Defense & intelligence · Moraph software

SCIF Access Control & Management System

Access logs, visit requests and alarm events for your SCIF, in one auditable record

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

The SCIF Access Control & Management System replaces paper entry logs and spreadsheets with a digital record of who entered a Sensitive Compartmented Information Facility, when, why and under whose escort. It tracks visit access requests from receipt to approval, shows intrusion detection system events as they are received from your alarm system, and records opening and closing checks. Every entry, decision and event is kept in an append-only audit trail that supports the facility management requirements of ICD 705.

The problem it solves

Many SCIFs still run on paper: sign-in sheets at the door, binders of visit requests, handwritten opening and closing checklists, and alarm records kept in a separate system. Special Security Officers spend hours reconciling them before an inspection, and answering a simple question such as who was inside on a given afternoon means reading several logs side by side. Paper can be lost, altered or illegible, and it does not tell anyone that a visitor's approved access has expired.

  • Entry logs, visit requests and alarm records are kept in separate places
  • Checking that a visitor's access is approved and current is done by hand at the door
  • Opening, closing and end-of-day checks are recorded on paper forms
  • Inspection preparation means reconciling binders and spreadsheets

Who uses it

  • Special Security Officers and SCIF managers in defense and intelligence organizations
  • Facility security officers at cleared contractors operating accredited SCIFs
  • Entry control and security staff who staff the door
  • Program security leads who sponsor visitors
  • Inspectors and security officials who review facility records

Requirements it supports

ICD 705 (Sensitive Compartmented Information Facilities)ICS 705-1 (Physical and Technical Security Standards for SCIFs)ICS 705-2 (Standards for the Accreditation and Reciprocal Use of SCIFs)Technical Specifications for Construction and Management of Sensitive Compartmented Information FacilitiesICD 704 (Personnel Security Standards for SCI eligibility)32 CFR Part 117 (NISPOM), for cleared contractors

The product supports these requirements; meeting them remains your organization’s responsibility.

See how it works

A short walkthrough

Illustrative screens with fictional sample data. They show the workflow, not any client’s data or configuration, and the layout of the product itself differs. A live demonstration uses the product with sample data.

  1. Step 1

    Today's access log

    Entry controllers work from one live log of who is inside, why, and with which escort.

    PersonTypeEnteredPurposeEscortStatus
    Person 4471Roster07:12Assigned workNot requiredInside
    Visitor 2209Approved visit09:30Program reviewPerson 4471Inside
    Visitor 2214Approved visit10:05Equipment maintenanceNone recordedInside
    Person 3980Roster06:55Assigned workNot requiredExited 11:40
    Visitor 2231Not on list10:20MeetingNoneEntry refused
    Entry controllers work from one live log of who is inside, why, and with which escort.

  2. Step 2

    A visit access request

    Each visit request shows the visitor's certified accesses, the sponsor and purpose, and waits for the SSO's decision.

    Visitor 2209 · Example Facility A (fictional)

    Sending office
    Example Agency security office
    Accesses certified
    As recorded by sending office
    Visit dates
    Three days, fictional dates
    Sponsor
    Person 4471
    Purpose
    Program review
    Escort required
    No, within approved areas

    Checks

    • Request received through security office channel
    • Sponsor confirmed purpose
    • Visit dates within certification validity
    Each visit request shows the visitor's certified accesses, the sponsor and purpose, and waits for the SSO's decision.

  3. Step 3

    An alarm event

    IDS events received from the alarm system are recorded with the response, alongside the access log for the same time.

    EV-5530 · Zone 3 door alarm

    1. Door alarm received from IDS, zone 3IDS
    2. Event acknowledgedAlarm responder
    3. Access log checked: no one signed in to zone 3Alarm responder
    4. Area inspected, door found not fully latchedAlarm responder
    5. Door secured, alarm reset by alarm systemAlarm responder
    6. Response reviewed and closedSSO
    IDS events received from the alarm system are recorded with the response, alongside the access log for the same time.

  4. Step 4

    End-of-day check

    The closing checklist is completed digitally, and a second custodian confirms it where your procedures require.

