Financial Services · Managed platform (CyberArk)

Privileged Access Management

The administrator accounts behind your core banking systems, vaulted, rotated and watched

Book a demonstration Request a technical briefing Factsheet

Overview

What you are buying

Moraph resells, implements and runs CyberArk to control the privileged accounts that administer your core banking platform, databases, servers and network. CyberArk vaults and rotates the credentials, brokers and records administrator sessions, and requires approval where your policy says so. Moraph onboards the accounts, keeps the configuration aligned to your policy, watches the platform and its alerts, and gives your security team and auditors the evidence they ask for.

The problem it solves

The accounts that can change core banking configuration, read customer databases or rebuild servers are often the least controlled. Passwords are shared among administrators, kept in spreadsheets or scripts, and rarely changed. Vendors and contractors connect with standing access. When an examiner or auditor asks who used a domain administrator account on a given night and what they did, the answer depends on whoever remembers. Buying a privileged access platform fixes little on its own if nobody has time to find the accounts, onboard them and keep the policy current.

Shared administrator passwords that are rarely rotated and known to too many people
Service and application accounts with credentials hard-coded in scripts and configuration files
Vendor and contractor access that stays open after the work is done
No reliable record of what was done during an administrator session

Who uses it

CISOs and information security officers at banks, credit unions and other financial institutions
Infrastructure and core banking administrators who use privileged accounts every day
IT risk and compliance teams who answer access findings
Internal audit and examiners reviewing privileged access controls
Institutions that own a CyberArk licence but have not finished rolling it out

Requirements it supports

Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)FTC Safeguards Rule under the Gramm-Leach-Bliley Act (16 CFR Part 314)NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.7 on access privilegesFFIEC IT Examination Handbook, Information Security bookletSarbanes-Oxley Act Section 404 (internal control over financial reporting)PCI DSS v4.0 Requirements 7 and 8 (access control and authentication)

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

CyberArk provides the platform, Moraph implements and runs it for you, and your institution keeps the decisions about who may have privileged access.

Area	Moraph	CyberArk	Your organization
Licensing	Resells the CyberArk subscription or licence and manages renewals with you	Sets licence terms and product entitlements	Agrees the licence scope and accepts the vendor's terms
Platform availability	Monitors platform health and raises vendor support cases when something fails	Runs Privilege Cloud under its own service commitments, or supplies the software for self-hosted components	Provides the servers, network and connectivity for any components hosted in your environment
Configuration	Designs and maintains safes, platform policies, approval rules and connectors to your agreed baseline	Provides the configuration options and documentation	Approves the baseline and any change to it
Account onboarding	Discovers, onboards and verifies privileged accounts in approved waves	Provides discovery and onboarding tools	Names account owners, approves each wave and fixes system-side blockers
Identity and access	Configures single sign-on and role mapping; runs access review exports	Supports integration with identity providers	Owns the identity provider and decides who holds which role
Monitoring and alerts	Watches rotation status, platform health and security alerts, and triages them	Generates the platform's alerts and logs	Investigates and decides on alerts that may be security incidents
Incident response	Contains platform-side issues, gathers evidence and supports your response	Responds to incidents in its own service and software	Leads security incident response and any regulatory notification
Changes	Prepares, tests and applies change requests in agreed windows	Publishes release notes for platform changes	Approves changes and change windows
Patches and updates	Plans and applies updates to self-hosted components; tracks vendor updates to the cloud service	Releases updates and security fixes	Approves maintenance windows and patches its own target systems
Policy decisions	Recommends rotation, approval and session-recording settings	None	Decides the privileged access policy and accepts any exceptions

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of CyberArk itself, which belongs to its vendor.

Step 1

Onboarding tracker

Onboarding runs in waves your security team approves, with each system's progress and blockers in view.

Wave	Systems	Accounts found	Onboarded	Rotation verified	Status
Wave 1	Domain administrators	24	24	24	Complete
Wave 2	Core banking admin accounts	38	35	33	2 blocked
Wave 3	Database servers	61	40	40	In progress
Wave 4	Network devices	52	0	0	Awaiting approval

