Defense & Intelligence · Moraph software

Cryptographic Key Management System (CKMS)

Account for every key from generation to destruction, and act quickly when one is compromised

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

The Cryptographic Key Management System keeps the record of keying material for radios, weapon systems and other end cryptographic units: where each key came from, who holds it, which devices it was loaded into, and when it was superseded or destroyed. It runs the requests, hand receipts, loading records and destruction reports that COMSEC accounts work through every day. When a key is reported compromised, it shows every holder and device affected and drives the emergency supersession steps your controlling authority directs.

The problem it solves

COMSEC custodians often keep track of keying material across the government key management infrastructure, local inventories, paper hand receipts and spreadsheets of which device holds which key. Supersession dates are watched by hand, destruction is recorded on forms that are filed and hard to search, and inventories take days of reconciliation. When a key is suspected compromised, working out which units and devices hold it, and confirming that each one has moved to replacement key, depends on calls, emails and the custodian's memory.

  • Holdings, hand receipts and device loads are tracked in separate places
  • Supersession and destruction deadlines are watched by hand
  • Inventories and audits mean days of reconciling paper with systems
  • After a compromise it is slow to confirm who holds the key and who has rekeyed

Who uses it

  • COMSEC account managers and their alternates
  • Hand receipt holders and key operators in units and on platforms
  • Controlling authorities who direct key use, supersession and emergency rekey
  • Information system security managers responsible for cryptographic equipment
  • Inspectors and auditors who review COMSEC accounts

Requirements it supports

NIST SP 800-57 Part 1, Recommendation for Key ManagementNIST SP 800-130, A Framework for Designing Cryptographic Key Management SystemsNIST SP 800-152, A Profile for U.S. Federal Cryptographic Key Management SystemsFIPS 140-3, Security Requirements for Cryptographic ModulesDoD Instruction 8523.01, Communications Security (COMSEC)CNSSI 4005, Safeguarding Communications Security (COMSEC) Facilities and Materials

The product supports these requirements; meeting them remains your organization’s responsibility.

See how it works

A short walkthrough

Illustrative screens with fictional sample data. They show the workflow, not any client’s data or configuration, and the layout of the product itself differs. A live demonstration uses the product with sample data.

  1. Step 1

    The account inventory

    The account manager starts from one inventory of every item on the account, with its holder and supersession date.

    ItemShort title (fictional)EditionHolderSupersedesStatus
    KM-08812SAMPLE-KEY-AEd. 14Example Squadron 1 (fictional)In 3 daysRekey due
    KM-08807SAMPLE-KEY-BEd. 6Example Battery 2 (fictional)In 21 daysIn use
    KM-08795SAMPLE-KEY-CEd. 2Account vaultIn 40 daysOn hand
    KM-08781SAMPLE-KEY-AEd. 13Example Squadron 1 (fictional)SupersededDestruction overdue
    KM-08776SAMPLE-KEY-DEd. 9Example Platoon 3 (fictional)In 12 daysIn use
    The account manager starts from one inventory of every item on the account, with its holder and supersession date.

  2. Step 2

    A key request

    Units ask for key against named devices and nets, and the account manager approves and issues it on a hand receipt.

    Request RQ-1207 · Example Battery 2 (fictional)

    Requested by
    Hand receipt holder, Example Battery 2
    Short title
    SAMPLE-KEY-B, Ed. 7
    Purpose
    Training net (fictional)
    Devices
    6 radios
    Needed by
    Fictional sample date

    Checks

    • Holder has current hand receipt authority
    • All 6 devices registered to the unit
    • Edition available on the account
    Units ask for key against named devices and nets, and the account manager approves and issues it on a hand receipt.

  3. Step 3

    Where a key is loaded

    Load records show which devices hold each key, so rekeying and compromise response start from facts, not phone calls.

    Device serialDevice typeUnitLoaded byLoadedStatus
    DEV-SAMPLE-0141RadioExample Squadron 1Key operatorDay 1Active
    DEV-SAMPLE-0142RadioExample Squadron 1Key operatorDay 1Active
    DEV-SAMPLE-0207Weapon system ECUExample Squadron 1Key operatorDay 2Active
    DEV-SAMPLE-0311RadioExample Squadron 1Key operatorDay 2In maintenance
    Load records show which devices hold each key, so rekeying and compromise response start from facts, not phone calls.

