George Butterfield actually said...
This document indicates that CMS postponed a final security assessment screening, but in its place, CMS did put in place a number of mitigation measures, and it concluded that these measures would mitigate any security risk.
10/29/2013