Security, data and compliance in Network Access Control

How Network Access Control protects data and supports your compliance obligations.

Security controls

Single sign-on for administrators

ISE administrators sign in through your identity provider with multi-factor authentication, using named accounts.

Role-based administration

Administrative roles separate policy changes, device classification and read-only views.

Controlled Moraph access

Moraph engineers reach ISE through an access path your organization approves, within the scope and time it authorizes.

Audit trail

Administrative changes, releases and exceptions are logged with who made them and when, and sent to your SIEM.

Encryption and keys

Configuration backups and evidence Moraph holds for the service are encrypted with keys staff cannot use without explicit, time-bound authorization.

Data handled

ISE handles device and network identity data, not clinical records. Where your use involves protected health information, a business associate agreement is put in place first.

Requirements it supports

• HIPAA Security Rule access control and risk management (45 CFR 164.308 and 164.312)
• HHS 405(d) Health Industry Cybersecurity Practices (HICP)
• HHS Healthcare and Public Health Sector Cybersecurity Performance Goals
• IEC 80001-1 risk management for health IT networks incorporating medical devices
• NIST Cybersecurity Framework 2.0
• NIST SP 800-207 Zero Trust Architecture

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Nodes in your data centers: ISE runs on virtual or physical hosts in your data centers, operated by Moraph through an access path you approve.
• Nodes in your cloud account: Where your design supports it, ISE nodes run in your own cloud account and are operated by Moraph.
• Your existing deployment: Where you already run ISE, Moraph reviews the configuration and takes over operation, subject to Cisco's licence terms.
• Alongside other Moraph services: Can be run with Moraph's Medical Device Cybersecurity Hub, so the device inventory and network access policy stay in step.

Limitations

• Moraph is not the vendor. Cisco owns Identity Services Engine, and its own support commitments, roadmap, advisories and product defects apply.
• Licences are subject to Cisco's terms, and features such as posture checks depend on the licence tier you hold.
• Enforcement depends on your switches and wireless controllers supporting the required features; older equipment may need upgrading, which is your organization's decision and cost.
• Profiling identifies devices from network behavior and attributes and can be wrong or incomplete. Classification of medical devices is confirmed by clinical engineering.
• Decisions to restrict or release a device, especially in clinical areas, are your organization's. Moraph acts within the approvals and emergency path you set.
• The service controls network access; it does not patch, harden or replace medical devices, and it is not an endpoint protection product.
• Network access control reduces risk from unknown devices but does not on its own stop a compromised device that is allowed on the network.
• Security incidents and any patient safety decisions are led by your organization, with Moraph supporting on the access layer.