Security, data and compliance in Vulnerability Management

How Vulnerability Management protects data and supports your compliance obligations.

Security controls

Single sign-on

Users sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Remediation owners see their own assets; approving a risk acceptance is separate from requesting one.

Scan credential handling

Scan accounts are least-privilege and can be held in your privileged access vault; Moraph staff do not keep copies.

Encryption and keys

Scan data is encrypted in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.

Complete audit trail

Changes to scope, schedules, findings and acceptances are logged with the person and time, and cannot be edited.

Data residency

Scan data is held in the region you choose where the platform offers it: the United States, the United Kingdom or Australia.

Requirements it supports

• Gramm-Leach-Bliley Act Safeguards Rule (16 CFR 314.4(d)(2), vulnerability assessments and penetration testing)
• Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
• FFIEC IT Examination Handbook, Information Security booklet
• NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR 500.5, vulnerability management)
• NCUA Security Program and Customer Information Guidelines (12 CFR Part 748 and Appendix A)
• NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Tenable cloud: Tenable Vulnerability Management hosted by Tenable, with scanners and agents in your environment, operated by Moraph.
• Tenable on-premises: Tenable Security Center installed in your environment for institutions whose policies keep scan data on-premises, operated by Moraph under logged administrative access.
• Existing Tenable deployment: Where you already own Tenable, Moraph reviews it against an agreed baseline and takes over operation.

Limitations

• Moraph is not Tenable. The platform belongs to Tenable, and Tenable's own service commitments, roadmap and outages apply to it.
• Licences are subject to Tenable's terms, including how assets are counted.
• Scanning finds vulnerabilities; it does not fix them. Your teams apply patches and configuration changes unless a separate Moraph service covers that.
• Results depend on the scan credentials and network access you provide. Assets that cannot be reached or logged into are reported as coverage gaps.
• A scanner only finds vulnerabilities it has checks for. Custom applications need application security testing, which is not part of this service.
• Scanning is not penetration testing. Where your regulations call for penetration tests, they are arranged separately.
• Running a scanner does not by itself satisfy GLBA or any other requirement; your institution decides scope, frequency and remediation targets under its own program.
• Remediation targets and risk acceptances are your institution's decisions; Moraph records and reports them.