Defense & Intelligence · Moraph software

Cross-Domain Solution (CDS) Transfer Agent

Inspect, sanitize and record every file before it crosses a network boundary

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

The CDS Transfer Agent is a software guard component that inspects and sanitizes files moving between networks of different security levels. It verifies each file's true type, removes macros, embedded objects, hidden content and metadata, rebuilds documents and images from their visible content, and routes transfers that need a person's review to a trained reviewer. Every transfer keeps a record of what was received, what was removed, who reviewed it and what was released, under the cross-domain approval your organization holds.

The problem it solves

Mission work depends on moving files between networks: imagery, reports, software updates and orders moving from lower to higher networks, and approved releases moving the other way. Each transfer carries risk. Malware can ride in on a document macro or an embedded object, and sensitive information can leak out in hidden text, tracked changes, metadata or content concealed in images. Manual transfer processes depend on removable media and individual diligence, reviewers lack consistent tools, and the record of what moved, when and why is often incomplete.

  • Documents carry active content, embedded objects and hidden data their authors never see
  • Files can be disguised as a different type to slip past simple checks
  • Reviewers of outbound transfers work without consistent tools or rules
  • Records of what was transferred, sanitized and approved are incomplete

Who uses it

  • Cross-domain and network operations teams in defense and intelligence organizations
  • Information system security managers and officers responsible for transfer paths
  • Data transfer officers and trained human reviewers who approve releases
  • Mission users who need files moved between networks to do their work
  • Assessors and security staff who audit cross-domain transfers

Requirements it supports

DoD Instruction 8540.01, Cross Domain (CD) PolicyNCDSMO Raise the Bar cross domain solution design and implementation requirementsCNSSI 1253, Security Categorization and Control Selection for National Security SystemsNIST SP 800-53 Rev. 5, including AC-4 Information Flow EnforcementIntelligence Community Directive 503, IC Information Technology Systems Security Risk ManagementDoD Instruction 8510.01, Risk Management Framework for DoD Systems

The product supports these requirements; meeting them remains your organization’s responsibility.

See how it works

A short walkthrough

Illustrative screens with fictional sample data. They show the workflow, not any client’s data or configuration, and the layout of the product itself differs. A live demonstration uses the product with sample data.

  1. Step 1

    The transfer queue

    Every transfer request on every path appears in one queue, with its direction, status and the checks still to run.

    RequestPathFilesRequesterResultStatus
    TR-58213Path A, low to high3Requester 2210SanitizedReleased
    TR-58209Path B, high to low1Requester 4471Sanitized, 2 keyword matchesAwaiting review
    TR-58204Path A, low to high2Requester 1908Blocked: type mismatchRejected
    TR-58198Path B, high to low4Requester 3352SanitizedAwaiting second review
    TR-58190Path A, low to high1Requester 2210Blocked: malware detectionRejected
    Every transfer request on every path appears in one queue, with its direction, status and the checks still to run.

  2. Step 2

    What was removed

    Each file comes with a sanitization report listing what was found, removed and rebuilt.

    example-status-report.docx (fictional)

    Declared type
    Word document
    True type
    Word document, matches
    Malware scan
    No detection
    Macros
    1 removed
    Embedded objects
    2 removed
    Rebuilt as
    Word document, no active content

    Hidden content removed

    • Author and organization metadata
    • 14 tracked changes and 6 comments
    • 1 hidden paragraph in white text
    • Image metadata from 3 embedded pictures
    Each file comes with a sanitization report listing what was found, removed and rebuilt.

  3. Step 3

    The reviewer's view

    Reviewers see the sanitized content with keyword and marking matches highlighted, and record a decision with a reason.

    Path B, high to low · 1 file

    Purpose
    Coordination with partner network (fictional)
    Markings declared
    Unclassified sample
    Keyword matches
    2
    Marking check
    Consistent
    Two-person review
    Required on this path

    Matches to review

    • Page 2: term from keyword list 7
    • Page 4: term from keyword list 7
    • No unmarked portions found
    Reviewers see the sanitized content with keyword and marking matches highlighted, and record a decision with a reason.

  4. Step 4

    The transfer record

    Every step of a transfer is recorded, from submission to release, with who acted and when.

    TR-58198 · Path B, high to low

    1. 4 files submitted with purpose and markingsRequester
    2. True type verified and malware scan completeTransfer Agent
    3. Macros, metadata and hidden content removedTransfer Agent
    4. Keyword checks run, no matchesTransfer Agent
    5. First review approvedReviewer
    6. Awaiting second reviewSecond reviewer
    Every step of a transfer is recorded, from submission to release, with who acted and when.