Step 2
Configuration baseline review
Moraph compares the running configuration with the approved baseline and lists what needs a decision.
Privileged Access Management · Baseline reviewSample data
Example Community Bank (fictional) · Quarterly baseline review
Baseline version
v3, approved by information security
Platform policies checked
14
Safes checked
46
Matches baseline
43 safes, 13 policies
Differences
4
Differences found
- Safe ADM-NET-02 has a member not on the approved list
- Rotation interval on the Unix root policy longer than baseline
- Dual control not enabled on safe CORE-DB-PRD
- Session recording off for one jump-host connection
Raise change requestsAccept as exception
Moraph compares the running configuration with the approved baseline and lists what needs a decision.
Step 3
Change request
Every configuration change is proposed, approved by your team, applied by Moraph and verified.
Privileged Access Management · Change CR-1142Sample data
CR-1142 · Enable dual control on safe CORE-DB-PRD
1. Change raised from baseline reviewMoraph service engineer
2. Approvers for the safe confirmedSafe owner
3. Change approved for the agreed windowInformation security officer
4. Dual control enabled and test request approvedMoraph service engineer
5. Change closed and baseline updatedMoraph service engineer
Every configuration change is proposed, approved by your team, applied by Moraph and verified.

Step 4

Alert triage

Platform alerts are triaged by Moraph and handed to your security team with what they need to decide.

Alert	Type	Account	Severity	Moraph triage	Status
PA-5512	Credential used outside the vault	svc-backup-07	High	Escalated to client	With security operations
PA-5509	Password verification failed	core-admin-03	Medium	Target account locked	Fix scheduled
PA-5503	Session outside usual hours	dba-prod-01	Medium	Matched approved change	Closed
PA-5498	Connector unreachable	Connector 2	Low	Server restarted by client	Closed

Step 5
Safe access review
Safe owners certify who belongs in each safe, and removals are tracked to completion.
Privileged Access Management · Access reviewSample data
Safe CORE-DB-PRD · Quarterly certification
Safe owner
Database platform lead (fictional)
Members
11
Certified
9
Marked for removal
2
Due
End of review period
Removals requested
- User 4471: moved to another team
- Vendor account V-208: support contract ended
Confirm removalsExport certification
Safe owners certify who belongs in each safe, and removals are tracked to completion.
Step 6
Monthly service review
Each month Moraph reviews coverage, exceptions, alerts and changes with your team.
Privileged Access Management · Service reviewSample data
Monthly service review · Example Community Bank (fictional)
Accounts under management
312
Rotation exceptions open
5
Alerts triaged
27
Escalated to client
3
Changes applied
8
For decision
- Approve Wave 4 (network devices)
- Accept or remediate two legacy systems without a rotation connector
- Review vendor update notes for the cloud service
Download review packRecord decisions
Each month Moraph reviews coverage, exceptions, alerts and changes with your team.

Workflows

The principal workflows

Discover and onboard
Moraph finds the privileged accounts across your core banking platform, servers, databases, network devices and cloud consoles, agrees an owner for each, and brings them into CyberArk in waves you approve.
- CyberArk discovery scans and your own inventories identify privileged accounts
- Each account is classified by system, type and risk, and given an owner
- Your security team approves the onboarding wave and the safe it lands in
- Moraph onboards the accounts and confirms CyberArk can verify and change each password
- Hard-coded credentials found along the way are logged for remediation
Request and use access
Administrators request a credential or a session through CyberArk. Where your policy requires it, a safe owner approves the request before access is granted, and the session is brokered and recorded.
- Administrator signs in through your identity provider with multi-factor authentication
- Requests access to an account, with a reason or ticket number
- Safe owner approves or rejects where dual control applies
- CyberArk connects the session without revealing the password, and records it
- Password is changed after use where one-time use is configured
Rotate and verify
CyberArk changes and verifies passwords on the schedule your policy sets. Moraph watches for rotations that fail and works them with your system owners until the account is back under management.
- Rotation and verification run on the schedule in each platform policy
- Failed changes and verifications raise an alert to Moraph
- Moraph diagnoses the cause, such as a changed firewall rule or a locked account
- Fix agreed with the system owner and applied
- Account returned to managed status and the event recorded
Monitor and evidence
Moraph watches platform health and CyberArk's security alerts, triages them with your security operations team, and produces the access reviews and reports your auditors and examiners expect.
- Platform health, rotation status and security alerts monitored by Moraph
- Alerts triaged and passed to your security team with context
- Recorded sessions available to authorized reviewers on request
- Quarterly safe membership and account reviews prepared for certification
- Monthly service review covers coverage, exceptions and open changes

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Privileged user

System administrator, core banking administrator, database administrator, network engineer

Uses privileged accounts to administer systems, through CyberArk rather than with standing passwords.

