CMS Pub. 100-17, ch. 117_systems_security, § 3.5.1

(Rev. 15.1; Issued: 07-17-25; Effective: 02-28-25; Implementation: 08-18-25)

Key Requirements

At least 1/3 of controls must be tested each year, and all controls shall be tested over a 3-year period.

CMS identifies which control families must be tested each year.

A critical factor for maintaining on-going compliance with FISMA and the Federal Managers’

Financial Integrity Act of 1982 (FMFIA) is for Business Owners in coordination with

developers/maintainers, to annually test their internal controls and dedicate sufficient resources to

accomplish this test. These resources include budget (if external resources are to be used to support

the testing) and person-hours (if internal personnel are to be engaged in this activity). They are

required to schedule and perform the test; and oversee the development and completion of

applicable POA&Ms for vulnerabilities noted during the annual testing.

The annual FA is documented, tracked, and reported in the CFACTS. The purpose of annual FA

testing (i.e., validation) is to examine and analyze implemented security safeguards in order to

provide evidence of compliance with applicable laws, directives, policies, and requirements

regarding information security. The annual FA is intended to validate the MAC ARS controls to

determine the extent to which the controls are:

- Implemented correctly

- Operating as intended

- Producing the desired outcome with respect to meeting the security requirements for the

system

The annual FA testing requirement has been interpreted by OMB as being within 365 calendar days

of the prior test. Over a 3-year period, all MAC ARS controls shall be tested. This means a subset

(no less than one-third [1/3]) of the MAC ARS controls shall be tested each year so that all security

controls are tested during a 3-year period. In an effort to standardize testing and results

summarization, a 3-year rotation of MAC ARS control families was established by CMS. After the

3-year rotation is completed, the testing rotation shall be repeated until notification from CMS is

received. As control families are added or removed, CMS reserves the right to change the controls

that must be tested each year.

To fulfill the annual FA validation obligation, the FA shall be conducted by an independent agent

or team. This can be any internal/external agent or team that is capable of conducting an impartial

assessment of an organization’s information system. Impartiality implies that the assessors are free

from any perceived or actual conflicts of interest with respect to the development, operation, and/or

management chain of command associated with the information system or to the determination of

MAC ARS effectiveness. All management-directed and independent testing conducted within

365 days of the attestation due date may be used to meet the requirement for the annual security

controls (i.e., FA) testing.