Cross-Domain Solution (CDS) Transfer Agent

Principal workflows

• Request: A user submits files for transfer on the source network, naming the destination, the purpose and any classification or release markings. The request follows the transfer path and rules your organization has approved.
• Inspect: Each file is checked against the rules for its path. The Agent verifies the true file type from its content rather than its name, unpacks archives, and scans with the malware engines your organization provides.
• Sanitize: Permitted files are rebuilt from their visible content. Macros, scripts, embedded objects, hidden text, comments, tracked changes and metadata are removed, and images are re-encoded to strip data hidden in them. A report lists what was removed from each file.
• Review and release: Where your rules require it, such as for transfers to a lower network, a trained reviewer examines the sanitized files and the automated keyword and marking checks before release. A second person approves where your procedures require two-person review.

Who uses it

• Cross-domain and network operations teams in defense and intelligence organizations
• Information system security managers and officers responsible for transfer paths
• Data transfer officers and trained human reviewers who approve releases
• Mission users who need files moved between networks to do their work
• Assessors and security staff who audit cross-domain transfers

Reporting

• Transfers requested, released, rejected and blocked by path
• Files blocked by reason, such as type mismatch or malware detection
• Content removed during sanitization by type
• Review queue by age and reviewer
• Keyword and marking matches and their outcomes
• Path rule changes and who approved them, for auditors

Features

• True type verification: Each file's type is identified from its content, and files whose content does not match their name or declared type are blocked.
• Content disarm and reconstruction: Office documents, PDFs and images are rebuilt from their visible content, leaving behind macros, scripts, embedded objects and other active content.
• Metadata and hidden content removal: Author names, revision history, comments, tracked changes, hidden text and hidden sheets are removed and listed in the sanitization report.
• Image re-encoding: Images are decoded and re-encoded, which strips metadata and disrupts data hidden in the original file's encoding.
• Path rules: Each approved transfer path has its own permitted directions, file types, sizes and review requirements, set and changed only by authorized staff.
• Malware scanning: Files are scanned with the malware engines your organization licenses and maintains, and results are kept with the transfer record.
• Keyword and marking checks: Content is checked against the keyword lists and marking rules your security office maintains, and matches are highlighted for the reviewer.
• Human review queue: Reviewers see the sanitized files, what was removed and the results of every check side by side, and record their decision.
• Two-person review: Paths can require a second reviewer, and nobody can approve a transfer they requested.
• Archive handling: Archives are unpacked and each file inside is inspected and sanitized on its own; nested archives beyond the depth your rules allow are blocked.
• Sanitization reports: Every file has a report of what was found, removed or changed, available to the requester, reviewer and auditors.
• Complete transfer record: Each transfer keeps the original file's hash, the released file's hash, the checks run, the reviewers and the times, for audit.

Integrations

• Source and destination networks: Connects to the file shares, transfer folders or applications on each side of an approved path, configured to your cross-domain architecture.
• Cross-domain guard: Works within the transfer path your organization has approved, alongside the cross-domain guard or data diode that enforces the boundary.
• Malware engines: Uses the antivirus and malware scanning engines your organization licenses, with signature updates loaded through your approved process.
• Keyword and marking lists: Keyword lists and marking rules maintained by your security office are loaded and versioned.
• Single sign-on: Users sign in through the identity provider on each network, including smart-card authentication where your provider supports it.
• Security monitoring: Transfer events, blocks and review decisions are sent to your security information and event management system.
• Work API: Transfer records and statistics are available to your reporting tools through the Moraph Work API on the network where they are held.

Deployment

• Client-hosted across domains: Installed in your environment on each side of an approved transfer path, operated under your authority and within your cross-domain approval.
• Unclassified boundary: For files entering an unclassified network from the internet or from partners, available hosted in Moraph's United States region.
• With a managed service: Optionally supported by a Moraph managed service for rule maintenance and administration, with staff who hold the clearances your environment requires.

Security and privacy

• Single sign-on: Users sign in through your identity provider, so your authentication and multi-factor policies apply.
• Role-based access: What each person can see and do follows their role; requesting a transfer is separate from approving it.
• No execution: Files are parsed and rebuilt, never opened in their native applications or executed during inspection.
• Encryption and keys: Files at rest and in transit are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.
• Complete audit trail: Every request, inspection, removal, review and release is logged with the person and time, and cannot be edited.
• Your authority, cleared support: On classified networks the Agent is installed and operated under your authority. Support tickets for defense and intelligence clients are handled only by US citizens with active clearances.

Limitations

• Moraph does not claim that the Transfer Agent is listed on the NCDSMO Baseline or accredited for any classified environment. Using it on a path between classification levels requires your organization's own cross-domain approval and authorization.
• It is a software sanitization and review component. It does not replace the cross-domain guard, data diode or network controls that enforce the boundary.
• Sanitization reduces risk but cannot guarantee that every hidden channel is removed. Data concealed in the visible content of an image or document can survive re-encoding, which is why human review remains part of the process.
• File types outside the supported list are blocked rather than passed through; formats that cannot be rebuilt cannot be sanitized.
• Malware detection depends on the engines your organization provides and how current their signatures are.
• Keyword and marking checks support reviewers; they do not make classification or release decisions. Those remain with your trained reviewers and security officers.
• Rebuilt documents may lose features such as macros, form logic, embedded media and some formatting, by design.
• Encrypted or password-protected files cannot be inspected and are blocked unless your rules provide another route.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/cross-domain-solution-cds-transfer-agent. Purchasing routes and company information: www.moraph.com/how-to-buy.