Sees

The accounts in safes they are a member of
Their own requests and approvals
Their own session history

Does

Requests access to an account with a reason or ticket number
Connects to systems through brokered sessions
Retrieves a password where the policy allows it
Reports accounts that are missing or not working

Cannot

Approve their own access requests
Change safe membership or platform policies
Turn off session recording

Approvals: Access to accounts under dual control needs a safe owner's approval each time.
Notified about: Requests approved, rejected or about to expire.

Safe owner

System owner, platform lead, infrastructure manager

Decides who may use the accounts in their safe and approves access where dual control applies.

Sees

Accounts in their safes and their rotation status
Pending and past access requests for their safes
Safe membership and recent session activity

Does

Approves or rejects access requests
Certifies safe membership during access reviews
Requests membership changes through a change request
Names the owner of each onboarded account

Cannot

Approve their own request
Change platform policies or rotation schedules

Approvals: Membership changes they request are applied by Moraph after information security approval where your policy requires it.
Notified about: Access requests waiting for approval, access reviews due and rotation failures on their accounts.

Information security officer

CISO, information security officer, IT risk manager

Owns the privileged access policy and the decisions that shape the platform's configuration.

Sees

All reports, alerts and service reviews
The configuration baseline and every change to it
Exceptions and their compensating controls
Session records, when reviewing an alert or incident

Does

Approves the configuration baseline and change requests
Approves onboarding waves
Accepts or rejects exceptions
Decides on alerts escalated as possible incidents
Grants auditors and examiners read-only access

Cannot

Retrieve credentials from safes they are not a member of
Edit or delete audit records

Approvals: Approves changes, waves, exceptions and auditor access; their own access requests follow the same dual control as anyone else's.
Notified about: Escalated alerts, changes waiting for approval, baseline differences and the monthly service review.

Security operations analyst

SOC analyst, security engineer, incident responder

Investigates privileged activity that Moraph's triage has escalated, alongside other security signals.

Sees

Escalated alerts with Moraph's triage notes
CyberArk audit events in your SIEM
Session recordings when investigating an alert

Does

Investigates escalated alerts
Requests containment actions such as rotating a credential or suspending a user
Records the outcome of each investigation

Cannot

Change platform configuration
Retrieve credentials from safes for their own use without the normal request

Approvals: Containment actions follow your incident procedure; Moraph applies urgent platform-side actions on request from authorized contacts.
Notified about: Alerts escalated by Moraph.

Moraph service engineer

Moraph privileged access engineer, Moraph service manager

Implements and operates the platform for you under approved changes.

Sees

Platform health, rotation status and alerts
Platform policies, safes and connector configuration
Moraph service portal records for your service

Does

Onboards accounts and verifies rotation
Prepares and applies approved changes
Triages alerts and escalates those that need your decision
Works rotation exceptions with system owners
Manages vendor support cases
Runs the monthly service review

Cannot

Retrieve credentials from your safes without explicit, time-bound authorization
Apply changes without approval, except agreed emergency actions
Accept exceptions on your behalf

Approvals: Every change needs your approval; emergency actions are limited to those agreed in advance and reported afterwards.
Notified about: Platform health alerts, rotation failures, security alerts and vendor notices.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Reviews privileged access controls and evidence without being able to change anything.

Sees

Policies, the configuration baseline and change history
Access reviews and their results
Reports on accounts, rotation, requests and sessions within scope

Does

Reads and exports reports within their scope, with each export logged
Requests session recordings through the information security officer

Cannot

Retrieve credentials or start sessions
Change anything
Keep access after it expires

Approvals: Access is granted by the information security officer with a scope and an end date.
Notified about: Nothing by default.

Platform owner

IT security manager, identity and access manager

Your day-to-day contact for the service, who coordinates onboarding and changes inside your institution.

Sees

The service portal, onboarding tracker and change requests
Reports and service reviews
Vendor notices passed on by Moraph

Does

Raises change and onboarding requests
Coordinates system owners on blocked accounts
Schedules access reviews
Attends the monthly service review

Cannot

Approve changes that need information security sign-off
Retrieve credentials outside their own safe memberships

Approvals: Their requests are approved by the information security officer where the change affects policy.
Notified about: Change status, onboarding blockers, vendor notices and service review packs.

