Healthcare · Managed platform (Cisco ISE)

Network Access Control

Know every device that plugs into your hospital network, and contain the ones you don't

Book a demonstration Request a technical briefing Factsheet

Overview

What you are buying

Moraph resells, implements and runs Cisco Identity Services Engine (ISE) so that every device connecting to a wired port or wireless network in your hospital is identified and given only the access its role allows. Unknown devices, including medical devices plugged into a wall jack without going through clinical engineering, are placed in a restricted network until someone decides what they are. Moraph builds the policies with your network, security and clinical engineering teams, introduces enforcement in stages so patient care is not interrupted, and triages what ISE sees every day.

The problem it solves

Hospital networks carry infusion pumps, monitors, imaging systems, building controls, workstations and personal devices, often on the same switches. Many medical devices cannot run security software or authenticate in the usual way, and a device plugged into an open wall jack typically gets the same access as a workstation. Security teams cannot say with confidence what is connected, clinical engineering learns about new devices after they are in use, and nobody wants to be the one whose blocking rule takes down a monitor in a patient's room.

There is no reliable inventory of what is connected to each port and wireless network
Unknown devices plugged into wall jacks get broad network access
Medical devices often cannot authenticate with certificates or run endpoint agents
Fear of disrupting clinical devices keeps enforcement switched off

Who uses it

Network and infrastructure teams at hospitals and health systems
Information security officers responsible for the Security Rule and network risk
Clinical engineering and biomedical teams who own medical devices
IT leaders who need network access control without adding headcount
Facilities teams responsible for building and environmental systems on the network

Requirements it supports

HIPAA Security Rule access control and risk management (45 CFR 164.308 and 164.312)HHS 405(d) Health Industry Cybersecurity Practices (HICP)HHS Healthcare and Public Health Sector Cybersecurity Performance GoalsIEC 80001-1 risk management for health IT networks incorporating medical devicesNIST Cybersecurity Framework 2.0NIST SP 800-207 Zero Trust Architecture

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Cisco provides Identity Services Engine and the network equipment it relies on, Moraph designs, configures and runs the access policies, and your organization owns the network, the devices and every decision to restrict them.

Area	Moraph	Cisco	Your organization
Licensing	Resells ISE licences and tracks endpoint counts and renewals with you	Sets licence terms, tiers and endpoint measures	Agrees scope and signs the order
Platform software	Operates ISE nodes, monitors their health and plans capacity	Provides the software and fixes product defects	Provides the virtual or physical hosts where nodes run in your data centers, unless agreed otherwise
Network equipment	Configures switch and wireless controller settings that ISE needs, under your change process	Provides the switch and wireless features ISE relies on	Owns the switches, controllers and network design, and approves changes to them
Access policy	Designs and maintains authentication, profiling and authorization policies	Provides policy, profiling and posture capabilities	Decides which device types and users get which access
Enforcement	Moves locations from monitoring to enforcement in agreed stages and watches the effect	Enforces the policy configured	Approves each stage, with clinical engineering sign-off for clinical areas
Device classification	Triages unknown and newly profiled devices and proposes a classification	Provides profiling data and libraries	Clinical engineering and IT confirm what each device is and who owns it
Monitoring and alerts	Watches authentication failures, quarantines and node health, and triages alerts	Provides logs, alarms and context sharing	Receives escalations and decides on response
Incident response	Investigates access problems, restores service on the access layer and releases devices when authorized	Resolves product defects through support cases	Leads security incidents and patient safety decisions
Patches and upgrades	Plans, tests and applies ISE patches and upgrades in agreed windows	Publishes patches, versions and support timelines	Agrees maintenance windows
Exceptions	Records each exception with its owner, reason and end date	No role	Approves exceptions and accepts the risk

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Cisco ISE itself, which belongs to its vendor.

Step 1

Onboarding tracker

During onboarding, Moraph tracks each step with an owner on each side, from platform build to the first enforcement stage.

