Security, data and compliance in Nuclear Command & Control (NC3) Assurance Check

How Nuclear Command & Control (NC3) Assurance Check protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider with CAC, PIV or your multi-factor policy.

Role-based access

What each person sees and does follows their role and their sites; preparing, verifying and approving a baseline are separate.

Append-only audit trail

Every check, view, decision and export is logged with the person and time, and records cannot be edited or deleted.

Encryption and keys

Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Cleared US-person support

Support tickets for defense and intelligence clients are handled only by Moraph staff who are US citizens with active clearances.

Your environment only

Operational use runs in your environment under your authority; Moraph hosting, in the United States region, is limited to unclassified evaluation with fictional data.

Requirements it supports

• DoD Instruction 8510.01, Risk Management Framework for DoD Systems
• DoD Instruction 8500.01, Cybersecurity
• NIST SP 800-53 Rev. 5, configuration management and system and information integrity controls
• CNSSI No. 1253, Security Categorization and Control Selection for National Security Systems
• NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems
• DISA Security Technical Implementation Guides (STIGs)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Your environment: Installed in your own environment, including networks operated under your authority, with Moraph providing software and support as you allow.
• Disconnected installation: For isolated networks, updates and content are delivered as signed packages for your staff to verify and transfer.
• Unclassified evaluation: A Moraph-hosted evaluation environment in the United States region, using fictional systems and data only.

Limitations

• It verifies; it does not control. It cannot send commands to, reconfigure or repair the systems it checks.
• No check can prove a system is uncompromised. The product compares systems with their approved baseline and records what it finds; a baseline that is itself wrong will not be detected.
• It checks only what its collectors are permitted to read. Components without a readable interface must be verified by your own procedures, and their results recorded.
• Link health depends on your existing monitoring systems and test procedures; the product records their results and does not test links itself.
• Moraph does not claim accreditation or an authorization to operate for the product. Moraph maps controls and supports your own assessment and authorization.
• Operation on classified networks takes place in your environment, under your authority and accreditation. Moraph does not hold your operational data.
• Decisions about discrepancies, escalation and response belong to your personnel and procedures.
• Remediation is out of scope; differences are fixed through your own change and maintenance processes.