Security, data and compliance in Wargaming & Simulation Sandbox

How Wargaming & Simulation Sandbox protects data and supports your compliance obligations.

Security controls

Single sign-on

Participants and staff sign in through your identity provider, so your authentication policies apply.

Compartmented access

Each exercise and each cell is separated by network, accounts and storage, and access follows the approved roster.

Encryption and keys

Data is encrypted at rest and in transit, with keys Moraph staff cannot use without explicit, time-bound authorization from your organization.

Complete audit trail

Builds, sign-ins, data loads, changes, exports and destruction are logged with the person and time, and cannot be edited.

Cleared US staff

Federal and defense work is handled only by US citizens with active clearances, and environments are hosted only in the United States.

Tested releases

Security testing gates every change to Moraph's templates and tooling, and a software bill of materials is kept for the components Moraph supplies.

Requirements it supports

• DoD Instruction 8510.01, Risk Management Framework for DoD Systems
• CNSSI No. 1253, Security Categorization and Control Selection for National Security Systems
• NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
• DoD Instruction 5000.61, DoD Modeling and Simulation Verification, Validation, and Accreditation
• DoD Manual 5200.01, DoD Information Security Program
• Executive Order 13526, Classified National Security Information

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• On your premises: Built in your data center or enclave, including classified environments, and operated under your organization's authority by cleared Moraph staff where the contract provides for it.
• US government cloud region: Built in a US government cloud region your organization has approved, hosted only in the United States, with compute reserved for each event.
• Hybrid: A standing on-premises platform that draws on approved cloud capacity for the largest events, scoped in the proposal.

Limitations

• Moraph is not the maker of the simulation software, hardware or cloud services. Their own service commitments, roadmaps and outages apply, and licences are subject to their terms.
• Moraph does not hold an accreditation or authorization for the environment. Your authorizing official decides whether it operates; Moraph maps controls and supplies evidence to support that decision.
• Work in classified environments happens under your organization's authority and only where the contract provides for it, by US citizens with the required clearances.
• Moraph does not design scenarios, adjudicate games or analyze results. Exercise design, play and conclusions belong to your organization.
• Verification, validation and accreditation of models and simulations under DoD Instruction 5000.61 remain your organization's responsibility; Moraph keeps the build records that support it.
• Compute is available within the capacity reserved for each event; exceeding it depends on what the platform or cloud provider can supply at the time.
• Moving data between security domains is not included; it uses the cross-domain solution your organization has approved.
• Classification guidance and decisions about aggregated results are your security office's responsibility; the environment enforces the separation they specify.