Security, data and compliance in Privileged Access Management

How Privileged Access Management protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff sign in to CyberArk and to Moraph's service portal through your identity provider, so your password and multi-factor policies apply.

Moraph staff access

Moraph engineers reach your CyberArk environment through role-based access you approve, with their own sessions recorded, and cannot retrieve your privileged passwords without explicit, time-bound authorization.

Separation of duties

Safe design keeps vault administration separate from access to the credentials in the safes, so administering the platform does not mean seeing the passwords it holds.

Complete audit trail

CyberArk logs every credential retrieval, session and configuration change, and Moraph's service portal logs every change request, approval and alert decision.

Encryption

CyberArk encrypts the vault and its contents; Moraph's own service records are encrypted with keys staff cannot use without explicit, time-bound authorization.

Audited operations

Moraph is SOC 2 Type II and ISO/IEC 27001 audited company-wide, and its service records are hosted in the United States, United Kingdom or Australia region you choose.

Requirements it supports

• Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
• FTC Safeguards Rule under the Gramm-Leach-Bliley Act (16 CFR Part 314)
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.7 on access privileges
• FFIEC IT Examination Handbook, Information Security booklet
• Sarbanes-Oxley Act Section 404 (internal control over financial reporting)
• PCI DSS v4.0 Requirements 7 and 8 (access control and authentication)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• CyberArk Privilege Cloud: The vault runs as CyberArk's software-as-a-service, with connectors in your environment, configured and operated by Moraph.
• Self-hosted: CyberArk components run in your data center or cloud account, installed and maintained by Moraph under your change process.
• Existing CyberArk estate: If you already own CyberArk, Moraph can take over operations of the existing deployment after a baseline review.

Limitations

• Moraph is not CyberArk. Moraph resells, implements and operates the platform; CyberArk develops it and is responsible for its software and cloud service.
• CyberArk's own service commitments, product roadmap and any outages of its cloud service apply. Moraph does not change them.
• Licences are subject to CyberArk's terms, which you accept as part of the purchase.
• Some systems cannot have passwords rotated automatically, for example older platforms without a supported connector. These are documented as exceptions with a compensating control your institution approves.
• Removing hard-coded credentials from applications needs your developers to change the application; Moraph identifies them and supports the change.
• Moraph does not decide who should hold privileged access. Your institution sets the policy and approves access and exceptions.
• Moraph triages alerts from the platform but does not replace your security operations center or incident response team.
• Session recordings are kept for the period your policy sets and the platform's storage allows; longer retention needs additional storage.