FedRAMP High Managed Landing Zone

Principal workflows

• Establish: Moraph builds the landing zone in your agency's AWS GovCloud (US) or Azure Government organization: account or subscription structure, network hub, identity, logging and guardrails, to a baseline your ISSO approves.
• Onboard an application: When an application team needs a place to deploy, Moraph provisions an account or subscription inside the landing zone with the guardrails, network connections and logging already in place.
• Operate: Moraph monitors the shared components, maintains the boundary, patches what it manages and checks the configuration for drift, reporting each month.
• Support authorization: The landing zone's control implementations are documented once, so application packages can reference them rather than repeat them. Evidence is kept current for continuous monitoring.

Who uses it

• Agency CIO and cloud program offices
• Application and product teams that deploy to the cloud
• Information system security officers and authorizing officials
• Security operations centers that need visibility across cloud accounts
• Inspectors general and auditors reviewing cloud controls

Reporting

• Environment requests and their status
• Baseline drift by account and control family
• Guardrail violations and open exceptions
• Control inheritance for application authorization packages
• Plan of action and milestones items and their status
• Cloud cost by program and application

Features

• Account and subscription structure: A multi-account or multi-subscription layout that separates shared services, security tooling and each application's environments.
• Boundary protection: A network hub with controlled ingress and egress, inspection, and connections to the agency network aligned with your TIC 3.0 approach.
• Federated identity: Sign-in through your agency's identity provider, including PIV, with privileged access separated and recorded.
• Guardrails: Preventive policies, applied through AWS Organizations or Azure Policy, that stop accounts from disabling logging, using unapproved regions or creating public exposure without approval.
• Central logging: Logs from every account collected centrally and retained to support OMB M-21-31, and forwarded to your security operations.
• Encryption and key management: Encryption at rest and in transit using the cloud provider's key management services, with keys controlled by your agency.
• Environment provisioning: New accounts or subscriptions for application teams created from a standard pattern, with guardrails, logging and networking already applied.
• Patching of shared components: Moraph patches the landing zone's own components, such as network appliances, bastion hosts and shared tooling, on the schedule your ISSO agrees.
• Drift detection: The approved configuration is checked continuously, and differences are reported and corrected through change requests.
• Control inheritance documentation: Control implementation statements and a customer responsibility matrix, so application teams know which controls the landing zone provides and which remain theirs.
• Cost and tagging: Tagging standards and cost reports by account, application and program, so spending can be attributed.
• Backup and recovery: Backup policies for shared components and an agreed recovery approach, tested with your staff.

Integrations

• AWS GovCloud (US) or Azure Government: The landing zone is built in your agency's organization or tenant on the cloud provider, using its native account, network, policy and key management services.
• Agency identity provider: Users sign in through your identity provider with PIV or other approved authenticators, and roles follow its groups.
• Agency network and TIC: Connections between the landing zone and your agency network follow your TIC 3.0 architecture.
• Security operations and SIEM: Logs and security events from every account forwarded to your agency's security operations tooling.
• Continuous Diagnostics and Mitigation: Asset and configuration data made available to your agency's CDM tooling where your agency requires it.
• Governance, risk and compliance tooling: Control implementation statements and evidence shared with your GRC tool or Moraph's FedRAMP ATO Accelerator.
• Moraph Work API: Environment requests, changes, findings and service reports available to your service management tools.

Deployment

• AWS GovCloud (US): Built in your agency's AWS GovCloud (US) organization, using AWS Organizations, Control Tower or equivalent native services.
• Azure Government: Built in your agency's Azure Government tenant, using management groups, Azure Policy and equivalent native services.
• Both providers: Landing zones in both clouds with a common set of guardrails, logging and reporting, scoped in the proposal.

Security and privacy

• Single sign-on: Users sign in through your agency's identity provider, so your authentication policies, including PIV, apply.
• Role-based and privileged access: Access follows each person's role; privileged access to shared components is time-bound, approved and recorded.
• Encryption and keys: Data is encrypted at rest and in transit, with keys controlled by your agency that Moraph staff cannot use without explicit, time-bound authorization.
• Complete audit trail: Every configuration change, privileged session and approval is logged with the person and time, and the logs cannot be edited.
• US-only hosting and cleared staff: The landing zone runs only in US government cloud regions, and Moraph's federal work is handled by US citizens with active clearances.
• Tested releases: Security testing gates every change to Moraph's templates and automation, and a software bill of materials is kept for the components Moraph supplies.

Limitations

• Moraph is not the cloud provider. AWS and Microsoft's own service commitments, roadmaps and outages apply, and cloud services and licences are subject to their terms.
• Moraph does not hold a FedRAMP authorization for the landing zone. The underlying cloud services carry the provider's own authorizations; your authorizing official decides whether systems built on the landing zone operate, and Moraph supports that with control mappings and evidence.
• The name refers to the FedRAMP High baseline the landing zone is configured against. How many controls an application inherits depends on the application and is set out in its customer responsibility matrix.
• Application teams remain responsible for their own workloads, code, data and the controls the matrix assigns to them, including patching their workloads unless contracted separately.
• The landing zone does not replace your security operations center; it forwards logs and events for your SOC to monitor and investigate.
• It is built only in US government cloud regions and is not intended for workloads that require a classified environment.
• Bringing existing accounts that were built differently into the landing zone may require rework, assessed account by account during discovery.
• Cost reporting depends on the provider's billing data and on application teams applying the agreed tags.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/fedramp-high-managed-landing-zone. Purchasing routes and company information: www.moraph.com/how-to-buy.