Security, data and compliance in FedRAMP ATO Accelerator

How FedRAMP ATO Accelerator protects data and supports your compliance obligations.

Security controls

Read-only connections

Connections to your cloud accounts and repositories use read-only permissions; the Accelerator does not change your systems.

Records kept in the United States

Package content and evidence for US government work are hosted in the United States region.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Encryption under controlled keys

Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every draft, edit, approval, export and access grant is recorded with the user and time, and cannot be edited.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Requirements it supports

• FedRAMP Authorization Act (44 U.S.C. 3607-3616)
• Federal Information Security Modernization Act of 2014 (44 U.S.C. 3551 et seq.)
• NIST SP 800-53 Rev. 5, Security and Privacy Controls
• NIST SP 800-37 Rev. 2, Risk Management Framework
• FIPS 199, Standards for Security Categorization
• OMB Circular A-130, Managing Information as a Strategic Resource

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted in the United States region, with package content and evidence kept in the US.
• Dedicated environment: A single-tenant environment for organizations that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside Moraph's FedRAMP High Managed Landing Zone or another Moraph managed service for platform and continuous monitoring support.

Limitations

• The Accelerator does not grant or guarantee authorization. Authorization decisions are made by the authorizing official, and FedRAMP and agency review timelines are outside Moraph's control.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your own authorization decision about using it.
• It is not a third-party assessment organization and does not perform the independent assessment your authorization requires.
• Drafted statements are only as complete as the configuration it can read. Procedural, personnel and physical controls need people to write them and supply evidence.
• Every drafted statement must be reviewed by a person who knows the system; the Accelerator can misread intent from configuration alone.
• It reads configuration but does not change it, and does not remediate findings.
• It is not a vulnerability scanner. It imports results from the scanners you already use.
• It is designed for FedRAMP and NIST SP 800-53 based authorizations. Other frameworks are not included unless scoped separately.