  5. Step 5

    Path rules

    Each approved path has its own rules, changed only by the security officer and recorded when they change.

    RuleSettingLast changedApproved by
    DirectionHigh to low onlyAt path approvalSecurity officer
    Permitted typesWord, PDF, PNG, plain textFictional sample dateSecurity officer
    ArchivesNot permittedAt path approvalSecurity officer
    Human reviewTwo-person, every transferAt path approvalSecurity officer
    Keyword listsLists 3 and 7Fictional sample dateSecurity officer
    Each approved path has its own rules, changed only by the security officer and recorded when they change.

  6. Step 6

    Blocked files

    Blocked files are listed with the reason, so security staff can spot patterns and requesters know what to fix.

    RequestFilePathReasonAction
    TR-58204example-photo.jpgPath AContent is an executable, not an imageReferred to security officer
    TR-58190example-update.zipPath AMalware detection by engine 2Referred to security officer
    TR-58177example-budget.xlsxPath BPassword-protected fileReturned to requester
    TR-58165example-model.dwgPath AFile type not permitted on pathReturned to requester
    Blocked files are listed with the reason, so security staff can spot patterns and requesters know what to fix.

Workflows

The principal workflows

  1. Request

    A user submits files for transfer on the source network, naming the destination, the purpose and any classification or release markings. The request follows the transfer path and rules your organization has approved.

    • User selects the approved transfer path and destination
    • Files uploaded with purpose and markings
    • Path rules checked: permitted file types, sizes and direction
    • Request queued for inspection
    • User sees the status of every request they made

  2. Inspect

    Each file is checked against the rules for its path. The Agent verifies the true file type from its content rather than its name, unpacks archives, and scans with the malware engines your organization provides.

    • True file type identified from content and compared with the declared type
    • Archives and nested files unpacked and each file inspected
    • Files scanned with your organization's malware engines
    • Files that break a rule are blocked and the reason recorded
    • Inspection results attached to the request

  3. Sanitize

    Permitted files are rebuilt from their visible content. Macros, scripts, embedded objects, hidden text, comments, tracked changes and metadata are removed, and images are re-encoded to strip data hidden in them. A report lists what was removed from each file.

    • Active content such as macros, scripts and embedded objects removed
    • Metadata, comments, tracked changes and hidden text removed
    • Images re-encoded and metadata stripped
    • Document rebuilt in a clean form of the permitted type
    • Sanitization report produced for each file

  4. Review and release

    Where your rules require it, such as for transfers to a lower network, a trained reviewer examines the sanitized files and the automated keyword and marking checks before release. A second person approves where your procedures require two-person review.

    • Keyword and marking checks run against your organization's lists
    • Reviewer examines sanitized content and check results
    • Second reviewer approves where two-person review applies
    • Approved files released to the destination
    • Transfer record completed and the requester notified

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Requester

Mission user, analyst, operations staff, system owner

Moves the files their work needs between networks through an approved path.

Sees

  • The paths they are permitted to use
  • Their own requests, their status and the sanitization report for each file
  • The reason any of their files was blocked or rejected

Does

  • Submits files with purpose, destination and markings
  • Withdraws a request before review
  • Resubmits corrected files after a rejection
  • Collects released files on the destination side

Cannot

  • Review or approve any transfer, including their own
  • Change path rules or keyword lists
  • See other users' transfers
Approvals
Every transfer they request passes inspection and, where the path requires it, review by trained reviewers.
Notified about
Transfers released, rejected or returned to them, and files blocked with the reason.

Reviewer

Trained human reviewer, data transfer officer, release reviewer

Decides whether sanitized files may be released on paths that require human review.

Sees

  • Requests waiting for review on the paths they are appointed to
  • Sanitized files, sanitization reports and check results
  • Keyword and marking matches highlighted in context
  • Earlier decisions on the same requester's transfers

Does

  • Examines sanitized content and check results
  • Approves release, rejects with a reason, or returns to the requester
  • Records comments for the second reviewer
  • Refers suspicious transfers to the security officer

Cannot

  • Review a transfer they requested
  • Change path rules or keyword lists
  • Release a transfer that still needs a second review
Approvals
On two-person paths, their approval is followed by a second reviewer's.
Notified about
Transfers waiting for review on their paths and transfers returned by a second reviewer.

Second reviewer

Senior reviewer, data transfer officer

Provides an independent second approval on paths that require two-person review.

