Security, data and compliance in Software Bill of Materials (SBOM) Watchtower

How Software Bill of Materials (SBOM) Watchtower protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your authentication and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; reviewing a package is separate from approving it.

Isolated analysis

Packages are unpacked and analyzed in an isolated area and are never executed as part of analysis.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every intake, view, decision, override and release is logged with the person and time, and cannot be edited.

US-only hosting and support

Hosted in the United States region only; support tickets for defense clients are handled only by US citizens with active clearances, and work on classified networks happens under your authority.

Requirements it supports

• Executive Order 14028, Improving the Nation's Cybersecurity
• NIST SP 800-218, Secure Software Development Framework (SSDF)
• NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices
• NTIA, The Minimum Elements for a Software Bill of Materials
• Section 889 of the FY2019 John S. McCain National Defense Authorization Act (FAR 52.204-25)
• DoD Instruction 8510.01, Risk Management Framework for DoD Systems

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, US region: Hosted and operated by Moraph in the United States region, for unclassified software intake.
• Client-hosted: Installed in your own environment, including disconnected and classified networks, where it is operated under your authority and your authorization process.
• In your software factory: Deployed alongside your DevSecOps pipelines and repositories so builds are checked before promotion.

Limitations

• Binary analysis cannot identify every component. Heavily modified, obfuscated or custom-built code may not match known components, and Watchtower reports what it could not identify rather than assuming it is safe.
• Country-of-origin and supplier restrictions are applied from the lists and provenance data your program supplies. Watchtower does not determine on its own where a component was written or by whom.
• Vulnerability results depend on the vulnerability sources loaded; on disconnected networks they are only as current as the last approved update.
• Watchtower recommends; people decide. Admitting, conditionally admitting or rejecting a package is a decision made by your designated approvers.
• It does not run or test the behavior of software, and it is not a malware sandbox or an antivirus product.
• It does not grant an authority to operate. It produces evidence that supports your authorization process.
• Moraph does not claim accreditation for any classified environment; use on classified networks is under your authority.
• Remediating a vulnerable component is the job of the supplier or the program; Watchtower tracks it but does not patch software.