Security, data and compliance in Insider Threat "UBA" (User Behavior Analytics)

How Insider Threat "UBA" (User Behavior Analytics) protects data and supports your compliance obligations.

Security controls

Runs under your authority

On classified networks, the product is installed and operated in your environment under your authorizing official; Moraph does not claim accreditation for it.

Cleared support lane

Support tickets from federal and defense clients are handled only by US citizens with active security clearances.

Single sign-on and role-based access

Hub staff sign in through your identity provider, and pseudonymization, reveal approval and role limits control what each person sees.

Encryption under controlled keys

Data is encrypted, and in Moraph-hosted environments keys cannot be used by Moraph staff without explicit, time-bound authorization.

Complete audit trail

Every search, view, reveal, decision and export is recorded with the person and time, and cannot be edited.

AI proposes, people decide

Models flag activity for review; closing, revealing, referring and any action affecting a person are decided by trained staff.

Requirements it supports

• Executive Order 13587, Structural Reforms to Improve the Security of Classified Networks
• National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs
• CNSS Directive 504, Protecting National Security Systems from Insider Threat
• DoD Directive 5205.16, The DoD Insider Threat Program
• 32 CFR Part 117 (NISPOM), insider threat program requirements for cleared contractors
• Privacy Act of 1974 (5 U.S.C. 552a)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Your environment: Installed in an environment you operate, including classified and disconnected networks, under your authorizing official. Moraph cleared staff support it only under your authority.
• Moraph cloud, United States: For monitoring of unclassified networks only, hosted in the United States region with controls mapped to support your own authorization.
• With a managed service: Optionally supported by a Moraph managed service for platform administration and content updates, delivered by US citizens with active clearances under your authority.

Limitations

• The product does not decide that anyone is a threat. Anomalies are prompts for review, and every closure, reveal and referral is decided by trained people under your procedures.
• It analyzes the activity data your program collects. It is not a user activity monitoring agent and does not collect data from endpoints itself.
• Detection depends on the coverage and quality of your data sources; networks or sources not connected are not seen.
• Your organization is responsible for monitoring consent, banners, legal authority and protections for privacy, civil liberties and whistleblowers.
• It does not take action against users or systems, such as blocking accounts or transfers.
• It is not a counterintelligence case management or law enforcement investigation system; referrals are passed to those functions.
• Moraph holds no accreditation for classified networks. Use there depends on your authorizing official, and operations happen under your authority.
• Baselines need historical activity to be meaningful; new users and newly connected sources have limited history at first.