ACA, Medicaid, and Partner Entities
Underlying Framework	Based on NIST 800-53 Rev. 4	Based on NIST 800-53 Rev. 5
Control Count	Lower baseline (approx. 300+ controls)	Significantly higher (approx. 402 baseline controls)
Privacy Integration	Privacy treated as a separate domain	Integrated PT (PII Processing & Transparency) family
Data Residency	Some offshore flexibility	U.S.-Only (No offshore processing or storage)
Infrastructure Scope	Often nuanced by environment (Cloud)	Universal (same for Cloud, On-Prem, & Hybrid)
SSPP Format	Microsoft Word	Microsoft Excel
Mandatory Deadline	Being phased out	Must be implemented by March 4, 2026

Why Choose JANUS

State healthcare exchange and Medicaid cyber assessments, including MARS‑E and now ARC‑AMPE, are long‑standing specialty areas in JANUS’ consulting practice. JANUS has provided security assessments and advisory services to CMS and healthcare clients for more than 20 years, with deep experience interpreting and applying NIST, CMS, and HIPAA requirements in complex environments.

Full time subject matter experts with extensive ACA/Medicaid security, privacy, and penetration testing experience.
Proven capability delivering MARS E and CMS aligned assessments on schedule, with a strong track record of working collaboratively with CMS on your behalf.

Independent, evidence driven reporting that supports system authorization decisions and audit readiness while reducing rework and delays.
Organizations seeking a partner for ARC AMPE and MARS E compliance engage JANUS for its combination of technical depth, regulatory insight, and ability to integrate security, privacy, and risk management into one coherent program rather than isolated projects.

Speak with us and find out why 20% of states requiring MARS-E compliance trust JANUS and have awarded us multiple-year contracts.

Request a Consultation

ARC‑AMPE & MARS‑E services

JANUS provides a structured portfolio of services to support entities through the full ARC‑AMPE lifecycle while maintaining continuity with existing MARS‑E obligations.

ARC‑AMPE readiness and gap assessments

Evaluate current MARS‑E‑based controls, documentation, and SSPPs against the new ARC‑AMPE baseline derived from NIST SP 800‑53 Rev. 5.

Identify gaps across 20 control families, including access control, incident response, privacy, system and communications protection, and supply chain risk management.

Control mapping and remediation planning

Map MARS‑E controls, policies, and procedures to ARC‑AMPE requirements to preserve prior investments while meeting updated expectations.

Develop prioritized remediation plans that balance CMS compliance, risk reduction, and operational reality.

System Security and Privacy Plan

A System Security and Privacy Plan (SSP) is a requirement for compliance with MARS-E.

An SSP has two main purposes. First, it describes the security and privacy environment for IT systems. Secondly, it documents the implementation of security and privacy controls.

These controls must address all relevant ACA data that a healthcare organization handles. It includes data that the entity receives, stores, processes,
and transmits.

MARS-E Readiness and Compliance Assessment

A readiness assessment evaluates your current
and security controls. It tells you how your
processes compare to the MARS-E standards. A comprehensive analysis will also examine your current SSP. A complete audit reviews your full MARS-E compliance.

A MARS-E Compliance Assessment includes:

– Policies and procedures
– Documentation
– System configurations

The audit will identify any gaps in your procedures or documentation. The auditor will work with you to develop a remediation plan to prioritize the necessary changes and get back into compliance more efficiently.

Speak With Us

Importance of MARS-E Compliance

Following MARS-E standards is critical to protect users and healthcare organizations. Non-compliance can result in substantial fines and penalties. Maintaining robust cybersecurity practices as found in MARS-E protects user data. It also protects the ACA marketplace or other administering entities. As the number of cyber-attacks continues to grow, a successful cyber-attack can deal a critical blow to an organization, and it ultimately undermines user confidence.