Security, data and compliance in SCIF Access Control & Management System

How SCIF Access Control & Management System protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider with CAC, PIV or your multi-factor policy.

Role-based access

What each person sees and does follows their role and their facilities; approving a visit is separate from sponsoring one.

Append-only audit trail

Every entry, view, change and export is logged with the person and time, and records cannot be edited or deleted.

Encryption and keys

Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Cleared US-person support

Support tickets for defense and intelligence clients are handled only by Moraph staff who are US citizens with active clearances.

US-only hosting

When hosted by Moraph, data stays in the United States region. Deployments in your own environment run under your authority.

Requirements it supports

• ICD 705 (Sensitive Compartmented Information Facilities)
• ICS 705-1 (Physical and Technical Security Standards for SCIFs)
• ICS 705-2 (Standards for the Accreditation and Reciprocal Use of SCIFs)
• Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities
• ICD 704 (Personnel Security Standards for SCI eligibility)
• 32 CFR Part 117 (NISPOM), for cleared contractors

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud (US): Hosted and operated by Moraph in the United States region for unclassified facility management data.
• Your environment: Installed in your own environment, including networks operated under your authority, with Moraph providing software and support as you allow.
• Dedicated environment: A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.

Limitations

• It does not accredit a facility or replace the accreditation process. Accreditation decisions belong to the accrediting official.
• It is not an intrusion detection system or alarm monitoring station. It receives and records events from your IDS; alarm monitoring and response remain as your procedures require.
• It does not grant clearances or decide need-to-know. Eligibility and accesses come from your security office and personnel security system.
• It does not store safe or door combinations. Combination changes can be recorded as having occurred, but not the combinations themselves.
• It is not a physical access control system and does not open doors. It records badge events from the system you have.
• The Moraph-hosted service handles unclassified facility management information only. Operation on classified networks takes place in your environment, under your authority and accreditation.
• Moraph does not claim accreditation for the product. Moraph maps controls and supports your own assessment and authorization.
• Integrations depend on the interfaces your IDS and access control vendors provide.