CMS Pub. 100-17, ch. 117_systems_security, § 3.5.3

(Rev. 15.1; Issued: 07-17-25; Effective: 02-28-25; Implementation: 08-18-25)

Key Requirements

In the MAC ARS, many security documents and recurring processes (e.g., log reviews, access

reviews, document reviews, etc.) require timely execution on a yearly, bi-annual (every 6 months),

quarterly, monthly, weekly or daily basis.

It is important to note that events such as Penetration Tests, Contingency Plan Tests, Federal

Information Security Management Act (FISMA) Submissions, etc. are not subject to the timing

conditions described below.

In order to assure that security documents and recurring processes, as defined above, are

reviewed/processed timely, the following timing requirements apply:

• Yearly/365 days: Any document/process to be reviewed on a yearly basis shall be performed no

later than the same calendar month each year. For example, if you review your ISRA or ITSCP

on February 14th, then the next review must take place no later than the end of February during

subsequent years. This can be applied to reviews to be performed over multiple years. If you

perform a review in February and a review is due 3 years later, it must be performed no later

than the end of February for the year when the review is to be performed again. The only

exceptions to this annual/yearly compliance condition are deliverables whose annual due date

are set and distributed by CMS, such as the annual FA submission. If an annual review is

performed prior to the month of the last annual review, this month now needs to be considered

the calendar month for the annual review the following year.

• Bi-Annual/Every 6 Months/180 days: The months designated for a 6-month document/process

review shall occur every 6 months and be consistent from year to year. For example, if you

perform an initial review during February, then the next review must be performed within the

month of August. In subsequent years, the review must be performed within the months of

February and August. Those months then become your standard months for performing the

review.

• Quarterly/90 days: The months designated for a quarterly document/process review shall occur

every 3 months and be consistent from year to year. A quarterly document/process review shall

be scheduled on the same day of each designated month and be performed within 4 business

days** before or after the scheduled review date of those months. That is, if you choose July 16

as your review date, then your review date will be the 16 in each designated month. The

following table demonstrates when quarterly reviews must be performed based on the day your

scheduled review date occurs.

Earliest Review Review Target Day Latest Review

Previous Tuesday Monday Following Friday

Previous Wednesday Tuesday Following Monday

Previous Thursday Wednesday Following Tuesday

Previous Friday Thursday Following Wednesday

Previous Monday Friday Following Thursday

**Federal holidays or incidental office closures will not affect these timeframes.

• Monthly/30 days: The document/process review shall be performed within 2 business days**

before or after the scheduled review completion date each month. The exact date of the monthly

review shall not change month to month. That is, if you choose July 16th as your review

completion date, then your review date will be the 16th in every subsequent month. The

following table demonstrates when monthly reviews must be completed based on the day your

scheduled review date occurs.

Earliest Review Completed Review Target

Day

Latest Completed Review

Previous Thursday Monday Following Wednesday

Previous Friday Tuesday Following Thursday

Previous Monday Wednesday Following Friday

Previous Tuesday Thursday Following Monday

Previous Wednesday Friday Following Tuesday

**Federal holidays or incidental office closures will not affect these timeframes.

• Weekly/7 days: Weekly/7 days document/process reviews shall be performed on the same day

every week. If the scheduled review day falls on a holiday, the previous or subsequent business

day can be used as your review target date, returning to the original target date in subsequent

weeks.

• Daily/24 hours: Daily/24 hours document/process reviews shall be performed on the next

business day. If the day of the scheduled review falls on a Saturday, then the review is

performed on a Monday. If the day of the scheduled review falls on a federal holiday or an

incidental office closure, then the review is performed the next business day. This may cause

more than one review to be performed on the same day.

If the business partner wishes to change the timing cycle of a review, the business partner is

required to shorten the timing cycle and not lengthen the timing cycle to attain the new performance

date. For example, if the annual/yearly review of the security and privacy plan is being performed

in June during year 1 and the business partner desired to change the review date for year 2, they

would be required to review the security and privacy plan in a month prior to June. That month

would then become the review month going forward.

Exceptions to the timing requirements can be implemented with the approval of the CMS ISSO.

These can be one-time exceptions (e.g., a yearly review of a disaster recovery test is performed

after an established month due to scheduling issues with the recovery facility).