Task	Moraph owner	Client owner	Status
ISE nodes deployed in monitoring mode	Network security engineer	Infrastructure manager	Done
Directory and certificate services connected	Network security engineer	IT identity team	Done
Switch configuration pushed to pilot building	Network security engineer	Network engineer	Done
Discovery reconciled with medical device inventory	Service manager	Clinical engineering	412 devices unmatched
Policy design review	Network security engineer	Security officer	Planned

Step 2
Enforcement stage review
Before a location moves to enforcement, Moraph shows what would be restricted and who has signed off.
Network Access Control · Stage ST-05Sample data
East tower, floors 3 to 5 · Medical-surgical units (sample)
Ports in scope
1,140
Devices seen
866
Matched to approved groups
851
Would be restricted
15
Network change approval
Approved
Clinical engineering sign-off
Pending
Devices that would be restricted
- 6 patient monitors with an unrecognized profile after a firmware change
- 5 label printers not in the IT asset inventory
- 4 devices with no profile, at nurse station jacks
Request sign-offPostpone stage
Before a location moves to enforcement, Moraph shows what would be restricted and who has signed off.
Step 3
Alert triage
When an unknown device is contained, Moraph triages it and the owner decides what happens next.
Network Access Control · Triage TR-8812Sample data
Unknown device on wall jack, Example Health Clinic room 214 (fictional)
1. Device connected and placed in restricted network by policyISE
2. Profile suggests a portable vital signs monitor; not in inventoryMoraph network security engineer
3. Clinical engineering asked to identify the deviceMoraph network security engineer
4. Device identified as a loaner awaiting onboardingClinical engineering
5. Device kept restricted until onboarded, unit manager informedClinical engineering
When an unknown device is contained, Moraph triages it and the owner decides what happens next.

Step 4

Change requests

Policy and network changes are tested and approved before Moraph applies them.

Request	Change	Tested	Approval	Status
CR-2031	New device group for infusion pump fleet replacement	Passed	Approved	Applied
CR-2036	Move outpatient building to enforcement	Passed	Approved	Scheduled
CR-2040	Allow imaging modality to reach new archive	Passed	Pending	Awaiting security officer
CR-2044	Apply ISE patch release	In lab	Pending	Needs maintenance window

Step 5
Monthly service review
Each month Moraph reports on what ISE saw, what was contained and released, and how enforcement is progressing.
Network Access Control · Service reviewSample data
Monthly service review · Fictional sample month
Devices contained
47
Released after identification
39
Still restricted
8
Exceptions expiring next month
3
Locations in enforcement
14 of 22
Platform notices
1 security advisory, patch planned
For decision
- Three exceptions for legacy lab analyzers expire next month
- Proposal to enforce the next building in the stage plan
- Patch window needed for the security advisory
Accept reportRaise change request
Each month Moraph reports on what ISE saw, what was contained and released, and how enforcement is progressing.

Step 6

Exception register

Every device allowed outside normal policy has an owner, a reason, an approver and an end date.

Exception	Device	Owner	Reason	Ends
EX-114	Lab analyzer (sample)	Laboratory	Vendor remote support required	Fictional date A
EX-117	Nurse call gateway (sample)	Facilities	Cannot be profiled reliably	Fictional date B
EX-121	Legacy imaging workstation (sample)	Radiology	Replacement scheduled	Expired, review

Workflows

The principal workflows

Discover
Before anything is blocked, ISE runs in monitoring mode and profiles what connects to each switch port and wireless network, so you see the real population of devices.
- Switches and wireless controllers send authentication and profiling data to ISE
- ISE profiles each device from network attributes
- Moraph reconciles results with your medical device and IT asset inventories
- Unrecognized devices listed by location for review
- Clinical engineering and IT confirm device types and owners
Design policy
Access rules are designed with your teams by device type and owner: workstations and staff authenticate with 802.1X, and devices that cannot are identified by profile and allowed only what they need.
- Device groups agreed, such as infusion pumps, patient monitors, imaging, building systems
- Access each group needs documented with its owner
- Authorization rules and restricted network for unknown devices designed
- Policy reviewed by network, security and clinical engineering leads
- Policy tested in a lab or pilot location
Enforce in stages
Enforcement is switched on location by location, starting with non-clinical areas, and only with sign-off for clinical areas, so problems surface where they cause least harm.
- Stage plan agreed, with clinical areas last
- Each location reviewed for devices that would be restricted
- Clinical engineering signs off clinical areas before enforcement
- Enforcement enabled in an agreed window with Moraph watching
- Rollback plan ready for every stage
Contain and decide
When an unknown device connects, ISE places it in a restricted network, Moraph triages it, and the device's owner decides whether it is allowed, classified or removed.
- Unknown device placed in the restricted network by policy
- Moraph triages the alert with location, port and profile data
- Clinical engineering or IT identifies the device and owner
- Device classified and given its access, or kept restricted
- Decision recorded and the inventory updated

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Network engineer

Network engineer, infrastructure manager, network architect

Owns the network equipment and design that ISE works with.