Permissions at a glance

Action	Priv. user	Safe owner	Security lead	SOC analyst	Moraph ops	Auditor	Platform owner
Request access to an account	Own work only	Own work only	Own work only	Own work only	No access	No access	Own work only
Approve access under dual control	No access	Approves	No access	No access	No access	No access	No access
Use brokered sessions	Own work only	Own work only	Own work only	Own work only	No access	No access	Own work only
View session recordings	Own work only	View only	View only	View only	No access	No access	No access
Onboard accounts	No access	No access	Approves	No access	Full	No access	No access
Change safes and platform policies	No access	No access	Approves	No access	Full	No access	No access
Accept a rotation exception	No access	No access	Approves	No access	No access	No access	No access
Triage platform alerts	No access	No access	View only	View only	Full	No access	View only
Certify safe membership	No access	Full	View only	No access	No access	View only	View only
View reports and service reviews	No access	Own work only	View only	View only	View only	View only	View only
View audit trail	No access	No access	View only	View only	View only	View only	View only
Grant auditor access	No access	No access	Approves	No access	No access	No access	No access

Full
Own work only
Approves
View only
No access

How access is controlled

Nobody approves their own access request, and administering the vault is kept separate from membership of the safes that hold your credentials, including for Moraph engineers.
Roles are configured with you during implementation and can follow your identity provider's groups, so joiners, movers and leavers are handled by your existing process.
Every permission change, credential retrieval and session is recorded by CyberArk, and every change request and approval is recorded in Moraph's service portal.
Auditors and examiners receive temporary read-only access with a defined scope and an end date, granted by your information security officer.

Features

What it does

Credential vaulting

CyberArk stores privileged passwords and keys in its encrypted vault, organized into safes with their own members and permissions.

Automatic rotation

CyberArk changes and verifies passwords on the schedule set in each platform policy, so no administrator needs to know a standing password.

Session isolation and recording

Administrator sessions to servers, databases and consoles are brokered through CyberArk and recorded, so the password never reaches the administrator's workstation.

Dual control

For the accounts you choose, access requires a reason and an approval from a safe owner before CyberArk releases it.

Account discovery

Moraph runs CyberArk discovery across your environment and reconciles the results with your inventories so unmanaged privileged accounts are found and onboarded.

Application credentials

Where your applications and scripts use embedded passwords, CyberArk's credential provider lets them retrieve the credential at run time instead, onboarded by Moraph with your developers.

Vendor and third-party access

Contractors and vendors reach the systems they support through CyberArk with time-limited, approved and recorded access, rather than standing VPN accounts.

Policy baseline

Moraph documents the platform policies, safe design and approval rules that implement your access policy, and reviews the running configuration against that baseline.

Rotation exception handling

Accounts whose password change or verification fails are worked by Moraph with the system owner until they are back under management, and tracked until then.

Alert triage

CyberArk's security alerts, such as access outside the vault or unusual session activity, are triaged by Moraph and passed to your security team with the context needed to decide.

Access reviews

Safe membership, approver lists and account owners exported for periodic certification, with the results and removals recorded.

Change management

Every change to safes, policies and onboarding goes through a change request your team approves, tested in a non-production environment where one exists.

Integrations

How it connects to your systems

Connects to	How	What flows
Identity provider	Administrators and approvers sign in to CyberArk through your identity provider with multi-factor authentication, and roles follow your directory groups.	In: user identity, multi-factor result and group membership.
Core banking and infrastructure	CyberArk connects to the core banking platform's administrative accounts, Windows and Linux servers, databases, network devices and hypervisors to rotate and broker access, where the target system supports it.	Out: password changes and brokered sessions. In: verification results.
Cloud consoles	Administrative accounts and access keys for your cloud providers can be vaulted and rotated where the provider supports it.	Out: credential changes. In: verification results.
SIEM	CyberArk audit events and security alerts forwarded to your security information and event management system.	Out: audit events, alerts and session metadata in syslog or the format your SIEM accepts.
IT service management	Access requests can require a valid ticket number from your service management tool, and Moraph's change requests reference your change records.	In: ticket validation. Out: change and incident references.
Moraph service portal	Change requests, alerts, onboarding progress and monthly service reviews are tracked in Moraph's service portal, available to your team through single sign-on.	Out: service records, change history and review reports.
Endpoint Detection & Response	Where you also use Moraph's managed endpoint service, privileged-session context can be shared with endpoint investigations.	Out: session metadata for investigations, by agreement.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your staff sign in to CyberArk and to Moraph's service portal through your identity provider, so your password and multi-factor policies apply.

Moraph staff access

Moraph engineers reach your CyberArk environment through role-based access you approve, with their own sessions recorded, and cannot retrieve your privileged passwords without explicit, time-bound authorization.