  4. Step 4

    Reporting a compromise

    A compromise report lists every holder and device with the affected key and records the controlling authority's direction.

    Incident IN-0093 · SAMPLE-KEY-A, Ed. 14 (fictional)

    Reported by
    Hand receipt holder, Example Squadron 1
    Nature
    Fill device unaccounted for (fictional)
    Holders affected
    3
    Devices affected
    14
    Direction
    Supersede, per controlling authority

    Holders to confirm

    • Example Squadron 1: 4 of 6 devices confirmed
    • Example Squadron 2: 5 of 5 devices confirmed
    • Example Detachment 4: 0 of 3 devices confirmed
    A compromise report lists every holder and device with the affected key and records the controlling authority's direction.

  5. Step 5

    The incident timeline

    Every step after a compromise is recorded with who did it, ready for the incident report.

    Incident IN-0093 · Timeline

    1. Suspected compromise reportedHand receipt holder
    2. Affected holders and devices identifiedAccount manager
    3. Direction recorded: supersede with Ed. 15Controlling authority
    4. Replacement key issued to 3 holdersAccount manager
    5. Loads of Ed. 15 and zeroization of Ed. 14 confirmedKey operators
    6. Incident record closed for reportingAccount manager
    Every step after a compromise is recorded with who did it, ready for the incident report.

  6. Step 6

    Recording destruction

    Destruction is recorded with the destroying official and witness, and the item stays open until the report is accepted.

    Destruction DR-0458 · KM-08781

    Short title
    SAMPLE-KEY-A, Ed. 13 (fictional)
    Holder
    Example Squadron 1
    Method
    Electronic zeroization
    Destroying official
    Key operator (fictional)
    Witness
    Alternate account manager (fictional)

    Before closing

    • All devices loaded with this edition confirmed zeroized
    • Second person confirmed under two-person integrity
    • Destruction report prepared for submission
    Destruction is recorded with the destroying official and witness, and the item stays open until the report is accepted.

Workflows

The principal workflows

  1. Receive and generate

    Keying material enters the account either from your government key management infrastructure, recorded on receipt, or, for unclassified and commercial keys within the system's scope, generated in a FIPS 140-3 validated hardware security module you designate.

    • Incoming material recorded against the shipment or electronic transfer it arrived on
    • Short title, edition, quantity and accounting legend captured for each item
    • Unclassified and commercial keys generated in your designated hardware security module
    • Receipt confirmed by a second person where your procedures require two-person integrity
    • Item added to the account inventory with its supersession date

  2. Distribute and load

    Units request key through the system, the account manager issues it on a hand receipt, and key operators record which devices it was loaded into, so the account always knows where each key is in use.

    • Unit submits a key request naming the devices, mission or net it supports
    • Account manager approves and issues the material on a hand receipt
    • Hand receipt holder signs for the material
    • Key operator records each device load against the device serial number
    • Holdings by unit and device update on the account view

  3. Supersede and destroy

    The system counts down to each supersession date, reminds holders to rekey and destroy, and keeps the destruction record with its witness, so nothing stays in use or on hand past its date.

    • Upcoming supersessions listed by holder and device
    • Holders reminded to load replacement key and zeroize the old
    • Zeroization and destruction recorded with the destroying official and witness
    • Destruction report prepared for the account manager to submit
    • Item closed in the inventory once the report is accepted

  4. Respond to a compromise

    When key is reported lost or compromised, the system identifies every holder and device that has it, records the report, and tracks each holder through the emergency supersession steps the controlling authority directs.

    • Suspected compromise reported with what is known and when
    • Every hand receipt, holder and device holding the key listed
    • Controlling authority's direction recorded: continue, supersede or stop use
    • Each holder confirms replacement key loaded and old key zeroized
    • Incident record closed with the full timeline for the incident report

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

COMSEC account manager

COMSEC account manager, COMSEC custodian, key management manager

Runs the account and answers for every item on it, from receipt to destruction.

Sees

  • Every item on the account, its holder, devices and supersession date
  • All key requests, hand receipts, loads and destruction records
  • Open compromise incidents and holders still to confirm
  • Inventory and reconciliation results

Does

  • Records receipt of material and confirms quantities
  • Approves key requests and issues material on hand receipts
  • Prepares destruction and other reports for submission
  • Opens compromise incidents and records the controlling authority's direction
  • Runs periodic and change-of-custodian inventories
  • Assigns hand receipt holders and key operators

Cannot

  • Complete a two-person step alone
  • Edit or delete entries in the audit trail
  • Close an incident while holders are still unconfirmed, without recording why
Approvals
Approves key requests and issues; two-person steps need a second authorized person, usually the alternate.
Notified about
New key requests, supersessions coming due, destruction overdue, compromise reports and inventory discrepancies.