Sees

ISE policy, node health and authentication activity
Switch and wireless configuration changes raised by Moraph
Stage plans and enforcement status by location

Does

Approves configuration changes on switches and wireless controllers
Works with Moraph on network design for segmentation
Agrees maintenance windows for enforcement stages and upgrades
Investigates network faults found during triage

Cannot

Approve access policy changes without the security officer
Release a quarantined clinical device without clinical engineering

Approvals: Network changes they request go through your change advisory process.
Notified about: Changes needing approval, node health problems and enforcement stages scheduled.

Security officer

Chief information security officer, security operations manager, HIPAA security officer

Owns network access policy and accepts the risk of exceptions.

Sees

Access policy and its change history
Quarantine, authentication failure and exception reports
Security alerts shared from ISE to your SIEM
The audit trail of administrative changes

Does

Approves access policy and changes to it
Approves exceptions and their end dates
Leads security incidents involving network access
Reviews the monthly service report
Decides when a device should stay restricted

Cannot

Approve their own exception request
Edit the audit trail

Approvals: Policy changes in clinical areas also need clinical engineering sign-off.
Notified about: Exception requests, policy changes for approval, security-relevant alerts and incidents.

Clinical engineering

Clinical engineering manager, biomedical engineer, healthcare technology manager

Makes sure medical devices are identified correctly and that enforcement never puts patient care at risk.

Sees

Medical devices seen on the network by location and profile
Unknown devices awaiting identification
Enforcement stage plans for clinical areas

Does

Identifies unknown devices and confirms their owner
Keeps the medical device inventory reconciled with what ISE sees
Signs off enforcement in clinical areas
Approves release of quarantined medical devices
Brings new medical devices through onboarding before they connect

Cannot

Change access policy directly
Approve exceptions that the security officer has not accepted

Approvals: Their sign-off is required before enforcement in any clinical area.
Notified about: Unknown devices in clinical areas, quarantined medical devices and enforcement stages planned for clinical areas.

Service desk

IT service desk analyst, clinical IT support

Takes reports from staff whose devices cannot connect and routes them to the right team.

Sees

Connection status of a device by port or address
Whether a device is in the restricted network and why
Open triage tickets

Does

Looks up a device's connection status
Raises tickets to Moraph for triage
Tells staff what will happen next

Cannot

Release a device from the restricted network
Change policy or profiles

Approvals: Nothing they do needs approval; releases are decided by device owners and the security officer.
Notified about: Updates on tickets they raised.

Moraph service team

Moraph network security engineer, service manager

Designs, configures and runs ISE and triages what it sees, within your approvals.

Sees

ISE configuration, policy, profiles and logs
Node health and capacity
Platform notices and support cases with Cisco

Does

Designs and maintains authentication, profiling and authorization policy
Triages quarantined devices, failures and new profiles daily
Runs enforcement stages with rollback plans
Applies patches and upgrades in agreed windows
Opens and follows support cases with Cisco
Prepares the monthly service review

Cannot

Change policy, enforce a new location or release a quarantined clinical device without the required approvals
Change switch or wireless configuration outside your change process
Access ISE outside the scope your organization authorizes

Approvals: Policy changes are approved by the security officer, network changes by your change process, and clinical enforcement by clinical engineering.
Notified about: Alerts, quarantined devices, node health issues, approved changes and Cisco security advisories.

Auditor (read-only)

Internal auditor, risk assessor, external assessor under temporary access

Reviews network access control without being able to change it.

Sees

Access policy and its change history
Exceptions and their approvals
Enforcement status and reports

Does

Reads policy, reports and exceptions
Exports evidence within scope, with each export logged
Records review notes where enabled

Cannot

Change anything
Keep access after it expires

Approvals: Access is approved by the security officer, with a scope and an end date.
Notified about: Nothing by default.

