diff --git a/chpl/chpl-service/src/main/java/gov/healthit/chpl/certificationCriteria/CertificationCriteriaManager.java b/chpl/chpl-service/src/main/java/gov/healthit/chpl/certificationCriteria/CertificationCriteriaManager.java
index b5f00a2406..77ae8be90f 100644
--- a/chpl/chpl-service/src/main/java/gov/healthit/chpl/certificationCriteria/CertificationCriteriaManager.java
+++ b/chpl/chpl-service/src/main/java/gov/healthit/chpl/certificationCriteria/CertificationCriteriaManager.java
@@ -16,6 +16,7 @@
 import gov.healthit.chpl.certificationCriteria.CertificationCriterionWithAttributes.AllowedAttributes;
 import gov.healthit.chpl.dao.CertificationCriterionDAO;
 import gov.healthit.chpl.domain.CertifiedProductSearchDetails;
+import gov.healthit.chpl.permissions.ResourcePermissionsFactory;
 import gov.healthit.chpl.util.CertificationResultRules;
 import gov.healthit.chpl.util.DateUtil;
 import lombok.extern.log4j.Log4j2;
@@ -26,14 +27,17 @@ public class CertificationCriteriaManager {
     private CertificationCriterionDAO certificationCriterionDao;
     private CertificationResultRules rules;
     private CertificationCriterionComparator criterionComparator;
+    private ResourcePermissionsFactory resourcePermissionsFactory;
 
     @Autowired
     public CertificationCriteriaManager(CertificationCriterionDAO certificationCriterionDao,
             CertificationResultRules rules,
-            CertificationCriterionComparator criterionComparator) {
+            CertificationCriterionComparator criterionComparator,
+            ResourcePermissionsFactory resourcePermissionsFactory) {
         this.certificationCriterionDao = certificationCriterionDao;
         this.rules = rules;
         this.criterionComparator = criterionComparator;
+        this.resourcePermissionsFactory = resourcePermissionsFactory;
     }
 
     @Transactional
@@ -65,10 +69,10 @@ public List<CertificationCriterion> getActive(String certificationEdition, Local
                 .collect(Collectors.toList());
     }
 
-    public List<CertificationCriterion> getCriteriaAvailableToListing(CertifiedProductSearchDetails listing) {
+    public List<CertificationCriterion> getCriteriaAvailableToListingAndUser(CertifiedProductSearchDetails listing) {
         List<CertificationCriterion> allCriteriaAvailableToListing = Stream.concat(
                 getAttestedCriteria(listing).stream(),
-                getActiveCriteriaBasedOnEditionAndDate(listing).stream())
+                getEditableCriteria(listing).stream())
             .distinct()
             .sorted(criterionComparator)
             .collect(Collectors.toList());
@@ -82,11 +86,18 @@ private List<CertificationCriterion> getAttestedCriteria(CertifiedProductSearchD
                 .collect(Collectors.toList());
     }
 
-    private List<CertificationCriterion> getActiveCriteriaBasedOnEditionAndDate(CertifiedProductSearchDetails listing) {
+    private List<CertificationCriterion> getEditableCriteria(CertifiedProductSearchDetails listing) {
         String edition = listing.getEdition() != null && !StringUtils.isEmpty(listing.getEdition().getName())
                         ? listing.getEdition().getName() : null;
 
-        return this.getActive(edition, listing.getCertificationDay(), LocalDate.now());
+        List<CertificationCriterion> allActiveCriteria = this.getActive(edition, listing.getCertificationDay(), LocalDate.now());
+        if (!resourcePermissionsFactory.get().isUserRoleAdmin()
+                && !resourcePermissionsFactory.get().isUserRoleOnc()) {
+            return allActiveCriteria.stream()
+                    .filter(criterion -> criterion.isEditable())
+                    .collect(Collectors.toList());
+        }
+        return allActiveCriteria;
     }
 
     @Transactional
diff --git a/chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvDataWriter.java b/chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvDataWriter.java
index 5aa450cea5..9491d19a0f 100644
--- a/chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvDataWriter.java
+++ b/chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvDataWriter.java
@@ -141,7 +141,7 @@ public List<List<String>> getCsvData(CertifiedProductSearchDetails listing, int
     }
 
     private List<CertificationResult> getAllAvailableCriteriaAsCertResults(CertifiedProductSearchDetails listing) {
-        List<CertificationCriterion> allCriteriaAvailableToListing = criteriaManager.getCriteriaAvailableToListing(listing);
+        List<CertificationCriterion> allCriteriaAvailableToListing = criteriaManager.getCriteriaAvailableToListingAndUser(listing);
         List<CertificationResult> allAvailableCriteriaAsCertResults = new ArrayList<CertificationResult>();
         allCriteriaAvailableToListing.stream()
             .forEach(criterion -> {
diff --git a/chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvHeadingWriter.java b/chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvHeadingWriter.java
index 1ab6112565..82279d4392 100644
--- a/chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvHeadingWriter.java
+++ b/chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvHeadingWriter.java
@@ -111,7 +111,7 @@ public List<String> getCsvHeadings(CertifiedProductSearchDetails listing) {
 
     private List<String> getCriteriaHeadings(CertifiedProductSearchDetails listing) {
         List<String> criteriaHeadings = new ArrayList<String>();
-        List<CertificationCriterion> allCriteriaAvailableToListing = criteriaManager.getCriteriaAvailableToListing(listing);
+        List<CertificationCriterion> allCriteriaAvailableToListing = criteriaManager.getCriteriaAvailableToListingAndUser(listing);
         allCriteriaAvailableToListing.stream()
             .forEach(certResult -> criteriaHeadings.addAll(getCriterionHeadings(certResult)));
         return criteriaHeadings;