Summary

Starting August 26th, 2026, the CMS Hybrid Cloud Team will begin the Q3 2026 CMS Enterprise Security Campaign.

Any findings will be tracked via Jira tickets and assigned to the respective teams for remediation. The Q3 CMS Enterprise Security Campaign is targeting 46 Critical Common Vulnerabilities and Exposures (CVEs) that pose a high risk to CMS systems.

Benefits

Resolving findings in customers' Jira tickets ensures CMS systems remain secure. Participating in proactive, routine security activities, such as this CMS Enterprise Security Campaign, reduces the risk of unauthorized and/or malicious activity.

The CMS Enterprise Security Campaign will target and identify the following vulnerabilities and CVEs:

Targeted Vulnerabilities and Common Vulnerabilities and Exposures (CVEs)

Note: Operating System (OS)-level findings are remediated by the CMS Hybrid Cloud Team for customers who receive regular CMS Gold Image patching services. Please note that CMS customers are responsible for patching any software installed on top of the provided CMS Gold Image.

Additional Security Campaign Targets

In addition to the Tenable vulnerabilities, we will be performing a review of AWS Config settings across the enterprise. If your account does not meet the required AWS Config baseline for CMS Hybrid Cloud, our team will resolve the issue. No action is required by your team for these AWS Config updates. This is included here for notification purposes only.

Expected Actions

• CMS customers with findings will receive a Jira ticket.
  • If you would like to obtain an exemption, you will need to complete an attestation.
• CMS customers should resolve all received Jira tickets as soon as possible.
  • For help, please refer to the "Questions or Concerns" section below for instructions on how to submit a Hybrid Cloud Support ticket.
• Failure to resolve findings can lead to compromised systems that result in greater risks for unauthorized and/or malicious activity.
• Unresolved system flaws will result in Plan of Action and Milestones (POA&Ms) being issued against the Federal Information Security Modernization Act (FISMA) boundary.

Timeline

• August 26, 2026: CMS customers with findings will receive Jira tickets for the findings noted in the "Benefits" section above.

Additional Information

• Learn about CMS Enterprise Security Campaigns
• Exemption Policy Guide

Questions or Concerns

We look forward to helping you and your team. Reach out to your IUSG Hosting Coordinator with any questions. For further help, please fill out a Hybrid Cloud Support ticket as a CMS Cloud: Service Request specifying Request Type as "Security Posture Management - Findings".

Model Data Sharing Initiative Makes New Model Participation Data Available to Researchers

CMS is pleased to announce the availability of Research Identifiable Files (RIFs) for the CMS Innovation Center’s Increasing Organ Transplant Access (IOTA) Model.

The IOTA Model joins the existing models that have released data since 2022 as part of the CMS Innovation Center Model Data Sharing (CMDS) initiative. Each model in the release may have a separate file for each of the three types of participation data: entities, providers, and beneficiaries, if data is available. Not all models have data for each participation file type.

This release contains data up to June 30, 2026. To access this information, your Data Use Agreement must be amended to add the 2026 service year.

For information about all CMDS participating models and data files, please visit the CMMI Model Data Sharing Model Participation Data Initiative page.

Follow us on: X (formerly Twitter)  | LinkedIn: Centers for Medicare & Medicaid Services

Visit the CMS Innovation Center website