Permissions at a glance

Action	Network eng.	Security	Clinical eng.	Service desk	Moraph	Auditor
View device and session status	View only	View only	View only	View only	Full	View only
Identify and classify devices	View only	View only	Full	No access	Own work only	No access
Change access policy	View only	Approves	View only	No access	Full	View only
Enable enforcement at a location	Approves	Approves	Approves	No access	Full	No access
Release a quarantined device	No access	Approves	Approves	No access	Full	No access
Approve an exception	No access	Approves	View only	No access	No access	View only
Change switch and wireless settings	Approves	View only	No access	No access	Own work only	No access
Raise triage tickets	Full	Full	Full	Full	Full	No access
Apply patches and upgrades	Approves	View only	No access	No access	Full	No access
Manage ISE administrator accounts	No access	Approves	No access	No access	Full	No access
View audit trail	View only	View only	No access	No access	View only	View only

Full
Own work only
Approves
View only
No access

How access is controlled

Moraph carries out changes but does not decide them: access policy is approved by your security officer, network changes go through your change process, and clinical areas need clinical engineering sign-off before enforcement.
A quarantined medical device is released only with clinical engineering and security approval, and an urgent clinical need is handled through an agreed emergency path that is recorded and reviewed afterward.
ISE administrator accounts are named, sign in through your identity provider, and are reviewed periodically; nobody shares an administrator login.
Moraph staff work within the scope your organization authorizes, every administrative change is logged, and changes are reported in the monthly service review.

Features

What it does

Device profiling

ISE identifies device types from network attributes, so pumps, monitors, printers and workstations are recognized without an agent.

Restricted network for unknown devices

Devices that do not match an approved group are placed in a restricted network by policy until someone decides what they are.

802.1X for staff and workstations

Managed workstations and staff devices authenticate with certificates or credentials from your identity systems.

Medical device access by profile

Devices that cannot authenticate are identified by profile and allowed only the systems they need, agreed with clinical engineering.

Staged enforcement

Moraph moves locations from monitoring to enforcement in agreed stages, with sign-off for clinical areas and a rollback plan for each stage.

Guest and personal devices

Visitors and personal devices are given internet-only access separate from clinical systems, through the guest flow your policy sets.

Posture checks

Where you license it, ISE checks managed workstations for required security settings before granting full access.

Segmentation

Device groups are kept to their own network segments or access rules, limiting what a compromised device can reach.

Context sharing

ISE shares device and session context with security tools such as your SIEM, firewalls and medical device security platform.

Daily triage

Moraph reviews quarantined devices, authentication failures and new profiles, and works them with clinical engineering and IT.

Exception register

Devices allowed outside the normal policy are recorded with their owner, reason, approver and end date.

Monthly service review

Each month Moraph reports on enforcement progress, devices contained and released, exceptions, changes and platform health.

Integrations

How it connects to your systems

Connects to	How	What flows
Switches and wireless controllers	Authentication, authorization and profiling data exchanged with your network equipment, configured under your change process.	In: authentication requests and device attributes. Out: access decisions.
Directory and identity provider	Staff and workstation identities checked against your directory and certificate services for 802.1X.	In: user and machine identities and group membership.
Medical device inventory	Reconciliation with clinical engineering's inventory or a medical device security platform, including Moraph's Medical Device Cybersecurity Hub.	In: known devices and owners. Out: devices seen on the network.
Mobile device management	Compliance status from your MDM used in access decisions for managed phones and tablets.	In: enrollment and compliance status.
SIEM	ISE logs and alerts sent to your security information and event management system.	Out: authentication, authorization and quarantine events.
Firewalls and security tools	Device and session context shared with firewalls and other tools that support Cisco's context-sharing interfaces.	Out: device identity, group and session data.
Service desk	Triage and change tickets tracked in Moraph's service desk, with your ticketing system connected where agreed.	In and out: tickets, status and resolution notes.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on for administrators

ISE administrators sign in through your identity provider with multi-factor authentication, using named accounts.

Role-based administration

Administrative roles separate policy changes, device classification and read-only views.