Separation of duties

Safe design keeps vault administration separate from access to the credentials in the safes, so administering the platform does not mean seeing the passwords it holds.

Complete audit trail

CyberArk logs every credential retrieval, session and configuration change, and Moraph's service portal logs every change request, approval and alert decision.

Encryption

CyberArk encrypts the vault and its contents; Moraph's own service records are encrypted with keys staff cannot use without explicit, time-bound authorization.

Audited operations

Moraph is SOC 2 Type II and ISO/IEC 27001 audited company-wide, and its service records are hosted in the United States, United Kingdom or Australia region you choose.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Coverage

Accounts under management

For information security officer and platform owner

Privileged accounts discovered, onboarded and verified, by system and owner, with those not yet under management.

Break down by: System, Account type, Owner, Onboarding wave, Status
Delivered as: Monthly service review pack; CSV export
Used for: Showing how much of the privileged estate is controlled and what remains.

Rotation exceptions

For platform owner and system owners

Accounts whose password change or verification failed, how long each has been open, the cause and the planned fix.

Break down by: System, Cause, Owner, Age
Delivered as: Service portal view; weekly email
Used for: Getting accounts back under management and evidencing follow-up.

Approved exceptions

For information security officer and auditors

Accounts that cannot be rotated or brokered, with the compensating control and the person who accepted the exception.

Break down by: System, Reason, Approver, Review date
Delivered as: Service portal view; PDF export
Used for: Keeping exceptions visible and reviewed rather than forgotten.

Activity

Access requests and approvals

For safe owners and information security officer

Requests for privileged access, who approved or rejected each, and the reasons given.

Break down by: Safe, Requester, Approver, Outcome, Period
Delivered as: CyberArk reports; CSV export
Used for: Checking that dual control is working as the policy intends.

Privileged session activity

For information security officer and security operations

Sessions on the most sensitive accounts, with user, target, time and duration, and links to the recordings for authorized reviewers.

Break down by: Account, User, Target system, Time of day
Delivered as: CyberArk reports; SIEM
Used for: Reviewing sensitive activity and answering who did what on a system.

Alert triage log

For security operations and information security officer

Every platform alert, Moraph's triage notes, whether it was escalated, and the final outcome.

Break down by: Alert type, Severity, Outcome, Period
Delivered as: Service portal view; monthly service review pack
Used for: Showing that alerts were looked at and decided.

Governance

Safe membership certification

For safe owners, information security officer and auditors

Each review cycle's certifications by safe, removals requested and confirmed, and reviews still outstanding.

Break down by: Safe, Owner, Review cycle, Outcome
Delivered as: Service portal view; PDF and CSV export
Used for: Evidencing periodic review of privileged access for auditors and examiners.

Configuration baseline differences

For information security officer and platform owner

Where the running configuration differs from the approved baseline, and the change or exception that resolved each difference.

Break down by: Area, Safe or policy, Resolution, Review date
Delivered as: Quarterly baseline review; PDF export
Used for: Keeping the platform aligned to the policy you approved.

Change history

For information security officer, auditors

Every change request with who raised, approved and applied it, when, and how it was verified.

Break down by: Change type, Approver, Period, Emergency or planned
Delivered as: Service portal view; CSV export
Used for: Answering change management questions from audit.

Monthly service review

For platform owner and information security officer

Coverage, exceptions, alerts, changes, vendor notices and decisions needed, for the month.

Break down by: Month, Area
Delivered as: PDF pack and review meeting
Used for: Running the service with your team and recording decisions.

Exports, access and evidence

Platform reports come from CyberArk itself; service reports such as exceptions, alert triage, changes and reviews come from Moraph's service portal.
Reports can be exported to CSV, and governance reports to PDF for audit and committee packs.
CyberArk audit events can be forwarded to your SIEM so privileged activity is reported alongside your other security data.
Reports respect each viewer's role: a safe owner sees their own safes, while the information security officer sees the whole service.
Running and exporting a report is itself recorded, and auditors can be given read-only access to reports within a defined scope.

Deployment

Where and how it runs

CyberArk Privilege Cloud

The vault runs as CyberArk's software-as-a-service, with connectors in your environment, configured and operated by Moraph.

Self-hosted

CyberArk components run in your data center or cloud account, installed and maintained by Moraph under your change process.

Existing CyberArk estate

If you already own CyberArk, Moraph can take over operations of the existing deployment after a baseline review.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Discovery and design

We review your access policy, systems and existing CyberArk components, if any, and agree the safe design, platform policies and approval rules. We need your policy documents and contacts for each major system.

