Foreign Disclosure/Release (FDR) Workflow

Principal workflows

• Request: An action officer submits a request describing the information, the intended foreign recipient, the purpose and the date it is needed, with the material attached or referenced.
• Check: The workflow reads the markings recorded for each item and compares them with the release rules your organization has configured, flagging anything that needs closer review.
• Review and consult: The Foreign Disclosure Officer reviews the request and the checks, consults the originator, export control and other reviewers as needed, and records every response in the request.
• Decide and record: The officer with the delegated authority approves, approves with conditions, or denies release, and the decision is recorded with its basis, the releasable version and any conditions.

Who uses it

• Foreign Disclosure Officers and their offices
• Designated and principal disclosure authorities
• Action officers and program staff who need to share information with partners
• Security managers and export control reviewers
• Inspectors and oversight staff who review disclosure programs

Reporting

• Open requests by office, step and need date
• Consultations waiting on originators and reviewers
• Decisions by outcome, recipient group and category
• Time from request to decision, by step
• Delegations of authority and their expiry
• Disclosure log of every release and denial

Features

• Structured disclosure requests: One request form for the recipient, purpose, material and need date, so officers start with what they need instead of chasing it.
• Marking checks: Classification and dissemination control markings recorded for each item are compared with the recipient and your configured release rules, with every flag explained.
• Configurable release rules: Your disclosure office maintains the rules the workflow checks against, such as recipient groups and delegated authority by category, with each change approved and versioned.
• Delegated authority routing: Each decision is routed to an officer whose recorded delegation covers the recipient and category, and escalated when it does not.
• Export control flags: Material that may be subject to ITAR is flagged for export control review before release is considered.
• Originator consultation: Requests to originators and original classification authorities are sent, tracked and answered inside the request record.
• Precedent search: Earlier decisions on similar material and recipients can be found and compared, so similar questions are answered consistently.
• Sanitization tracking: Versions prepared for release are kept with the request, with who prepared and approved each version.
• Conditions of release: Handling conditions, such as restrictions on further transfer, are recorded with the decision and passed to the requester.
• Disclosure log: A searchable record of every request, decision, basis and recipient, for program reporting and oversight.
• Suggestions, not decisions: Where the workflow suggests a likely outcome or relevant precedent, it shows its reasons; an authorized officer makes and records every decision.
• Complete audit trail: Every view, check, consultation, decision and export is recorded with the person and time.

Integrations

• Document and records systems: Material can be referenced from your document management or records system rather than uploaded again, where your environment allows it.
• Classification marking data: Markings applied by your marking or labeling tools are read where they are available in document metadata, and confirmed by the officer.
• Personnel and organization data: Requesters, offices and officers from your personnel or directory system, so requests route to the right office.
• Visit and assignment records: Approved foreign visits and assignments can be referenced on a request so the officer sees the context of the release.
• Export control records: Export authorizations or agreements your organization records can be linked to a request for the reviewer.
• Single sign-on: Users sign in through your identity provider using SAML or OpenID Connect, including certificate-based sign-in where your provider supports it.
• Work API: Request and decision data available to your reporting tools through the Moraph Work API, within the environment where the workflow runs.

Deployment

• Client-operated environment: Installed in an environment your organization operates, including classified networks. Operation there is under your authority and accreditation process, and Moraph provides control documentation to support it.
• Moraph cloud, United States: Hosted by Moraph in the United States region for unclassified use, such as training, evaluation and requests that involve only unclassified information.
• With a managed service: Optionally supported by a Moraph managed service for administration and configuration, delivered by cleared US citizen staff under the access your organization grants.

Security and privacy

• Records kept in the United States: For US government clients, data in Moraph's cloud is hosted only in the United States region.
• Cleared support lane: Support tickets from federal and defense clients are handled only by US citizens with active security clearances.
• Access by role and office: People see only the requests their role, office and consultations allow.
• Encryption under controlled keys: Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.
• Complete audit trail: Every view, check, consultation, decision and export is logged with the person and time, and cannot be edited.
• People decide: The workflow checks, flags and suggests; every disclosure decision is made and recorded by an authorized officer.

Limitations

• It does not make disclosure decisions. An officer with delegated authority decides every request, and the release rules are your organization's policy, not Moraph's.
• The checks are only as good as the markings recorded on the material and the rules your office configures. Unmarked or incorrectly marked material must be reviewed by the officer.
• It does not determine whether material is subject to export control. It flags material for review by your export control and legal staff.
• Moraph does not host classified information. Use with classified material happens only in environments your organization operates, under your authority.
• Moraph holds no accreditation or authorization for classified systems, and no FedRAMP or DoD impact level authorization for this product. We map controls and provide documentation to support your organization's own decision.
• It does not transfer information to foreign partners. Releasable material is passed through the channels your organization approves.
• It does not apply classification markings or replace your marking tools.
• Moraph does not supply the content of disclosure policies or agreements; your office loads and maintains the rules it applies.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/foreign-disclosure-release-fdr-workflow. Purchasing routes and company information: www.moraph.com/how-to-buy.