Alternate account manager

Alternate COMSEC account manager, alternate custodian

Acts for the account manager when needed and is the second person on two-person tasks.

Sees

  • Everything the account manager sees, while acting for them
  • Two-person tasks waiting for their confirmation
  • Inventory and destruction records

Does

  • Confirms two-person receipt and destruction steps
  • Witnesses destruction and records it
  • Issues material and approves requests when designated to act
  • Runs inventories with the account manager

Cannot

  • Confirm a two-person step they started themselves
  • Change the account's role assignments unless designated to act
  • Edit or delete entries in the audit trail
Approvals
Acts with the account manager's authority only while designated; their confirmations count as the second person on two-person tasks.
Notified about
Two-person tasks waiting for them, and everything the account manager receives while they are designated to act.

Hand receipt holder

Local element custodian, hand receipt holder, unit COMSEC custodian

Holds material for their unit and keeps the account informed of what they have and what has been destroyed.

Sees

  • Material issued to them and its supersession dates
  • Devices registered to their unit and the key loaded in each
  • Their open requests and any compromise incidents affecting them

Does

  • Requests key for named devices, nets or missions
  • Signs hand receipts for issued material
  • Confirms holdings during inventories
  • Reports suspected loss or compromise
  • Confirms rekey and destruction in their unit

Cannot

  • Issue material to another holder without the account manager
  • See other units' holdings
  • Close a compromise incident
Approvals
Their requests are approved by the account manager; transfers to other holders need the account manager's approval.
Notified about
Material issued to them, supersessions coming due, destruction overdue and compromise direction affecting their holdings.

Key operator

Key operator, crypto operator, communications technician

Loads key into devices and zeroizes superseded key, recording each action as it happens.

Sees

  • Key issued to their unit for loading
  • Devices assigned to them and the key currently loaded in each
  • Rekey and zeroization tasks assigned to them

Does

  • Records each device load against the device serial number
  • Records zeroization of superseded or compromised key
  • Confirms rekey tasks during a compromise response
  • Flags devices that cannot be rekeyed, such as those in maintenance

Cannot

  • Request or receive material on the account directly
  • Record destruction without the witness your procedures require
  • See holdings outside their unit
Approvals
None of their own; their loads and zeroizations are reviewed by the hand receipt holder and account manager.
Notified about
Rekey and zeroization tasks assigned to them and compromise direction affecting their devices.

Controlling authority

Controlling authority, key manager for a net or system

Directs how the keys it controls are used, when they are superseded and what happens after a compromise.

Sees

  • Holdings and device loads of the keys it controls, across the accounts it is granted
  • Compromise incidents involving its keys
  • Supersession schedules for its keys

Does

  • Records direction on a compromise: continue use, supersede or stop use
  • Sets or changes supersession dates for its keys
  • Tracks holders' confirmation of directed action
  • Exports incident timelines for its own reporting

Cannot

  • Issue or destroy material on an account
  • See keys it does not control
  • Edit holders' confirmations
Approvals
Its direction on a compromise is recorded as the decision the account and holders act on.
Notified about
Compromise reports involving its keys and holders who have not confirmed directed action.

Inspector or auditor (read-only)

COMSEC inspector, internal auditor, inspector general staff (under temporary access)

Reviews the account's records and evidence without being able to change anything.

Sees

  • Inventory, hand receipts, loads and destruction records within the scope granted
  • Inventory and reconciliation results
  • Compromise incidents and their timelines
  • The audit trail

Does

  • Searches and reads records within their scope
  • Exports records and reports, with each export logged
  • Leaves inspection notes where the account enables them

Cannot

  • Change, issue, approve or destroy anything
  • See records outside the scope and dates granted
  • Keep access after it expires
Approvals
Their access is approved by the account manager or an administrator, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Administrator

System administrator, information system security officer

Manages users, roles, sites and integrations, without authority over the material on the account.