Platform setup

CyberArk is provisioned as Privilege Cloud or installed in your environment, connected to your identity provider and SIEM, and configured to the agreed baseline.

Pilot

A small set of accounts and administrators goes first, so rotation, session brokering and approvals are proven before wider rollout.

Onboarding waves

Accounts are onboarded in waves you approve, starting with the highest-risk systems such as core banking administration and domain administrator accounts.

Training

Administrators learn to request and use access through CyberArk, and safe owners learn to approve and certify; your security team learns how alerts and reports reach them.

Transition to managed service

Once onboarding is complete, the service moves into steady-state operations with monitoring, change management and monthly service reviews.

Limitations

What it does not do

Worth knowing before you evaluate it.

Moraph is not CyberArk. Moraph resells, implements and operates the platform; CyberArk develops it and is responsible for its software and cloud service.
CyberArk's own service commitments, product roadmap and any outages of its cloud service apply. Moraph does not change them.
Licences are subject to CyberArk's terms, which you accept as part of the purchase.
Some systems cannot have passwords rotated automatically, for example older platforms without a supported connector. These are documented as exceptions with a compensating control your institution approves.
Removing hard-coded credentials from applications needs your developers to change the application; Moraph identifies them and supports the change.
Moraph does not decide who should hold privileged access. Your institution sets the policy and approves access and exceptions.
Moraph triages alerts from the platform but does not replace your security operations center or incident response team.
Session recordings are kept for the period your policy sets and the platform's storage allows; longer retention needs additional storage.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

List the privileged accounts on your core banking platform and ask how each would be onboarded
Watch an administrator request, receive approval for and use an account without seeing its password
Review a sample configuration baseline and how differences are reported
Walk through how a failed rotation is detected, worked and closed
Confirm what Moraph engineers can and cannot access in your vault
Read the responsibilities table with your vendor management team

Questions

Frequently asked questions

We already own CyberArk. Can Moraph run it?

Yes. Moraph starts with a baseline review of your existing deployment, agrees what needs fixing, and then takes over operations under the same change and reporting model.

Can Moraph staff see our privileged passwords?

Not by default. Moraph engineers administer the platform without membership of the safes that hold your credentials. Any exception needs your explicit, time-bound authorization and is recorded.

Who do we call when CyberArk is down?

Moraph. We diagnose the issue, fix what is in our scope, and open and manage the case with CyberArk when the cause is in their software or cloud service.

How is it priced?

The CyberArk licence is resold under CyberArk's terms, with Moraph's implementation and managed service priced separately, usually by the number of accounts and systems in scope. See Working with Moraph for what drives a quotation.

Does this satisfy our examiners on privileged access?

It gives you the controls and the evidence: vaulted and rotated credentials, approvals, session records and access reviews. Whether your program meets expectations remains your institution's judgment and the examiner's.

What happens to our configuration if we leave?

The platform and its configuration are yours under your CyberArk licence. Moraph hands over the baseline documentation, runbooks and open items as set out in the contract.

Next steps

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Privileged Access Management guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Privileged Access Management support guide.

Privileged Access Management

What you are buying

The problem it solves

Who uses it

Requirements it supports

Who is responsible for what

A short walkthrough

Onboarding tracker

Configuration baseline review

Change request

Alert triage

Safe access review

Monthly service review

The principal workflows

Discover and onboard

Request and use access

Rotate and verify

Monitor and evidence

Who does what in the product

Privileged user

Sees

Does

Cannot

Safe owner

Sees

Does

Cannot

Information security officer

Sees

Does

Cannot

Security operations analyst

Sees

Does

Cannot

Moraph service engineer

Sees

Does

Cannot

Auditor or examiner (read-only)

Sees

Does

Cannot

Platform owner

Sees

Does

Cannot

Permissions at a glance

How access is controlled

What it does

Credential vaulting

Automatic rotation

Session isolation and recording

Dual control

Account discovery

Application credentials

Vendor and third-party access

Policy baseline

Rotation exception handling

Alert triage

Access reviews

Change management

How it connects to your systems

How your data is protected

Single sign-on

Moraph staff access

Separation of duties

Complete audit trail

Encryption

Audited operations

What you can report on

Coverage

Accounts under management

Rotation exceptions

Approved exceptions

Activity

Access requests and approvals

Privileged session activity

Alert triage log

Governance