Security, data and compliance in FedRAMP High Managed Landing Zone

How FedRAMP High Managed Landing Zone protects data and supports your compliance obligations.

Security controls

Single sign-on

Users sign in through your agency's identity provider, so your authentication policies, including PIV, apply.

Role-based and privileged access

Access follows each person's role; privileged access to shared components is time-bound, approved and recorded.

Encryption and keys

Data is encrypted at rest and in transit, with keys controlled by your agency that Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every configuration change, privileged session and approval is logged with the person and time, and the logs cannot be edited.

US-only hosting and cleared staff

The landing zone runs only in US government cloud regions, and Moraph's federal work is handled by US citizens with active clearances.

Tested releases

Security testing gates every change to Moraph's templates and automation, and a software bill of materials is kept for the components Moraph supplies.

Requirements it supports

• Federal Information Security Modernization Act of 2014 (44 U.S.C. 3551 et seq.)
• FedRAMP Authorization Act (44 U.S.C. 3607 to 3616)
• NIST SP 800-53 Rev. 5, High control baseline (SP 800-53B)
• NIST SP 800-37 Rev. 2, Risk Management Framework
• OMB Memorandum M-21-31, Improving the Federal Government's Investigative and Remediation Capabilities
• OMB Memorandum M-19-26 and CISA Trusted Internet Connections (TIC) 3.0

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• AWS GovCloud (US): Built in your agency's AWS GovCloud (US) organization, using AWS Organizations, Control Tower or equivalent native services.
• Azure Government: Built in your agency's Azure Government tenant, using management groups, Azure Policy and equivalent native services.
• Both providers: Landing zones in both clouds with a common set of guardrails, logging and reporting, scoped in the proposal.

Limitations

• Moraph is not the cloud provider. AWS and Microsoft's own service commitments, roadmaps and outages apply, and cloud services and licences are subject to their terms.
• Moraph does not hold a FedRAMP authorization for the landing zone. The underlying cloud services carry the provider's own authorizations; your authorizing official decides whether systems built on the landing zone operate, and Moraph supports that with control mappings and evidence.
• The name refers to the FedRAMP High baseline the landing zone is configured against. How many controls an application inherits depends on the application and is set out in its customer responsibility matrix.
• Application teams remain responsible for their own workloads, code, data and the controls the matrix assigns to them, including patching their workloads unless contracted separately.
• The landing zone does not replace your security operations center; it forwards logs and events for your SOC to monitor and investigate.
• It is built only in US government cloud regions and is not intended for workloads that require a classified environment.
• Bringing existing accounts that were built differently into the landing zone may require rework, assessed account by account during discovery.
• Cost reporting depends on the provider's billing data and on application teams applying the agreed tags.