Requirements ยท Government
DoD RMF (DoDI 8510.01)
Risk Management Framework for DoD Systems. 11 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
DoD Instruction 8510.01, Risk Management Framework for DoD Systems, sets how the Department of Defense applies the NIST Risk Management Framework to its information systems. Issued under the authority of the DoD Chief Information Officer, it covers categorizing a system, selecting, implementing and assessing security controls, obtaining an authorization to operate from an authorizing official and monitoring the system continuously after that. It applies to DoD components and to systems operated on their behalf, including by contractors.
Source: DoD Instruction 8510.01 (DoD Directives Division). ATO and continuous ATO in the glossary. This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems 10 products
- DoDI 8510.01, Risk Management Framework for DoD Systems 1 product
For what it requires of your organization, read the rule itself or ask your counsel. ATO and continuous ATO in the glossary.
Products
The 11 products that support it
"Air-Gapped" Mission Planning Suite
In austere environments, connectivity is not guaranteed. This map-based planning tool runs completely offline on ruggedized laptops. It allows commanders to plan logistics, troop movements, and fires without reaching back to the cloud, syncing data only when secure connectivity is restored.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Battlefield Medical Record (Tactical EHR)
Combat medics operate in chaotic, high-stress environments. This lightweight, voice-enabled medical record system captures injury data at the "Point of Injury." It travels with the casualty and syncs with the broader military health system when a permitted connection is available, supporting continuity of care from the battlefield to the hospital; medics confirm every entry and clinical decisions remain with medical personnel.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Cross-Domain Solution (CDS) Transfer Agent
Moving files between classification levels (e.g., from Unclassified NIPRNet to Secret SIPRNet) carries the risk of malware transfer or data leakage. This "software guard" component sanitizes files in transit, stripping hidden metadata, macros and embedded content to reduce that risk. It cannot guarantee every hidden channel is removed; human review and cross-domain approval remain yours.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
DoD IL6 "Secret" Cloud Collaboration
Deploying commercial collaboration tools in a classified environment is a massive technical hurdle. We deploy Microsoft 365 in the "Secret" impact level (IL6) cloud, enabling classified email and Teams chat. Moraph provides the "cleared" administrators (US Citizens with clearances) required to manage this environment, helping address the DoD's talent gap; authorization stays with Microsoft for the platform and with your authorizing official for your use.
Lists:
- DoDI 8510.01, Risk Management Framework for DoD Systems
Mission Partner Environment (MPE) Builder
Coalition operations require ad-hoc networks. This tool automates the rapid spinning up of secure network enclaves where US forces can share data with allies for a specific mission duration, then tears them down, revoking access and sanitizing enclave storage. Disclosure decisions remain with your foreign disclosure officers.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Nuclear Command & Control (NC3) Assurance Check
For the most critical systems, error is not an option. This verification tool runs automated integrity checks on the software configurations of nuclear command and control systems and records link health, flagging every difference from the approved baseline for investigation. No check can prove a system is uncompromised.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Satellite/Geospatial Data Lake
Intelligence agencies collect petabytes of satellite imagery. We architect and manage massive, high-throughput storage arrays optimized for this data, enabling rapid ingestion and AI processing to detect changes in terrain or force buildup.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Software Bill of Materials (SBOM) Watchtower
The defense supply chain is vulnerable to software supply chain attacks. This platform checks software entering the DoD environment at the point of intake, decomposing binaries to find "nested dependencies" (like Log4j) and holding packages that break your supplier and provenance policies for a decision, helping protect the integrity of mission systems. Binary analysis cannot identify every component, and admission decisions remain with your designated approvers.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Tactical Edge Compute Node Manager
Modern warfare relies on computing power at the edge (in vehicles, ships, and aircraft). This platform manages Kubernetes clusters on these deployed hardware nodes, delivering signed, verified mission software updates and patches over low-bandwidth tactical links once the mission owner approves. Delivery depends on the links and contact windows available.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Wargaming & Simulation Sandbox
Testing strategies requires simulation. We manage the virtual environments for running large-scale war games, with compute that scales for each event and separation between exercises so data from one cannot be seen from another. Participation, data and authorization decisions remain your organization's.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Zero Trust "Black Cloud" Overlay
Defense assets must be hidden from the public internet. This overlay network utilizes a Software Defined Perimeter so critical applications make only outbound connections and expose no inbound ports or public IP addresses, keeping them hidden from attackers on the transport network. Hiding an application does not fix vulnerabilities in it; patching and access policy remain with your organization.
Lists:
- DoD Instruction 8510.01, Risk Management Framework for DoD Systems
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.