Personnel Security (PerSec) Clearance Tracker

Principal workflows

• Initiate: When someone needs eligibility or access, the security office opens a case, collects what is needed and tracks the request through the government system until a determination is recorded.
• Monitor: Each person's eligibility, investigation date, continuous vetting enrollment and access are tracked, with reminders before anything lapses.
• Report and review: Self-reported events and continuous vetting alerts received by the security office become cases, each reviewed by a specialist and passed to the adjudicating authority where your procedures require.
• Access: Briefings, nondisclosure agreements, read-ons and debriefings are recorded so the office knows who has access to what, and can prove it.

Who uses it

• Security offices in defense and intelligence agencies
• Facility security officers at cleared contractors
• Personnel security specialists who manage cases day to day
• Special security officers who manage program access
• Inspectors and auditors who review personnel security programs

Reporting

• Reinvestigations, enrollment, briefings and training coming due
• Open cases by type, age and specialist
• Pending initiations and where each stands
• Access lists and debriefings due
• Reported events by category and outcome
• Reconciliation against the system of record

Features

• Clearance lifecycle record: Each person's eligibility level, investigation type and date, continuous vetting enrollment and access, with the history of every change.
• Due-date tracking: Reinvestigation, enrollment, briefing and training dates tracked against your procedures, with reminders before they lapse.
• Self-reporting forms: Forms for foreign travel, foreign contacts and other reportable events, routed to the security office and kept with the person's record.
• Continuous vetting alert log: Alerts the security office receives are logged against the person, assigned to a specialist and tracked to an outcome.
• Case management: Assignment, due dates, notes, attachments and a supervisor review before a case is closed or referred.
• Briefings and agreements: Initial, annual and debriefing records with the signed nondisclosure agreements, for each facility and program.
• Access lists: Who holds access to each program or facility, with periodic review and certification by the responsible security officer.
• System of record reconciliation: Compare the tracker's records with an export from the government system of record and list the differences for a specialist to resolve.
• Visit requests: Incoming and outgoing visit requests with the clearance information to be passed or confirmed, and their dates.
• Need-to-know restrictions: Sensitive case details are visible only to the specialists assigned and the roles you choose, separate from the basic clearance record.
• Workload management: Queues by team and case type, assignment rules and views of open work by age.
• Inspection-ready audit trail: Who viewed, changed, reported or closed what and when, for every person and case, exportable for inspections.

Integrations

• Government system of record: Eligibility and investigation data is reconciled against exports from the government personnel security system your organization uses, such as DISS, loaded by your authorized staff. The tracker does not replace or write to that system.
• Human resources: Hires, departures, transfers and position changes from your HR system, so cases open and debriefings are scheduled when people move.
• Training system: Completion of security briefings and refresher training from your learning system.
• Physical access control: Access status shared with your badge system so access can be updated when eligibility or program access changes, including Moraph's SCIF Access Control & Management System.
• Insider threat program: Referrals to your insider threat hub, including Moraph's Insider Threat UBA, with only the information your procedures allow to be shared.
• Single sign-on: Staff sign in through your identity provider (SAML or OpenID Connect), including CAC or PIV where your provider supports it.
• Work API: Clearance status and program metrics available to your reporting tools through the Moraph Work API, with sensitive case details excluded unless you choose otherwise.

Deployment

• Moraph cloud, United States: Hosted and operated by Moraph in the United States region for unclassified data, with controls mapped to support your own authorization.
• Dedicated environment: A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.
• Your environment: Installed in an environment you operate where your authorizing official approves it, running under your authority.
• With a managed service: Optionally run alongside a Moraph managed service for administration and integration support, delivered by US citizens with active clearances.

Security and privacy

• Records kept in the United States: Hosted in the United States region only, for government and cleared contractor clients.
• Cleared support lane: Support tickets from federal and defense clients are handled only by US citizens with active security clearances.
• Need-to-know access: Single sign-on through your identity provider, with roles that separate the basic clearance record from sensitive case details.
• Encryption under controlled keys: Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.
• Complete audit trail: Every view, change, report and export is recorded with the person and time, and cannot be edited.
• Controls mapped for your authorization: Moraph is SOC 2 Type II and ISO/IEC 27001 audited, maps the tracker's controls to NIST SP 800-53 and 800-171, and supports your own authorization and Privacy Act obligations; it does not hold a DoD authorization of its own.

Limitations

• The tracker does not adjudicate. Eligibility determinations are made by the government adjudicating authority, and the tracker records them.
• It does not replace or write to the government personnel security system of record; reports required there are submitted by your staff, and the tracker records the reference.
• It does not run continuous vetting checks or obtain records about individuals itself. It logs and tracks the alerts and reports your security office receives through official channels.
• It does not conduct background investigations or collect investigation forms; applicants complete those in the government system.
• It is designed for unclassified personnel security records. Classified case information is not stored in the hosted service.
• Records are only as current as the information entered and reconciled; periodic reconciliation with the system of record is needed.
• Your organization remains responsible for its Privacy Act notices, system of records requirements and retention schedules.
• Moraph does not hold a DoD authorization for the tracker; your authorizing official decides whether and where it may be used.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/personnel-security-persec-clearance-tracker. Purchasing routes and company information: www.moraph.com/how-to-buy.