Sees

  • Transfers approved by a first reviewer and waiting for a second
  • The first reviewer's comments and all check results
  • Sanitized files and reports

Does

  • Approves release or rejects with a reason
  • Returns a transfer to the first reviewer with comments
  • Refers transfers to the security officer

Cannot

  • Give the second approval on a transfer they requested or first-reviewed
  • Change path rules
Approvals
Their approval completes the release on two-person paths.
Notified about
Transfers waiting for second review.

Security officer

Information system security manager, information system security officer, cross-domain security lead

Owns the transfer paths and the rules that govern them, and responds to blocked and suspicious transfers.

Sees

  • All transfers, blocks and review decisions on their paths
  • Path rules, keyword lists and their history
  • Reviewer appointments
  • The audit trail

Does

  • Sets and changes path rules within the approved architecture
  • Maintains keyword lists and marking rules
  • Appoints and removes reviewers
  • Investigates blocked and referred transfers
  • Suspends a path when needed

Cannot

  • Approve a transfer they requested
  • Edit or delete transfer records or audit entries
  • Enable a new path without the approval your organization requires
Approvals
Rule changes they make are recorded with their approval; enabling a new path follows your organization's cross-domain approval process.
Notified about
Malware detections, type mismatches, referrals from reviewers, and failed keyword list or signature updates.

Auditor (read-only)

Security control assessor, inspector general staff, internal auditor

Reviews transfers and their controls without being able to change anything.

Sees

  • Transfer records and sanitization reports within the scope granted
  • Path rules and their change history
  • The audit trail

Does

  • Searches and reads records within their scope
  • Exports records and reports, with each export logged
  • Leaves review notes where enabled

Cannot

  • Change, approve or delete anything
  • Open released or original file content unless granted separately
  • Keep access after it expires
Approvals
Their access is approved by the security officer, with a scope and an end date.
Notified about
Nothing by default.

Administrator

System administrator, cross-domain operations staff

Keeps the Agent running and connected without access to the content of transfers.

Sees

  • System health, queues and connection status
  • Users and role assignments
  • Update status for malware signatures and lists

Does

  • Manages users or maps them from single sign-on groups
  • Maintains connections to file shares, guards and malware engines
  • Applies updates through your approved process
  • Runs access review reports

Cannot

  • Open file content or review transfers
  • Change path rules or keyword lists
  • Grant themselves a reviewer or security officer role
Approvals
Role changes that grant review or security officer rights are approved by the security officer.
Notified about
Connection failures, queue backlogs, failed updates and access reviews coming due.

Permissions at a glance

ActionRequesterReviewer2nd reviewerSec. officerAuditorAdmin
Submit transfer requestsOwn work onlyOwn work onlyOwn work onlyOwn work onlyNo accessNo access
View sanitization reportsOwn work onlyFullFullFullView onlyNo access
View sanitized file contentOwn work onlyFullFullFullNo accessNo access
Approve or reject releaseNo accessApprovesNo accessNo accessNo accessNo access
Give second approvalNo accessNo accessApprovesNo accessNo accessNo access
Investigate blocked transfersNo accessView onlyView onlyFullView onlyNo access
Change path rulesNo accessNo accessNo accessApprovesNo accessNo access
Maintain keyword listsNo accessNo accessNo accessFullNo accessNo access
Appoint reviewersNo accessNo accessNo accessFullNo accessNo access
View audit trailNo accessNo accessNo accessView onlyView onlyView only
Manage users and connectionsNo accessNo accessNo accessApprovesNo accessFull
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Two-person rules are built in: nobody reviews a transfer they requested, and on two-person paths the second approval must come from a different reviewer.
  • Roles are configured with you during implementation and are scoped by path, so a reviewer appointed to one path cannot review transfers on another.
  • Every permission change and reviewer appointment is recorded in the audit trail, and access review reports list each person's roles for periodic certification by the security officer.
  • Administrators keep the system running but cannot see file content. Auditors get temporary read-only access with a defined scope and an end date.

Features

What it does

True type verification

Each file's type is identified from its content, and files whose content does not match their name or declared type are blocked.

Content disarm and reconstruction

Office documents, PDFs and images are rebuilt from their visible content, leaving behind macros, scripts, embedded objects and other active content.

Metadata and hidden content removal

Author names, revision history, comments, tracked changes, hidden text and hidden sheets are removed and listed in the sanitization report.

Image re-encoding

Images are decoded and re-encoded, which strips metadata and disrupts data hidden in the original file's encoding.

Path rules

Each approved transfer path has its own permitted directions, file types, sizes and review requirements, set and changed only by authorized staff.

Malware scanning

Files are scanned with the malware engines your organization licenses and maintains, and results are kept with the transfer record.