Sees

  • Users, roles, accounts and sites
  • Integration status and synchronization from disconnected sites
  • The record of permission changes

Does

  • Adds and removes users, or maps them from identity provider groups
  • Assigns roles to accounts and sites
  • Maintains integrations and site synchronization
  • Runs access review reports

Cannot

  • Issue, transfer or destroy material
  • Record loads or confirm two-person steps
  • Grant themselves an account role without the account manager's approval
Approvals
Role changes that grant account manager or alternate rights are approved by the account manager.
Notified about
Synchronization failures, access reviews coming due and accounts not used for a period your policy sets.

Permissions at a glance

ActionAccount mgrAlternateHolderKey operatorCtrl authorityInspectorAdmin
Record receipt of materialFullApprovesNo accessNo accessNo accessNo accessNo access
Request keyFullFullOwn work onlyNo accessNo accessNo accessNo access
Approve and issue materialApprovesApprovesNo accessNo accessNo accessNo accessNo access
Sign hand receiptsNo accessNo accessOwn work onlyNo accessNo accessNo accessNo access
Record device loadsFullFullOwn work onlyOwn work onlyNo accessNo accessNo access
Record destructionFullApprovesOwn work onlyOwn work onlyNo accessNo accessNo access
Report a compromiseFullFullOwn work onlyOwn work onlyView onlyNo accessNo access
Direct compromise responseView onlyView onlyNo accessNo accessApprovesView onlyNo access
Run inventoriesFullFullOwn work onlyNo accessNo accessView onlyNo access
Prepare reports for submissionFullFullNo accessNo accessNo accessView onlyNo access
View audit trailView onlyView onlyNo accessNo accessNo accessView onlyView only
Manage users and rolesApprovesNo accessNo accessNo accessNo accessNo accessFull
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Two-person integrity is enforced where your procedures require it: the system records both people, and nobody can confirm a step they started themselves.
  • Roles are configured with you during implementation and limited by account, unit and site, so a hand receipt holder sees only their own unit's holdings and a controlling authority sees only the keys it controls.
  • Every permission change is recorded in the audit trail with who made it and when, and access review reports list each person's roles for periodic certification by the account manager.
  • Users sign in through your identity provider, including smart-card sign-in, and roles can follow its groups. Inspectors get temporary read-only access with a defined scope and an end date, rather than shared accounts.

Features

What it does

Account inventory

Every item of keying material on the account, with its short title, edition, accounting legend, location, holder and supersession date.

Key requests

Units request key for named devices, nets or missions, and the account manager approves, issues or returns each request with a reason.

Electronic hand receipts

Material issued to local holders is signed for electronically, and transfers between holders are recorded rather than handed over on paper.

Device load records

Each load into a radio, weapon system or other end cryptographic unit is recorded against the device serial number, so you can see which key is in which device.

Supersession tracking

Upcoming supersession dates by holder and device, with reminders to rekey and destroy before material goes out of date.

Destruction records

Zeroization and destruction recorded with the destroying official, the witness and the method, and assembled into destruction reports for submission.

Compromise response

A compromise report immediately lists every holder and device with the affected key and tracks each through the directed supersession steps until all have confirmed.

Two-person integrity

Steps your procedures mark for two-person integrity, such as receipt or destruction of certain material, cannot be completed until a second authorized person confirms.

Inventory and reconciliation

Periodic and change-of-custodian inventories are run from the system, with each item confirmed by the holder and discrepancies recorded for resolution.

Key generation for commercial keys

Unclassified and commercial symmetric and asymmetric keys can be generated, wrapped and distributed through a FIPS 140-3 validated hardware security module you designate.

Device registry

End cryptographic units and fill devices registered with their type, serial number, assigned unit and status, including devices in maintenance or awaiting disposal.

Inspection-ready audit trail

Every receipt, issue, transfer, load, destruction and report recorded with the person and time, and exportable for inspectors and auditors.

Integrations

How it connects to your systems

Connects toHowWhat flows
Government key management infrastructureRecords of material received from your government key management infrastructure are imported or entered on receipt, and reports are prepared in the form your infrastructure requires, for your account manager to submit.In: shipment and transfer records. Out: reports for submission by your account manager.
Hardware security modulesUnclassified and commercial keys are generated and wrapped in a FIPS 140-3 validated hardware security module you own and designate; key values never appear in the application.Out: generation and wrapping requests. In: key identifiers and status, not key values.
Fill device recordsWhere your fill devices can export load logs, those logs are imported to confirm device loads instead of entering them by hand.In: load records with device serial, key identifier and time.
Property and maintenance systemsDevice serial numbers, assigned units and maintenance status from your property book or maintenance system keep the device registry current.In: device records, assignments and status changes.
Single sign-onUsers sign in through your identity provider, including smart-card (PKI) sign-in where your environment uses it.In: user identity and group membership for role assignment.
Security information and event managementThe audit trail is streamed to your SIEM so security staff see account activity alongside other events.Out: audit events in a standard log format.
Work APIHoldings, requests, supersession schedules and incident status available to your own reporting tools through the Moraph Work API, inside your environment.Out: inventory, requests, loads, destruction and incident records, without key values.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