    End-of-day check · Example Facility A

    Completed by
    Custodian 12
    Confirmed by
    Custodian 07
    People still signed in
    0
    Containers checked
    6 of 6
    IDS state
    Secure, from alarm system

    Checklist

    • All containers locked and checked
    • Windows and doors secured
    • Workstations logged off
    • Personal electronic device storage checked
    The closing checklist is completed digitally, and a second custodian confirms it where your procedures require.

  5. Step 5

    Access exceptions

    Exceptions are gathered for the SSO to follow up, rather than discovered at inspection.

    ExceptionFacilityPersonWhenStatus
    Escorted visitor without escort recordedFacility AVisitor 2214TodayOpen
    Badge event with no log entryFacility BPerson 5102YesterdayExplained, entry added
    Late exit after closing beganFacility APerson 33012 days agoReviewed
    Entry refused, not on listFacility AVisitor 2231TodaySponsor contacted
    Exceptions are gathered for the SSO to follow up, rather than discovered at inspection.

  6. Step 6

    Inspection readiness

    For a chosen period the SSO sees log reviews, checks and exceptions together, and exports them for the inspector.

    Example Facility A · Fictional review period

    Entries recorded
    3,912
    Visits approved
    148
    IDS events
    11, all closed
    Closing checks
    All completed and confirmed
    Open exceptions
    1

    Included in the pack

    • Access log extract
    • Roster verification history
    • IDS events and responses
    • Period sign-offs
    For a chosen period the SSO sees log reviews, checks and exceptions together, and exports them for the inspector.

Workflows

The principal workflows

  1. Request

    Visit access requests are recorded when the security office receives them, checked against the facility's rules, and approved or rejected by the SSO, so the door knows in advance who is expected.

    • Security office records the incoming visit request and its sponsor
    • Visitor's accesses and dates are entered as certified by the sending security office
    • Sponsor confirms the purpose and escort arrangements
    • SSO approves or rejects the request with a reason
    • Approved visits appear on the expected-visitor list for their dates

  2. Enter

    At the entry point, staff check each person against the access roster or the approved visit, record entry and exit, and assign an escort where required.

    • Entry controller looks up the person by badge or name
    • System shows whether they are on the roster or have an approved visit for today
    • Prohibited-items acknowledgment recorded for the visit
    • Escort assigned and recorded for uncleared or escorted visitors
    • Exit recorded, and anyone still signed in is shown at closing

  3. Monitor

    Events from your intrusion detection system are received and shown alongside the access log, so security staff can see alarm, access and secure states in one place and record the response.

    • IDS events arrive from the alarm system's monitoring interface
    • Alarm and tamper events are shown with the zone and time
    • Responder records the response and the outcome
    • Access and secure/open state compared with the event for review
    • Unresolved events are escalated to the SSO

  4. Close and review

    Opening and closing checks are recorded digitally, and the SSO reviews logs, events and exceptions on a schedule and before inspections.

    • Custodian completes the opening or end-of-day checklist
    • Second person confirms the closing check where procedures require it
    • Exceptions such as late exits or unresolved alarms flagged for review
    • SSO reviews and signs off the period
    • Records exported for inspection on request

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Special Security Officer

SSO, contractor SSO, SCIF manager, facility security officer

Is responsible for the facility's security records: approves visits and roster changes, reviews exceptions and alarm responses, and prepares for inspections.

Sees

  • All access logs, visit requests and roster entries for their facilities
  • IDS events and response records
  • Opening and closing checks and exceptions
  • The facility document library and audit trail

Does

  • Approves or rejects visit requests with a reason
  • Approves additions and removals on the access roster
  • Reviews and signs off exceptions and alarm responses
  • Signs off periodic log reviews
  • Exports records for inspections
  • Maintains facility documents and procedures

Cannot

  • Edit or delete a recorded entry, event or check
  • Approve a visit they are sponsoring themselves; a second approver is required
  • Change audit trail settings
Approvals
Approves visits, roster changes and period sign-offs; visits they sponsor need a second designated approver.
Notified about
Visit requests waiting for approval, unresolved alarm events, people still signed in at closing, and roster verifications coming due.