Keyword and marking checks

Content is checked against the keyword lists and marking rules your security office maintains, and matches are highlighted for the reviewer.

Human review queue

Reviewers see the sanitized files, what was removed and the results of every check side by side, and record their decision.

Two-person review

Paths can require a second reviewer, and nobody can approve a transfer they requested.

Archive handling

Archives are unpacked and each file inside is inspected and sanitized on its own; nested archives beyond the depth your rules allow are blocked.

Sanitization reports

Every file has a report of what was found, removed or changed, available to the requester, reviewer and auditors.

Complete transfer record

Each transfer keeps the original file's hash, the released file's hash, the checks run, the reviewers and the times, for audit.

Integrations

How it connects to your systems

Connects toHowWhat flows
Source and destination networksConnects to the file shares, transfer folders or applications on each side of an approved path, configured to your cross-domain architecture.In: files submitted on the source side. Out: sanitized, approved files on the destination side.
Cross-domain guardWorks within the transfer path your organization has approved, alongside the cross-domain guard or data diode that enforces the boundary.Out: sanitized files and transfer metadata handed to the guard. In: delivery confirmation.
Malware enginesUses the antivirus and malware scanning engines your organization licenses, with signature updates loaded through your approved process.In: scan results for each file.
Keyword and marking listsKeyword lists and marking rules maintained by your security office are loaded and versioned.In: keyword lists and marking rules.
Single sign-onUsers sign in through the identity provider on each network, including smart-card authentication where your provider supports it.In: user identity and group membership for role assignment.
Security monitoringTransfer events, blocks and review decisions are sent to your security information and event management system.Out: transfer, block and decision events.
Work APITransfer records and statistics are available to your reporting tools through the Moraph Work API on the network where they are held.Out: transfer records, outcomes and review decisions.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Users sign in through your identity provider, so your authentication and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; requesting a transfer is separate from approving it.

No execution

Files are parsed and rebuilt, never opened in their native applications or executed during inspection.

Encryption and keys

Files at rest and in transit are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every request, inspection, removal, review and release is logged with the person and time, and cannot be edited.

Your authority, cleared support

On classified networks the Agent is installed and operated under your authority. Support tickets for defense and intelligence clients are handled only by US citizens with active clearances.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Review queue

For reviewers and the security officer

Transfers waiting for first or second review, with their path, age and check results.

Break down by
Path, Review stage, Reviewer, Age band
Delivered as
Live dashboard
Used for
Keeping transfers moving and balancing review work.

Blocked files

For security officer

Every blocked file with its path, requester and reason, such as type mismatch, malware detection, unsupported type or encryption.

Break down by
Reason, Path, Requester, Period
Delivered as
Live dashboard; CSV export
Used for
Spotting attempted misuse and fixing rules that block legitimate work.

Referrals

For security officer

Transfers referred by reviewers for investigation, with notes and the outcome.

Break down by
Path, Reviewer, Outcome
Delivered as
Live view; PDF export
Used for
Tracking investigations through to closure.

System and update status

For administrators and the security officer

Connection health, queue depth, and when malware signatures and keyword lists were last updated.

Break down by
Component, Path, Status
Delivered as
Live dashboard; alerts to your monitoring system
Used for
Making sure checks are running with current data.

Management

Transfer volumes and outcomes

For security leadership and mission owners

Transfers requested, released, rejected, returned and blocked over a period.

Break down by
Path, Direction, Organization, Period, Outcome
Delivered as
Live dashboard; PDF; CSV export
Used for
Understanding demand on each path and how transfers are resolved.

Sanitization summary

For security officer and leadership

Content removed during sanitization by type, such as macros, embedded objects, metadata and hidden text.

Break down by
Content type, File type, Path, Period
Delivered as
Live dashboard; CSV export
Used for
Showing what the sanitization step is catching and informing user guidance.

Audit

Transfer record extract

For auditors and assessors

For a chosen transfer or period, every step from request to release, with file hashes, checks, removals, reviewers and times.

Break down by
Transfer, Path, Requester, Date range
Delivered as
On request in the product; PDF and CSV export
Used for
Providing evidence of controlled transfers for assessments and investigations.

Path rule change history

For security officer and assessors

Every change to path rules and keyword lists, with who made it and when.

Break down by
Path, Rule, Change date
Delivered as
Live view; PDF and CSV export
Used for
Showing that path rules stay within the approved architecture.

Reviewer decisions

For security officer and assessors

Review decisions by reviewer, including approvals, rejections, returns and referrals, and where first and second reviewers disagreed.

