Security, data and compliance in Tactical Edge Compute Node Manager

How Tactical Edge Compute Node Manager protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your authentication and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; building a bundle is separate from approving its installation.

Signed and verified software

Nodes accept only bundles signed with your program's keys, and reject anything that fails verification.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every release, approval, delivery, installation and baseline change is logged with the person and time, and cannot be edited.

US-only hosting and support

Hosted in the United States region only; support tickets for defense clients are handled only by US citizens with active clearances, and work on classified networks happens under your authority.

Requirements it supports

• DoD Instruction 8500.01, Cybersecurity
• DoD Instruction 8510.01, Risk Management Framework for DoD Systems
• CNSSI 1253, Security Categorization and Control Selection for National Security Systems
• DISA Kubernetes Security Technical Implementation Guide (STIG)
• NIST SP 800-190, Application Container Security Guide
• DoD Enterprise DevSecOps Reference Design: CNCF Kubernetes

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, US region: The management service hosted and operated by Moraph in the United States region, for unclassified fleets.
• Client-hosted: The management service installed in your own environment, including disconnected and classified networks, where it is operated under your authority and your authorization process.
• At the edge: A small agent runs on each node alongside your Kubernetes distribution and keeps working while disconnected.

Limitations

• It does not create bandwidth. Delivery depends on the links and contact windows available, and large releases may still take several contacts or a physical transfer.
• It manages the software and configuration on edge clusters; it does not manage radios, networks or the tactical links themselves.
• It does not decide when an update is safe to install during a mission. Installation is approved by the mission owner.
• Nodes that never report back cannot be verified. The inventory shows when each node last reported, rather than assuming it is current.
• It does not test mission software. Functional and safety testing remain with your program before a release is built.
• It does not grant an authority to operate. It produces evidence that supports your authorization process.
• Moraph does not claim accreditation for any classified environment; use on classified networks is under your authority.
• Supported Kubernetes distributions and node hardware are confirmed during scoping; unusual hardware may need additional engineering.