Entry controller

Entry control officer, security specialist, security guard

Controls the entry point: checks each person against the roster or an approved visit and records entry, exit and escort.

Sees

  • Today's expected visitors and the access roster for their facility
  • People currently signed in and their escorts
  • Recent IDS events for the facility

Does

  • Records entry and exit
  • Assigns and records escorts
  • Records prohibited-items acknowledgments
  • Refuses entry and records the reason when access is not approved
  • Flags issues to the SSO

Cannot

  • Approve visits or change the roster
  • Admit a visitor whose approved visit is not current
  • Edit past entries
Approvals
Nothing they do needs approval; refusals and exceptions are reviewed by the SSO.
Notified about
Expected visitors arriving, escorted visitors without an escort recorded, and people still signed in at closing.

Visit sponsor

Program security officer, government lead, cleared employee hosting a visit

Requests and confirms visits for their program, states the purpose and arranges escorts.

Sees

  • Visit requests they sponsor and their status
  • Entry and exit times for their visitors
  • Escort assignments for their visitors

Does

  • Starts a visit request or confirms one received by the security office
  • States the purpose and dates of the visit
  • Names escorts
  • Cancels visits that are no longer needed

Cannot

  • Approve their own visit requests
  • See other programs' visitors unless granted
  • Change the access roster
Approvals
Every visit they sponsor is approved by the SSO.
Notified about
Visit approved or rejected, and their visitor's arrival and departure.

Alarm responder

Security officer, alarm response team member

Responds to IDS events and records what they found and did.

Sees

  • IDS events for their facilities with zone and time
  • Access log entries around the time of an event
  • Earlier responses to the same zone

Does

  • Acknowledges events assigned to them
  • Records response time, findings and outcome
  • Escalates events that need the SSO
  • Adds notes and photographs where procedures allow

Cannot

  • Close an event the SSO has marked for review
  • Change the IDS itself or its zones
  • Edit a recorded response
Approvals
Responses to events the procedures classify as significant are reviewed by the SSO.
Notified about
New alarm and tamper events for their facilities, and events left unacknowledged.

Facility custodian

Facility custodian, alternate custodian, last-person-out

Opens and secures the facility and completes the checks that go with it.

Sees

  • Checklists for their facility and the history of recent checks
  • People still signed in at closing
  • Current secure or open state reported by the IDS

Does

  • Completes opening and end-of-day checklists
  • Records container checks
  • Confirms another custodian's closing check where required
  • Records exceptions found during checks

Cannot

  • Confirm their own closing check where a second person is required
  • Edit a completed check
  • Change checklists
Approvals
Exceptions they record are reviewed by the SSO.
Notified about
Checks due and people still signed in when closing begins.

Inspector or auditor (read-only)

Accrediting official's inspector, security inspector, internal auditor

Reviews facility records for inspections and audits without being able to change them.

Sees

  • Access logs, visit requests and roster history for the period granted
  • IDS events, responses and checks
  • Facility documents and the audit trail

Does

  • Searches and reads records within their scope
  • Exports records, with each export logged
  • Records inspection notes where enabled

Cannot

  • Change, approve or delete anything
  • See facilities or periods outside their scope
  • Keep access after it expires
Approvals
Access is approved by the SSO with a scope and an end date.
Notified about
Nothing by default.

Administrator

Security systems administrator, application administrator

Manages users, facilities, checklists and integrations, without access to approve visits or change records.

Sees

  • Users, roles and facility assignments
  • Checklist templates and integration status
  • The record of configuration and permission changes

Does

  • Adds and removes users or maps them from identity provider groups
  • Sets up facilities, zones and checklists
  • Monitors integration health with the IDS and badge systems
  • Runs access review reports

Cannot

  • Approve visits or roster changes
  • Edit access logs, events or checks
  • Grant themselves the SSO role
Approvals
Role changes and checklist changes are approved by the SSO.
Notified about
Integration failures and access reviews coming due.