Controlled Moraph access

Moraph engineers reach ISE through an access path your organization approves, within the scope and time it authorizes.

Audit trail

Administrative changes, releases and exceptions are logged with who made them and when, and sent to your SIEM.

Encryption and keys

Configuration backups and evidence Moraph holds for the service are encrypted with keys staff cannot use without explicit, time-bound authorization.

Data handled

ISE handles device and network identity data, not clinical records. Where your use involves protected health information, a business associate agreement is put in place first.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Quarantined devices

For moraph service team, clinical engineering and security

Devices currently in the restricted network, with location, port, profile, time quarantined and triage status.

Break down by: Location, Profile, Owner, Age
Delivered as: Live dashboard; scheduled email
Used for: Making sure every contained device is identified and decided.

Authentication failures

For moraph service team and network engineers

Failed authentications by cause, location and device type, with repeat failures highlighted.

Break down by: Cause, Location, Device type, Period
Delivered as: Live dashboard
Used for: Finding misconfigurations and devices that need attention.

Node health and capacity

For moraph service team and network engineers

ISE node status, load and license consumption.

Break down by: Node, Data center, Period
Delivered as: Live dashboard
Used for: Planning capacity and catching problems early.

Visibility

Connected device inventory

For security officer, clinical engineering and IT asset management

Devices seen on the network by profile, group and location, compared with your inventories.

Break down by: Device group, Location, Profile, Inventory match
Delivered as: Live view; CSV export
Used for: Knowing what is connected and finding devices missing from inventories.

Unknown devices awaiting identification

For clinical engineering and IT

Devices not yet classified, with location, first seen and the profile ISE suggests.

Break down by: Location, Suggested profile, First seen
Delivered as: Live view; scheduled email
Used for: Working through identification.

Enforcement coverage

For security officer and IT leadership

Locations in monitoring and enforcement, and the stage plan for those remaining.

Break down by: Facility, Building, Area type, Stage
Delivered as: Live view; PDF
Used for: Tracking progress toward enforcement across the organization.

Governance

Exceptions

For security officer and auditors

Every exception with device, owner, reason, approver and end date, and those expiring soon.

Break down by: Owner, Reason, Approver, Expiry
Delivered as: Live view; CSV and PDF export
Used for: Keeping accepted risks visible and time-limited.

Policy change history

For security officer and auditors

Each change to access policy, who requested and approved it, and when it took effect.

Break down by: Change type, Approver, Date range
Delivered as: Live view; PDF export
Used for: Evidence that policy changes were approved and controlled.

Administrator access review

For security officer

ISE administrator accounts, their roles and last use.

Break down by: Role, Organization, Last use
Delivered as: PDF; on request
Used for: Periodic certification of who can change ISE.

Service

Monthly service review

For security officer, network and clinical engineering leads

Devices contained and released, triage volumes, exceptions, changes, upgrades and enforcement progress.

Break down by: Period, Facility, Ticket type
Delivered as: PDF; reviewed in a monthly meeting
Used for: Holding Moraph to account for the service and planning the next stages.

Exports, access and evidence

Reports come from ISE's own reporting, your SIEM and Moraph's service records. Moraph sets up the standard set with you during implementation.
Device inventories can be exported for reconciliation with clinical engineering and IT asset records.
Governance reports such as exceptions and policy history can be run for a past period and exported as PDF for risk assessments and audits.
Each team sees the reports it needs: clinical engineering the medical device views, network engineers the health and failure views, and auditors read-only governance reports.
ISE events can be retained in your SIEM under your own retention policy for investigation and audit.

Deployment

Where and how it runs

Nodes in your data centers

ISE runs on virtual or physical hosts in your data centers, operated by Moraph through an access path you approve.

Nodes in your cloud account

Where your design supports it, ISE nodes run in your own cloud account and are operated by Moraph.

Your existing deployment

Where you already run ISE, Moraph reviews the configuration and takes over operation, subject to Cisco's licence terms.

Alongside other Moraph services

Can be run with Moraph's Medical Device Cybersecurity Hub, so the device inventory and network access policy stay in step.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Assessment

We review your network design, switch and wireless capabilities, identity sources and device inventories, and agree the scope with your network, security and clinical engineering leads.