No key values in the application

The system records identifiers, holdings and events. Key values stay in the hardware security module, fill devices and end cryptographic units, never in the application database.

Single sign-on and role-based access

Users sign in through your identity provider, and what each person can see and do follows their role and account; issuing key is separate from approving its use.

Two-person integrity

Actions your procedures require two people for are enforced by the system, and both identities are recorded.

Encryption and keys

Records are encrypted at rest and in transit, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, issue, load, destruction and report is logged with the person and time, and cannot be edited.

Your authority, cleared support

On classified networks the system is installed and operated under your authority. Support tickets for defense and intelligence clients are handled only by US citizens with active clearances.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Account operations

Account inventory

For account manager and alternate

Every item on the account with its short title, edition, accounting legend, holder, location and supersession date.

Break down by
Holder, Short title, Accounting legend, Status
Delivered as
Live view; PDF and CSV export
Used for
Knowing exactly what the account holds and where.

Supersession and destruction due

For account manager, hand receipt holders

Material coming up for supersession and superseded material not yet recorded as destroyed.

Break down by
Holder, Due window, Short title, Device type
Delivered as
Live dashboard; scheduled email
Used for
Making sure key is replaced and destroyed on time.

Key requests

For account manager

Open, approved and returned key requests with the unit, purpose and date needed.

Break down by
Unit, Status, Short title, Date needed
Delivered as
Live dashboard; CSV export
Used for
Working requests in time for the mission or net they support.

Device load status

For account manager, hand receipt holders, key operators

Each registered device with the key currently loaded, when it was loaded and whether it is due for rekey.

Break down by
Unit, Device type, Short title, Load age
Delivered as
Live view; CSV export
Used for
Seeing which devices need attention before a supersession date.

Compromise response

Open incidents

For account manager, controlling authority

Each open compromise incident with the affected key, the direction given, and holders and devices still to confirm.

Break down by
Incident, Holder, Direction, Confirmation status
Delivered as
Live dashboard; scheduled email
Used for
Driving every holder through the directed response until all have confirmed.

Incident timeline

For account manager, controlling authority, inspectors

The full sequence of a compromise incident: report, holders identified, direction, issue of replacement key and each confirmation.

Break down by
Incident, Step, Person, Time
Delivered as
On request in the product; PDF export
Used for
Supporting the incident report your procedures require.

Accountability and audit

Inventory reconciliation

For account manager, inspectors

The results of each inventory: items confirmed by holders, discrepancies found and how each was resolved.

Break down by
Inventory date, Holder, Discrepancy type, Resolution
Delivered as
Live view; PDF and CSV export
Used for
Evidencing that inventories took place and discrepancies were resolved.

Destruction register

For account manager, inspectors

Every destruction recorded, with the method, destroying official, witness and the report it was submitted on.

Break down by
Period, Holder, Short title, Report status
Delivered as
Live view; PDF and CSV export
Used for
Showing that superseded material was destroyed and reported.

Hand receipt register

For account manager, inspectors

Current and past hand receipts, who signed for what, and transfers between holders.

Break down by
Holder, Short title, Issue date, Status
Delivered as
Live view; PDF and CSV export
Used for
Tracing custody of any item at any point in time.

Audit trail extract

For inspectors and auditors

Who did what and when for a selected item, holder, incident or period, including two-person confirmations.

Break down by
Record, User, Action, Date range
Delivered as
On request in the product; CSV and PDF export
Used for
Answering inspection requests for evidence without assembling it by hand.

Administration

Access review

For account manager, administrators

Each user's roles, accounts and sites, and accounts not used recently.

Break down by
Role, Account, Site, Last sign-in
Delivered as
Live view; CSV export
Used for
Periodic certification of who has access to the account.

