Security, data and compliance in DoD IL6 "Secret" Cloud Collaboration

How DoD IL6 "Secret" Cloud Collaboration protects data and supports your compliance obligations.

Security controls

Cleared US personnel

Every ticket for this service is handled only by Moraph staff who are US citizens with active clearances, verified by your security office.

Access under your authority

Moraph administrators use credentials and access your organization issues, from facilities and networks it approves, and lose access when you remove it.

Least privilege

Administrators hold only the platform roles their work needs, with time-bound elevation where your organization enables it.

Complete audit trail

Every Moraph action is tied to a request or change record and appears in the platform's audit log.

Encryption and keys

Moraph staff cannot use client encryption keys without explicit, time-bound authorization from your organization.

US-only operations

Service operations for US government clients take place only in the United States.

Requirements it supports

• DoD Cloud Computing Security Requirements Guide (CC SRG)
• DoDI 8510.01, Risk Management Framework for DoD Systems
• CNSSI 1253, Security Categorization and Control Selection for National Security Systems
• DoDM 5200.01, DoD Information Security Program
• DoDM 8140.03, Cyberspace Workforce Qualification and Management Program
• 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Fully managed administration: Moraph's cleared staff carry out day-to-day administration of the tenant, with your organization approving changes and access.
• Co-administration: Moraph administrators work alongside your own administration team, with responsibilities split as agreed in the service description.
• Onboarding support only: Moraph supports configuration and onboarding, then hands day-to-day administration to your team.

Limitations

• Moraph is not Microsoft. The platform, its features and its operation belong to Microsoft, and Microsoft's own service commitments, roadmap and outages apply.
• Licences are bought and held under Microsoft's terms and your organization's contract vehicle; Moraph resells and manages them but does not set their terms.
• Moraph does not hold or claim any authorization or accreditation for the platform or your environment. Authorization is maintained by Microsoft for the platform and by your authorizing official for your use.
• Features available in Microsoft's Secret cloud can differ from commercial Microsoft 365, and Moraph cannot add features the platform does not provide.
• Moraph staff work only under your organization's authority, with the access, credentials, facilities and networks it provides and approves.
• Moraph does not provide classified network connectivity, end-user devices or facilities.
• Moraph does not classify, mark or review content. Classification and handling decisions remain with your users and classification authorities.
• Transfers of information between networks at different classification levels are not included in this service.