The Centers for Medicare & Medicaid Services Did Not Account for National Security Risks in Its Enterprise Risk Management Processes

We recommend that the Centers for Medicare & Medicaid Services, as part of its ERM program, implement a process to assess all of its programs for national security risks in accordance with OMB Circular No. A-123's requirement to include new or emerging risks in the risk profile.