Reminders for Securing Your CMS Portal Login Credentials 

You must never share your CMS Portal login credentials (user ID and password) with anyone. This includes, but is not limited to, coworkers, agencies, or the CMS IT Service Help Desk. Allowing others access to your login credentials puts both your and your consumers’ personally identifiable information (PII) at risk. PII includes Social Security Numbers, addresses, phone numbers, and your NPN, among other information. Learn more about PII here. 

You should always make sure you are maintaining good password hygiene to prevent unauthorized access to your and your consumers’ information. The following tips will help you keep your password secure and private. 

• Use passwords that are 8 characters or longer. Include upper and lowercase letters, numbers, and special characters. 

• Avoid passwords that could be easily guessed by people you know or that contain easily accessible information (such as from a social media account). 

• Avoid passwords that contain personal information (such as nicknames, birthdays, your address, or the names of family members) or common words or phrases.  

• Change your password on a frequent basis to make it more difficult for hackers to track. 

• Use a password generator to help you ensure your password is strong and secure. 
• Use multi-factor authentication (MFA), a method of authentication that requires users to provide two or more elements of verification to access a system, whenever possible to make it more challenging for hackers to gain unauthorized access to accounts.  

Report any potential and confirmed breaches and incidents to the CMS IT Service Desk at (410) 786-2580 or 1 (800) 562-1963 or via email at CMS_IT_Service_Desk@cms.hhs.gov within 24 hours of knowledge of the breach. Reporting a breach or incident is not an admission of wrongdoing. If you’re unsure whether the situation is a breach, an incident, or nothing at all, it is better to report it. Additionally, reset your CMS Portal password as soon as possible: 

1. Visit the CMS Enterprise Portal landing page.
2. Click the “Password” link under the “Login” button.
3. Enter your Federally-facilitated Marketplace (FFM) user ID. Click the “Next” button. An error will display if invalid data is entered.
4. Answer the challenge questions and enter a new password in the “Create New Password” field and again in the “Confirm New Password” field. An error will display if invalid data is entered. After successfully submitting your information, you will receive confirmation that your information has been successfully verified. You will receive an email notification indicating that you successfully changed your password.
5. Click the link in the confirmation message to log into the CMS Enterprise Portal

Additional resources: 

• FAQ: How to maintain good password hygiene 
• FAQ: How do I reset my Centers for Medicare & Medicaid Services (CMS) Enterprise Portal account password?

• Tip sheet: Best Practices for Cybersecurity 

• Webinar slides: The Marketplace and Cybersecurity 

Have questions? For additional assistance, contact the Agent/Broker Email Help Desk via email at FFMProducer-AssisterHelpDesk@cms.hhs.gov.