Mission Partner Environment (MPE) Builder

Principal workflows

• Request and approve: A mission owner requests an enclave for a named mission, its partners and its period. The foreign disclosure officer records what categories of information may be shared with each partner, and the ISSM approves the template and boundary.
• Build: Moraph builds the enclave from an approved, versioned template using infrastructure as code, so each enclave starts from the same hardened configuration and differences are recorded.
• Operate: Partners are onboarded as your organization approves them, and Moraph runs the enclave: monitoring, patching, change control and user support for the life of the mission.
• Tear down: When the mission owner closes the mission, Moraph revokes every partner account and connection, transfers the records your organization keeps, removes the remaining data and sanitizes storage, and records each step for your ISSM.

Who uses it

• Combatant command and service component staff who plan partner information sharing
• Foreign disclosure officers who approve what partners may receive
• Information system security managers responsible for enclave authorization
• Network operations teams who provide connectivity to partners
• Assessors and inspectors who review partner access and teardown evidence

Reporting

• Enclaves by mission, partner, template version and end date
• Partner accounts by enclave, with last use and expiry
• Data movement by enclave, partner and disclosure decision
• Changes requested, approved and applied
• Teardowns completed, with evidence status
• Alerts triaged and escalated, with outcomes

Features

• Approved enclave templates: Versioned, hardened templates for common partner-sharing patterns, each approved by your ISSM before use.
• Infrastructure as code: Enclaves are built from code rather than by hand, so each build is repeatable and its configuration is recorded.
• Disclosure-linked sharing: Sharing rules for each partner are configured from the disclosure decision your foreign disclosure officer recorded, and the decision is kept with the enclave.
• Partner onboarding: Partner organizations and named users are added only after approval, with each account tied to the mission and its end date.
• Mission-bound access: Every account, key and connection carries the mission's end date, and reminders go out before it is reached.
• Configuration baseline: Each enclave is compared with its template baseline, and differences are reported for a decision.
• Data movement records: Information moved into and out of the enclave is logged with who moved it and under which disclosure decision.
• Monitoring and alert triage: Moraph watches enclave health, access and data movement, and escalates confirmed issues to your security operations team.
• Controlled teardown: A teardown runbook revokes access, transfers retained records, deletes data and sanitizes storage, step by step.
• Teardown evidence: Each teardown produces a record of what was revoked, transferred, deleted and sanitized, signed off by your ISSM.
• Change control: Changes to a running enclave are raised, approved through your process, applied and recorded.
• Enclave inventory: One view of every enclave: its mission, partners, template version, users and end date.

Integrations

• Your identity provider: US users sign in through your identity provider, with groups used to assign enclave roles.
• Partner identity: Partner users are given enclave accounts, or federated with a partner's identity service where your ISSM approves it.
• Disclosure records: Disclosure decisions are recorded in the service or referenced from the system your foreign disclosure office already uses.
• Cross-domain transfer: Where information must move between enclaves or networks, transfers go through the cross-domain solution your organization has approved, including Moraph's Cross-Domain Solution (CDS) Transfer Agent.
• SIEM: Enclave access, data movement and administrator events are sent to your SIEM.
• IT service management: Requests, changes and incidents are tracked in your service management tool, or in Moraph's if you have none.
• Records repository: Records your organization keeps from a mission are transferred to your designated repository before teardown.

Deployment

• Commercial cloud in US regions: Enclaves for unclassified sharing built in the US government cloud regions your organization authorizes, with Moraph's service tooling hosted in the United States region.
• Your data centers: Enclaves built on infrastructure you own or operate, with Moraph working under your access procedures.
• Classified networks: Where enclaves run on classified networks, Moraph's cleared staff work under your organization's authority and procedures, scoped in the proposal.

Security and privacy

• Single sign-on: US users and administrators sign in through your identity provider, so your authentication policies apply.
• Role-based access: What each person can see and do follows their role and the mission they belong to; partners see only their own enclave.
• Encryption and keys: Enclave data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization, and keys are destroyed at teardown.
• Complete audit trail: Every request, approval, build, change, data movement and teardown step is logged with the person and time.
• Cleared US support staff: Tickets for federal and defense clients are handled only by US citizens with active clearances.
• Your authority, your networks: Enclaves on classified networks are built and operated under your organization's authority and procedures; Moraph does not hold the authorization.

Limitations

• Moraph is not the vendor of the cloud, network or software products the enclaves are built on. Those vendors' own service commitments, roadmaps and outages apply.
• Licenses for underlying products are subject to each vendor's terms.
• Moraph does not make disclosure or release decisions. Your foreign disclosure officers decide what each partner may receive; the service configures and records what they approve.
• Moraph does not authorize enclaves. Your authorizing official makes that decision; Moraph maps controls and supplies evidence.
• Build time depends on the template, the infrastructure and your approvals, and is agreed per mission rather than guaranteed.
• Teardown removes data from the enclave's own storage. Copies a partner has legitimately taken out under an approved disclosure are governed by your agreements with that partner, not by the service.
• Connectivity to partner networks is provided by your organization and its partners; Moraph configures the enclave side.
• The service is not a cross-domain solution; information moving between classification levels uses the cross-domain solution your organization has approved.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/mission-partner-environment-mpe-builder. Purchasing routes and company information: www.moraph.com/how-to-buy.