Platform build

ISE nodes are deployed and connected to your directory, identity provider, SIEM and network equipment in monitoring mode.

Discovery

ISE profiles what is connected while nothing is blocked, and the results are reconciled with your inventories.

Policy design

Device groups, access rules and the restricted network are designed with your teams and tested in a lab or pilot location.

Staged enforcement

Locations move to enforcement in agreed stages, non-clinical first, with clinical engineering sign-off and a rollback plan for every stage.

Operations handover

Daily triage, the exception register, the emergency release path and the monthly service review begin.

Limitations

What it does not do

Worth knowing before you evaluate it.

Moraph is not the vendor. Cisco owns Identity Services Engine, and its own support commitments, roadmap, advisories and product defects apply.
Licences are subject to Cisco's terms, and features such as posture checks depend on the licence tier you hold.
Enforcement depends on your switches and wireless controllers supporting the required features; older equipment may need upgrading, which is your organization's decision and cost.
Profiling identifies devices from network behavior and attributes and can be wrong or incomplete. Classification of medical devices is confirmed by clinical engineering.
Decisions to restrict or release a device, especially in clinical areas, are your organization's. Moraph acts within the approvals and emergency path you set.
The service controls network access; it does not patch, harden or replace medical devices, and it is not an endpoint protection product.
Network access control reduces risk from unknown devices but does not on its own stop a compromised device that is allowed on the network.
Security incidents and any patient safety decisions are led by your organization, with Moraph supporting on the access layer.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

Run ISE in monitoring mode in one building and review what it finds against your inventories
Check that your switches and wireless controllers support the features the design needs
Walk through the enforcement stage plan with your clinical engineering lead
Agree the emergency release path for a clinical device before any enforcement
Review the responsibilities table with your network, security and clinical engineering leads
Ask for a sample triage record and monthly service review

Questions

Frequently asked questions

Will this block a patient monitor in the middle of care?

Enforcement is introduced in stages, starting in non-clinical areas, and clinical areas move only with clinical engineering sign-off and a rollback plan. An emergency release path is agreed with you before enforcement begins.

Our medical devices can't do 802.1X. Does that matter?

Devices that cannot authenticate are identified by profile and allowed only the access agreed for their group. Profiling can be wrong, so clinical engineering confirms classifications.

We already run Cisco ISE. Can Moraph take it over?

Yes. Moraph reviews your configuration and takes over operation, subject to Cisco's licence terms.

Who decides whether a device is allowed?

Your organization does. Clinical engineering identifies medical devices, the security officer approves policy and exceptions, and Moraph carries out the decisions.

How is it priced?

ISE licences are priced by Cisco's terms, usually by endpoint count and tier, and Moraph's implementation and managed service are quoted separately. See Working with Moraph for what drives a quotation.

Does Moraph need access to our network?

Yes, to operate ISE. Access is through a path your organization approves, under named accounts, within the scope and time you authorize, and every change is logged.

Next steps

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Network Access Control guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Network Access Control support guide.

Network Access Control

What you are buying

The problem it solves

Who uses it

Requirements it supports

Who is responsible for what

A short walkthrough

Onboarding tracker

Enforcement stage review

Alert triage

Change requests

Monthly service review

Exception register

The principal workflows

Discover

Design policy

Enforce in stages

Contain and decide

Who does what in the product

Network engineer

Sees

Does

Cannot

Security officer

Sees

Does

Cannot

Clinical engineering

Sees

Does

Cannot

Service desk

Sees

Does

Cannot

Moraph service team

Sees

Does

Cannot

Auditor (read-only)

Sees

Does

Cannot

Permissions at a glance

How access is controlled

What it does

Device profiling

Restricted network for unknown devices

802.1X for staff and workstations

Medical device access by profile

Staged enforcement

Guest and personal devices

Posture checks

Segmentation

Context sharing

Daily triage

Exception register

Monthly service review

How it connects to your systems

How your data is protected

Single sign-on for administrators

Role-based administration

Controlled Moraph access

Audit trail

Encryption and keys

Data handled

What you can report on

Operational

Quarantined devices

Authentication failures

Node health and capacity

Visibility

Connected device inventory

Unknown devices awaiting identification

Enforcement coverage

Governance

Exceptions

Policy change history

Administrator access review

Service