Security, data and compliance in Zero Trust "Black Cloud" Overlay

How Zero Trust "Black Cloud" Overlay protects data and supports your compliance obligations.

Security controls

Single sign-on

Administrators and users sign in through your identity provider, so your authentication and multi-factor policies apply.

Least-privilege administration

Moraph administrators hold role-based rights in the Zscaler admin portal limited to the tasks in the service scope.

Cleared US support staff

Tickets for federal and defense clients are handled only by US citizens with active clearances.

Complete audit trail

Every administrative change and access decision is logged with the person and time and kept under your retention policy.

US hosting for government

Moraph's service tooling for US government clients is hosted in the United States region only.

People decide

Where automation suggests a policy change or flags an anomaly, a named person reviews it; nothing is applied without approval.

Requirements it supports

• Executive Order 14028, Improving the Nation's Cybersecurity
• OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
• DoD Zero Trust Strategy and Zero Trust Reference Architecture
• NIST SP 800-207, Zero Trust Architecture
• NIST SP 800-53 Rev. 5, Security and Privacy Controls
• DoD Instruction 8510.01, Risk Management Framework for DoD Systems

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Zscaler cloud with US-hosted management: Zscaler's government cloud offering where your requirements call for it, with Moraph's service tooling hosted in the United States region.
• Private Service Edge in your environment: Brokering placed inside your data centers or enclaves where your policy requires traffic to stay within them.
• Disconnected or classified environments: Where operations take place on classified networks, they are carried out under your organization's authority and procedures, by cleared staff, scoped in the proposal.

Limitations

• Moraph is not Zscaler. Zscaler owns and operates the platform, and its own service commitments, roadmap and outages apply.
• Licenses are subject to Zscaler's terms, which are passed through to your organization.
• Moraph does not authorize your systems. Your authorizing official makes that decision; Moraph maps controls and supplies evidence to support it.
• Hiding an application reduces its exposure but does not fix vulnerabilities inside it. Patching and hardening of the applications remain with their owners.
• Some applications, such as those that depend on server-initiated connections to clients, may need redesign or another access method; these are identified during discovery.
• Removing old firewall rules and public addresses is carried out by your network team; Moraph identifies them but does not change networks outside the service scope.
• Who is entitled to which application is your decision. Moraph configures and reviews policies but does not grant access on its own judgment.
• The service does not replace your security operations center; it supplies alerts and evidence to it.