Security, data and compliance in Supply Chain Mapping & Risk Illuminator

How Supply Chain Mapping & Risk Illuminator protects data and supports your compliance obligations.

Security controls

Data kept in the United States

Supplier maps, findings and decisions are hosted in the United States region.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Access by role and program

Staff see the programs and contracts they are responsible for; suppliers see only their own requests and responses.

Encryption under controlled keys

Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every data load, finding, decision and export is recorded with the user and time, and cannot be edited.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Requirements it supports

• Buy American Statute (41 U.S.C. 8301 to 8305) and FAR Part 25
• Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321 to 1328) and FAR Subpart 4.23
• Section 889 of the John S. McCain National Defense Authorization Act for FY 2019 (FAR 52.204-24 and 52.204-25)
• Executive Order 14005 (Ensuring the Future Is Made in All of America by All of America's Workers)
• Executive Order 14017 (America's Supply Chains)
• NIST SP 800-161 Rev. 1 (Cybersecurity Supply Chain Risk Management Practices)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted in the United States region, with data kept in the US.
• Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, data source maintenance and analyst support.

Limitations

• It informs decisions; it does not make them. Sourcing, exclusion, mitigation and domestic preference determinations belong to your contracting officers and officials.
• The map is only as complete as the data behind it. Sub-tier visibility depends on supplier disclosures and the commercial data your agency licenses, and gaps are shown as gaps, not filled by assumption.
• Country, region and entity lists are configured and approved by your program. Moraph does not designate countries of concern or decide which entities are prohibited.
• It does not issue FASCSA orders, exclusion or removal decisions, or debarments; it records the information and decisions your agency makes through its own processes.
• Commercial supplier data is subject to the provider's licence terms and accuracy, and is purchased by your agency or through a separate agreement.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
• It is not designed for classified supply chain information. Classified material must be handled outside it under your agency's procedures.
• It is not a contract writing or procurement system; it works alongside your acquisition systems.