Exports, access and evidence

  • Every report can be exported to CSV, and register and evidence reports to PDF. Reports can be scheduled to arrive by email for the people entitled to see them, within your network's rules.
  • Each report can be filtered and the filters saved, so an account manager or controlling authority can keep their own views.
  • Inventory, request, load, destruction and incident data is available through the Moraph Work API inside your environment, without key values, for your own reporting tools.
  • Reports respect each viewer's role: a hand receipt holder sees their own unit, a controlling authority sees its own keys, and inspectors can be given read-only access to reports and the audit trail.
  • Accountability reports can be run as of a past date and give the same result each time. Running and exporting a report is itself recorded in the audit trail.

Deployment

Where and how it runs

Client-hosted on your networks

Installed in your environment, including classified networks, and operated under your authority and within your own authorization.

Disconnected and tactical sites

Local instances at sites with limited connectivity record holdings and loads offline and synchronize with the account when a connection is available.

Moraph cloud, United States

For unclassified commercial key inventories, available hosted in Moraph's United States region where your policy allows.

With a managed service

Optionally supported by a Moraph managed service for administration and integration upkeep, with staff who hold the clearances your environment requires.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Account and procedures review

We review your COMSEC account structure, local elements, hand receipt practices and the procedures your service or agency requires, and agree how the system will follow them.

Inventory load

Your current holdings, hand receipts and device registry are loaded and reconciled against a physical inventory your account manager conducts.

Integration with your infrastructure

Imports from your key management infrastructure, property and maintenance systems, fill device logs and hardware security module are configured within your environment's rules.

Workflow and roles

Request and approval steps, two-person integrity rules, reminder timing and roles are configured to match your procedures.

Compromise exercise

A tabletop compromise is run through the system with your account manager and controlling authority before go-live, using fictional key and device records.

Training and go-live

Account managers, hand receipt holders and key operators are trained on their own tasks, and paper records are retired on a date your account manager sets.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • It does not produce government-issued keying material. Keys for national security systems come from your government key management infrastructure; the system accounts for them but does not replace that infrastructure.
  • Key generation is limited to unclassified and commercial keys, generated in a FIPS 140-3 validated hardware security module that you provide and designate.
  • Moraph does not claim accreditation or authorization of the system for any classified environment. Use on classified networks requires your organization's own authorization and is operated under your authority.
  • It does not load key into devices or zeroize them. People do that with fill devices and the equipment itself; the system records it.
  • Revocation after a compromise depends on people acting on the controlling authority's direction. The system shows who must act and tracks confirmation, but cannot reach into devices to remove key.
  • Reports to your government key management infrastructure are prepared for your account manager to submit; the system does not submit them on your behalf.
  • The accuracy of holdings depends on loads, transfers and destruction being recorded when they happen, especially at disconnected sites that synchronize later.
  • It is not a COMSEC incident reporting authority. Decisions about whether an incident occurred and what it requires belong to your controlling authority and the officials your procedures name.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Load a fictional copy of your account structure and walk an item from receipt to destruction
  2. Run a tabletop compromise and check how quickly the system shows every affected holder and device
  3. Confirm that two-person integrity steps cannot be completed by one person
  4. Check that no key values reach the application database or logs
  5. Run an inventory and compare the reconciliation with how your account manager works today
  6. Test offline recording at a disconnected site and the synchronization that follows

Questions

Frequently asked questions

Does the system replace our government key management infrastructure?

No. It works alongside it, recording what you receive, issue, load and destroy, and preparing the reports your account manager submits through the channels your procedures require.

Does it store key values?

No. It records identifiers, holdings and events. Key values stay in the hardware security module, fill devices and end cryptographic units.

Is it accredited for classified networks?

Moraph does not claim accreditation for any classified environment. The system is installed and operated under your authority, and Moraph provides control documentation to support your own authorization.

Who at Moraph can see our account?

On your networks, nobody without your authorization. Moraph support staff for defense and intelligence clients are US citizens with active clearances, and any work in your environment happens under your authority and procedures.

How is it priced?

As a subscription, usually measured by the number of accounts and sites, with implementation charged separately. See Working with Moraph for what drives a quotation.

Is there an accessibility conformance report?

Ask for one through the procurement request form at /how-to-buy/request, naming the version you are evaluating.

Next steps

Evaluate Cryptographic Key Management System (CKMS)

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Cryptographic Key Management System (CKMS) guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Cryptographic Key Management System (CKMS) support guide.

Related products