Security, data and compliance in Third-Party Risk Scoring

How Third-Party Risk Scoring protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff and Moraph's analysts sign in through identity providers with multi-factor authentication, so your access policies apply.

Role-based access

Relationship owners see their own vendors; administering the platform is separate from deciding on findings.

Confidential vendor information

Your vendor list, tiers and follow-up records are your confidential information and are shared only with the people and systems you approve.

Encryption and keys

Data in Moraph's service portal is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Alerts, triage decisions, follow-ups, risk acceptances and changes are logged with the person and time.

Data residency

Moraph's service portal runs in the United States, United Kingdom or Australia region you choose; BitSight's hosting follows its own terms.

Requirements it supports

• Interagency Guidance on Third-Party Relationships: Risk Management (2023)
• FFIEC IT Examination Handbook (Outsourcing Technology Services and Information Security booklets)
• NYDFS Cybersecurity Regulation 23 NYCRR 500.11 (third-party service provider security policy)
• Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b))
• SEC Regulation S-P (as amended in 2024, service provider oversight)
• PRA Supervisory Statement SS2/21 (outsourcing and third party risk management)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• BitSight service, run by Moraph: BitSight's hosted service, subscribed through Moraph, with Moraph's team operating the portfolio and monitoring work.
• Co-managed: Your team keeps some of the work, such as vendor follow-up, and Moraph runs portfolio maintenance, alert triage and reporting.
• With Vendor Risk Management: Run alongside Moraph's Vendor Risk Management (VRM), so ratings and findings sit with the rest of each vendor's due-diligence record.

Limitations

• Moraph is not the vendor. BitSight owns the platform and its rating methods, and BitSight's own service commitments, roadmap and outages apply.
• Subscriptions are subject to BitSight's terms, which you accept as part of the agreement.
• Ratings are based on what can be observed from outside an organization. They do not replace questionnaires, document review, contract terms or on-site assessment.
• Findings can be misattributed, for example on shared hosting or recently changed networks. Moraph checks findings before follow-up, but some will need confirmation with the vendor.
• A good rating does not mean a vendor is secure, and a poor rating does not on its own mean a vendor should be dropped. Those judgments are your organization's.
• Moraph does not contact your vendors except through the channel you agree, and does not negotiate with them on your behalf.
• Moraph does not change BitSight ratings; corrections are requested from BitSight under its own process.
• Fourth parties and vendors outside your subscription are not monitored unless they are added to the portfolio.