Getting started with Network Access Control

Moraph resells, implements and runs Cisco Identity Services Engine (ISE) so that every device connecting to a wired port or wireless network in your hospital is identified and given only the access its role allows. Unknown devices, including medical devices plugged into a wall jack without going through clinical engineering, are placed in a restricted network until someone decides what they are. Moraph builds the policies with your network, security and clinical engineering teams, introduces enforcement in stages so patient care is not interrupted, and triages what ISE sees every day.

What it is for

Hospital networks carry infusion pumps, monitors, imaging systems, building controls, workstations and personal devices, often on the same switches. Many medical devices cannot run security software or authenticate in the usual way, and a device plugged into an open wall jack typically gets the same access as a workstation. Security teams cannot say with confidence what is connected, clinical engineering learns about new devices after they are in use, and nobody wants to be the one whose blocking rule takes down a monitor in a patient's room.

• There is no reliable inventory of what is connected to each port and wireless network
• Unknown devices plugged into wall jacks get broad network access
• Medical devices often cannot authenticate with certificates or run endpoint agents
• Fear of disrupting clinical devices keeps enforcement switched off

Who uses it

• Network and infrastructure teams at hospitals and health systems
• Information security officers responsible for the Security Rule and network risk
• Clinical engineering and biomedical teams who own medical devices
• IT leaders who need network access control without adding headcount
• Facilities teams responsible for building and environmental systems on the network

Before you start

• Your organization uses Network Access Control as a managed platform from Moraph, under an agreement that covers it.
• Licences for Cisco ISE, bought through Moraph or under your own agreement with the vendor.
• A Moraph account in your organization for each person who works with Moraph on the service.
• Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

1. Agree the scope of the managed service for Network Access Control with Moraph, including which environments and teams it covers.

2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

4. Confirm how users will sign in, through your identity provider where the platform supports it.

5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

• Onboard Network Access Control
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com