Security, data and compliance in Mission Partner Environment (MPE) Builder

How Mission Partner Environment (MPE) Builder protects data and supports your compliance obligations.

Security controls

Single sign-on

US users and administrators sign in through your identity provider, so your authentication policies apply.

Role-based access

What each person can see and do follows their role and the mission they belong to; partners see only their own enclave.

Encryption and keys

Enclave data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization, and keys are destroyed at teardown.

Complete audit trail

Every request, approval, build, change, data movement and teardown step is logged with the person and time.

Cleared US support staff

Tickets for federal and defense clients are handled only by US citizens with active clearances.

Your authority, your networks

Enclaves on classified networks are built and operated under your organization's authority and procedures; Moraph does not hold the authorization.

Requirements it supports

• DoD Instruction 8110.01, Mission Partner Environment Information Sharing Capability Implementation for the DoD
• DoD Directive 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations
• DoD Instruction 8510.01, Risk Management Framework for DoD Systems
• NIST SP 800-53 Rev. 5, Security and Privacy Controls
• NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization
• International Traffic in Arms Regulations (22 CFR Parts 120-130)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Commercial cloud in US regions: Enclaves for unclassified sharing built in the US government cloud regions your organization authorizes, with Moraph's service tooling hosted in the United States region.
• Your data centers: Enclaves built on infrastructure you own or operate, with Moraph working under your access procedures.
• Classified networks: Where enclaves run on classified networks, Moraph's cleared staff work under your organization's authority and procedures, scoped in the proposal.

Limitations

• Moraph is not the vendor of the cloud, network or software products the enclaves are built on. Those vendors' own service commitments, roadmaps and outages apply.
• Licenses for underlying products are subject to each vendor's terms.
• Moraph does not make disclosure or release decisions. Your foreign disclosure officers decide what each partner may receive; the service configures and records what they approve.
• Moraph does not authorize enclaves. Your authorizing official makes that decision; Moraph maps controls and supplies evidence.
• Build time depends on the template, the infrastructure and your approvals, and is agreed per mission rather than guaranteed.
• Teardown removes data from the enclave's own storage. Copies a partner has legitimately taken out under an approved disclosure are governed by your agreements with that partner, not by the service.
• Connectivity to partner networks is provided by your organization and its partners; Moraph configures the enclave side.
• The service is not a cross-domain solution; information moving between classification levels uses the cross-domain solution your organization has approved.