Security, data and compliance in Endpoint Detection & Response

How Endpoint Detection & Response protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff and Moraph's analysts sign in to the console through identity providers with multi-factor authentication.

Role-based access

Analysts, service managers and your own staff hold only the console roles their work needs.

Logged response actions

Every containment, remote response and policy change is recorded with the person, time and approval behind it.

Controlled privileged access

Remote response on your machines is limited to the investigation at hand, with credentials staff cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. CrowdStrike's own platform assurance reports are available from CrowdStrike under its terms.

Data residency

Telemetry is held in the CrowdStrike cloud region selected for your institution, and Moraph's service records stay in the United States, United Kingdom or Australia region you choose.

Requirements it supports

• Computer-Security Incident Notification Rule (12 CFR Part 53, 12 CFR Part 225 Subpart N, 12 CFR Part 304 Subpart C)
• Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 App. B, Part 364 App. B)
• NCUA Security Program and cyber incident notification rules (12 CFR Part 748)
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
• Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)
• FFIEC IT Examination Handbook, Information Security booklet

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• CrowdStrike Falcon, managed by Moraph: CrowdStrike hosts the Falcon platform; Moraph monitors and responds on it for you under a managed service agreement.
• Moraph-managed with your existing Falcon subscription: If you already subscribe to Falcon, Moraph can take over monitoring and response, subject to CrowdStrike's terms.
• Alongside other Moraph services: Run with Moraph's Vulnerability Management, Security Awareness Training or Privileged Access Management services, so findings are shared between them.

Limitations

• Moraph is not CrowdStrike. Falcon belongs to CrowdStrike, and CrowdStrike's own service commitments, roadmap, maintenance and outages apply to it.
• Subscriptions are subject to CrowdStrike's terms, and the features available depend on the Falcon modules you license.
• No endpoint service can guarantee that ransomware or other attacks will be prevented. The service reduces the chance and shortens the time to detect and respond.
• Machines without a working sensor are not protected or monitored. Keeping sensors deployed is a shared task with your IT team.
• Moraph acts only within the containment policy you approve; anything else waits for your decision, which can affect how quickly an incident is contained.
• Restoring systems, backups and business operations after an incident is your institution's responsibility; Moraph supports with investigation.
• Decisions about regulatory notification, customer notification and law enforcement belong to your institution.
• The service covers endpoints and servers running the Falcon sensor. Network devices, cloud accounts and email are outside its scope unless covered by another service.