Security, data and compliance in Foreign Disclosure/Release (FDR) Workflow

How Foreign Disclosure/Release (FDR) Workflow protects data and supports your compliance obligations.

Security controls

Records kept in the United States

For US government clients, data in Moraph's cloud is hosted only in the United States region.

Cleared support lane

Support tickets from federal and defense clients are handled only by US citizens with active security clearances.

Access by role and office

People see only the requests their role, office and consultations allow.

Encryption under controlled keys

Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, check, consultation, decision and export is logged with the person and time, and cannot be edited.

People decide

The workflow checks, flags and suggests; every disclosure decision is made and recorded by an authorized officer.

Requirements it supports

• Executive Order 13526, Classified National Security Information
• 32 CFR Part 2001, Classified National Security Information (ISOO implementing directive)
• National Disclosure Policy (NDP-1) and DoD Directive 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations
• Intelligence Community Directive 403, Foreign Disclosure and Release of Classified National Intelligence
• International Traffic in Arms Regulations (22 CFR Parts 120-130)
• DoD Manual 5200.01, DoD Information Security Program

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Client-operated environment: Installed in an environment your organization operates, including classified networks. Operation there is under your authority and accreditation process, and Moraph provides control documentation to support it.
• Moraph cloud, United States: Hosted by Moraph in the United States region for unclassified use, such as training, evaluation and requests that involve only unclassified information.
• With a managed service: Optionally supported by a Moraph managed service for administration and configuration, delivered by cleared US citizen staff under the access your organization grants.

Limitations

• It does not make disclosure decisions. An officer with delegated authority decides every request, and the release rules are your organization's policy, not Moraph's.
• The checks are only as good as the markings recorded on the material and the rules your office configures. Unmarked or incorrectly marked material must be reviewed by the officer.
• It does not determine whether material is subject to export control. It flags material for review by your export control and legal staff.
• Moraph does not host classified information. Use with classified material happens only in environments your organization operates, under your authority.
• Moraph holds no accreditation or authorization for classified systems, and no FedRAMP or DoD impact level authorization for this product. We map controls and provide documentation to support your organization's own decision.
• It does not transfer information to foreign partners. Releasable material is passed through the channels your organization approves.
• It does not apply classification markings or replace your marking tools.
• Moraph does not supply the content of disclosure policies or agreements; your office loads and maintains the rules it applies.