Security, data and compliance in Security Awareness Training

How Security Awareness Training protects data and supports your compliance obligations.

Security controls

Single sign-on

Administrators sign in through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Staff see their own training, managers see their teams, and individual results are limited to the people your policy names.

Minimal personal data

Only the directory attributes needed for enrollment and grouping are synchronized; no customer data is used in simulations.

Controlled privileged access

Moraph staff use administrative access only for approved work, with credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. KnowBe4's own platform assurance reports are available from KnowBe4 under its terms.

Audit trail

Campaign approvals, launches and program changes are recorded with who did what and when.

Requirements it supports

• Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)
• Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 App. B, Part 364 App. B)
• NCUA Security Program rules (12 CFR Part 748)
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including cybersecurity awareness training
• SEC Regulation S-P (17 CFR Part 248)
• FFIEC IT Examination Handbook, Information Security booklet

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• KnowBe4 cloud, managed by Moraph: KnowBe4 hosts the platform; Moraph runs your program on it under a managed service agreement.
• Moraph-managed with your existing KnowBe4 subscription: If you already subscribe to KnowBe4, Moraph can take over running the program, subject to KnowBe4's terms.
• Alongside other Moraph services: Run with Moraph's Endpoint Detection & Response or Identity Access Management services, so reported phishing and risky users are handled together.

Limitations

• Moraph is not KnowBe4. The platform and content belong to KnowBe4, and KnowBe4's own service commitments, roadmap, maintenance and outages apply.
• Subscriptions are subject to KnowBe4's terms, and the content and features available depend on your subscription level.
• Training and simulations reduce the chance that staff fall for fraud; they do not prevent it. Payment controls such as call-back verification remain essential.
• Moraph cannot promise any effect on cyber insurance premiums or coverage. That is your insurer's decision; the service provides evidence of your program.
• Real phishing reported by staff is routed to your security team. Investigating it is not part of this service unless you also use a Moraph security operations service.
• Decisions about consequences for repeat failures belong to your institution and its HR policies.
• Simulations depend on mail delivery. If allow-listing is changed without notice, results may not reflect staff behavior.
• Training content is KnowBe4's; custom courses written for your institution are scoped separately.