Break down by
Reviewer, Path, Decision, Period
Delivered as
Live dashboard; CSV export
Used for
Checking reviewer consistency and targeting training.

Access review

For security officer

Every user with their roles, path appointments and last activity.

Break down by
Role, Path, Last activity
Delivered as
On request; CSV and PDF export
Used for
Periodic certification of who can request, review and administer transfers.

Exports, access and evidence

  • Every report can be exported to CSV, and summary and evidence reports to PDF, on the network where the records are held.
  • Each report can be filtered by path and period and the filters saved, so the security officer and reviewers keep their own views.
  • Transfer events and decisions can be sent to your security information and event management system for monitoring alongside other security data.
  • Reports respect each viewer's role and path scope; auditors see records and reports without file content unless granted separately.
  • Audit reports can be run as of a past date and give the same result each time. Running and exporting a report is itself recorded in the audit trail.

Deployment

Where and how it runs

Client-hosted across domains

Installed in your environment on each side of an approved transfer path, operated under your authority and within your cross-domain approval.

Unclassified boundary

For files entering an unclassified network from the internet or from partners, available hosted in Moraph's United States region.

With a managed service

Optionally supported by a Moraph managed service for rule maintenance and administration, with staff who hold the clearances your environment requires.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Path design

We work with your cross-domain and security staff to document each transfer path, its direction, permitted file types and review requirements, within the architecture your organization has approved.

Sanitization rules

Sanitization settings are configured for each file type and path, and tested with sample files your team provides.

Checks and lists

Your malware engines, keyword lists and marking rules are connected and their update process agreed.

Reviewer setup

Reviewer appointments, two-person rules and review queues are configured to match your procedures.

Authorization support

We provide control mappings, design documentation and test evidence to support your organization's cross-domain approval and authorization.

Training and go-live

Requesters, reviewers and security officers are trained on their own workflows, and each path is enabled once your organization has approved it.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph does not claim that the Transfer Agent is listed on the NCDSMO Baseline or accredited for any classified environment. Using it on a path between classification levels requires your organization's own cross-domain approval and authorization.
  • It is a software sanitization and review component. It does not replace the cross-domain guard, data diode or network controls that enforce the boundary.
  • Sanitization reduces risk but cannot guarantee that every hidden channel is removed. Data concealed in the visible content of an image or document can survive re-encoding, which is why human review remains part of the process.
  • File types outside the supported list are blocked rather than passed through; formats that cannot be rebuilt cannot be sanitized.
  • Malware detection depends on the engines your organization provides and how current their signatures are.
  • Keyword and marking checks support reviewers; they do not make classification or release decisions. Those remain with your trained reviewers and security officers.
  • Rebuilt documents may lose features such as macros, form logic, embedded media and some formatting, by design.
  • Encrypted or password-protected files cannot be inspected and are blocked unless your rules provide another route.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Run a set of your own unclassified sample files through the Agent and review the sanitization reports
  2. Submit a file renamed to look like a different type and confirm it is blocked with the reason recorded
  3. Submit a document with macros, tracked changes and hidden text and compare the original with the rebuilt file
  4. Work a high-to-low request through two-person review and check nobody can approve their own request
  5. Change a path rule and confirm the change and its approver are recorded
  6. Review the control mappings and documentation against what your cross-domain approval process requires

Questions

Frequently asked questions

Is the Transfer Agent an accredited cross-domain solution?

Moraph does not claim accreditation or NCDSMO Baseline listing. The Agent is a sanitization and review component used within a transfer path your organization approves, and we provide documentation and test evidence to support your approval and authorization.

Can it guarantee that no hidden data gets through?

No product can. Rebuilding files and re-encoding images removes the common places data hides, and human review covers what automated checks cannot, but the risk is reduced rather than removed.

Which file types are supported?

Common office documents, PDFs, images and plain text are supported for rebuilding. Each path permits only the types your security officer allows, and anything else is blocked.

Who at Moraph can access our transfer content?

On your networks, nobody without your authorization. Moraph support staff for defense and intelligence clients are US citizens with active clearances, and work in your environment happens under your authority and procedures.

How is it priced?

As a subscription, usually measured by the number of transfer paths and environments, with implementation charged separately. See Working with Moraph for what drives a quotation.

Is there an accessibility conformance report?

Ask for one through the procurement request form at /how-to-buy/request, naming the version you are evaluating.

Next steps

Evaluate Cross-Domain Solution (CDS) Transfer Agent

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Cross-Domain Solution (CDS) Transfer Agent guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Cross-Domain Solution (CDS) Transfer Agent support guide.

Related products