Security, data and compliance in IT Service Management

How IT Service Management protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff sign in through your identity provider under your multi-factor policies, and Moraph's staff sign in to Moraph systems with multi-factor authentication.

Role-based access

Requesters see their own requests, technicians see their team's work, and Moraph's service team works on configuration rather than tickets.

Controlled privileged access

Moraph's administrative roles are granted by your platform owner, used only for approved work, and keys and credentials cannot be used without explicit, time-bound authorization.

Complete audit trail

Changes to configuration, devices and tickets are recorded in ServiceNow, and every change Moraph makes is linked to its request and approval.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001, and Moraph signs a business associate agreement where tickets may contain PHI. ServiceNow's own assurance reports are available from ServiceNow under its terms.

Data residency

Your instances are hosted in the ServiceNow data center region in your agreement, and Moraph's service records are held in the United States, United Kingdom or Australia region you choose.

Requirements it supports

• Medicare Conditions of Participation: physical environment (42 CFR 482.41)
• The Joint Commission Environment of Care standards for medical equipment (EC.02.04.01 and EC.02.04.03)
• NFPA 99 Health Care Facilities Code
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• FDA medical device reporting for user facilities (21 CFR Part 803)
• FDA guidance on postmarket management of cybersecurity in medical devices

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• ServiceNow cloud, managed by Moraph: ServiceNow hosts your instances; Moraph configures and operates them under a managed service agreement.
• Moraph-managed with your existing instance: If you already run ServiceNow, Moraph can take over administration and add clinical engineering workflows, subject to ServiceNow's terms and a review of the current configuration.
• Alongside other Moraph services: Run with Moraph's Medical Device Cybersecurity Hub or Asset Tracking so device security findings and locations feed the same records.

Limitations

• Moraph is not ServiceNow. The platform belongs to ServiceNow, and ServiceNow's own service commitments, roadmap, upgrade policy and outages apply to it.
• Subscriptions are subject to ServiceNow's terms, and some workflows described here depend on the ServiceNow products you subscribe to.
• Moraph runs the platform; it does not repair or maintain your medical equipment. Your clinical engineering team and equipment vendors do that work.
• Maintenance intervals, risk classifications and alternative equipment maintenance decisions are your organization's, under your equipment management program.
• Equipment reporting depends on an accurate inventory. Devices not in the inventory, or work not recorded, will not appear in reports.
• Reporting adverse events to the FDA or manufacturers remains your organization's responsibility; the service can flag possible events but does not report them.
• Customizations beyond ServiceNow's standard configuration can make upgrades harder; Moraph will tell you when a request carries that cost.
• Where tickets may contain PHI, your staff need guidance on what to enter; the platform does not prevent PHI being typed into free-text fields.