Security, data and compliance in Business Continuity Planning

How Business Continuity Planning protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Plan owners see their own unit's material; approving a plan is separate from writing one.

Controlled administrator access

Moraph administrators use named accounts, and their access to your program data is limited, logged and reviewed with you.

Audit history

Changes to plans, approvals, exercise records and configuration are logged with the person and time.

Encryption and keys

Configuration exports and service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization. Data in the platform is protected under Fusion Risk Management's own controls.

Moraph controls

Moraph's managed services operate under its SOC 2 Type II and ISO/IEC 27001 audited controls, and service records stay in the US, UK or Australia region you choose.

Requirements it supports

• FFIEC IT Examination Handbook, Business Continuity Management booklet
• Interagency Paper on Sound Practices to Strengthen Operational Resilience (2020)
• Interagency Guidance on Third-Party Relationships: Risk Management (2023)
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500), Section 500.16
• FINRA Rule 4370 (Business Continuity Plans and Emergency Contact Information)
• Gramm-Leach-Bliley Act Section 501(b) information security standards

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licensed through Moraph: Moraph resells the Fusion Risk Management subscription and runs it as a managed service, as one agreement with you.
• Your existing licence: Where you already license the platform, Moraph takes over implementation and administration, subject to the vendor's terms.
• Alongside Moraph software: Can be paired with Moraph's Vendor Risk Management (VRM) so third-party dependencies feed the continuity program.

Limitations

• Moraph is not the vendor. Fusion Risk Management owns and operates the platform, and its own service commitments, roadmap and outages apply.
• Licences are subject to Fusion Risk Management's terms, including any limits on users, modules and data.
• Moraph does not run your recovery. Failover, system recovery and business recovery are performed by your staff and providers; the platform records the plans and results.
• Recovery objectives, plan approval, test scope and acceptance of findings are your organization's decisions.
• Plan quality depends on the source data you provide and on plan owners keeping their content current.
• Mass emergency notification is not part of this service. Contact lists can be prepared for the notification tool you already use.
• Moraph does not certify that your program meets regulatory expectations; it helps you produce and organize the evidence.
• Features available depend on the platform modules you license.