Permissions at a glance

ActionSSOEntry ctrlSponsorResponderCustodianInspectorAdmin
Record entry and exitFullFullNo accessNo accessNo accessNo accessNo access
Create or confirm visit requestsFullNo accessOwn work onlyNo accessNo accessNo accessNo access
Approve visit requestsApprovesNo accessNo accessNo accessNo accessNo accessNo access
Change the access rosterApprovesNo accessNo accessNo accessNo accessNo accessNo access
Assign escortsFullFullOwn work onlyNo accessNo accessNo accessNo access
Record alarm responsesFullView onlyNo accessOwn work onlyNo accessView onlyNo access
Complete opening and closing checksFullNo accessNo accessNo accessOwn work onlyView onlyNo access
Sign off log reviewsApprovesNo accessNo accessNo accessNo accessView onlyNo access
Export recordsFullNo accessNo accessNo accessNo accessFullNo access
Configure facilities and checklistsApprovesNo accessNo accessNo accessNo accessNo accessFull
View audit trailView onlyNo accessNo accessNo accessNo accessView onlyView only
Manage users and rolesApprovesNo accessNo accessNo accessNo accessNo accessFull
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Two-person rules are built in: nobody approves a visit they sponsor, and closing checks that require a second person cannot be confirmed by the person who completed them.
  • Roles are configured with you during implementation and limited by facility, so staff see only the SCIFs they support.
  • Records are append-only. Corrections are added as new entries that reference the original, and every view, change and export is logged.
  • Staff sign in through your identity provider, including CAC or PIV where you use them. Inspectors get temporary read-only access with a defined scope and end date.

Features

What it does

Digital access log

Every entry and exit recorded with person, time, purpose and escort, replacing paper sign-in sheets.

Visit access requests

Incoming visit requests tracked from receipt through sponsor confirmation and SSO approval, with validity dates.

Access roster

The list of people authorized for unescorted access, maintained by the security office with the date each entry was last verified.

Escort tracking

Escort assignments recorded for each escorted visitor, with handovers between escorts logged.

IDS event display

Alarm, tamper and access-mode events received from your intrusion detection system and shown with the zone and time.

Alarm response records

Who responded to each alarm, what they found and how it was resolved, kept with the event.

Opening and closing checks

Digital opening, end-of-day and container checks that replace paper checklists, with a second-person confirmation where required.

Prohibited items acknowledgment

Visitors' acknowledgment of the facility's rules on personal electronic devices and other prohibited items recorded at entry.

Append-only audit trail

Records cannot be edited or deleted; corrections are added as new entries that reference the original.

Facility document library

Accreditation documents, the fixed facility checklist, standard operating procedures and inspection reports stored with version history.

Inspection readiness

Views that bring together logs, events, checks and exceptions for a chosen period, ready for an inspector.

Multi-facility view

Organizations with several SCIFs see each facility separately, with roles limited to the facilities a person supports.

Integrations

How it connects to your systems

Connects toHowWhat flows
Physical access control systemBadge reader events from your access control system can be recorded with the access log, so badge entries and manual entries sit side by side.In: badge events with reader, time and badge holder.
Intrusion detection systemAlarm, tamper and access-mode events from the IDS monitoring interface, mapped to zones during implementation.In: IDS events and zone states.
Personnel security systemEligibility and access information from your personnel security system, including Moraph's Personnel Security (PerSec) Clearance Tracker, to support roster verification.In: person, eligibility status and accesses as your security office records them.
Single sign-onStaff sign in through your identity provider (SAML or OpenID Connect), including CAC or PIV authentication.In: user identity and group membership for role assignment.
Security monitoringAudit events forwarded to your security information and event management tool.Out: audit trail events.
Work APIAccess logs, visits and events available to your reporting tools through the Moraph Work API.Out: logs, visits, events and checks.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Staff sign in through your identity provider with CAC, PIV or your multi-factor policy.

Role-based access

What each person sees and does follows their role and their facilities; approving a visit is separate from sponsoring one.

Append-only audit trail

Every entry, view, change and export is logged with the person and time, and records cannot be edited or deleted.

Encryption and keys

Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Cleared US-person support

Support tickets for defense and intelligence clients are handled only by Moraph staff who are US citizens with active clearances.

US-only hosting

When hosted by Moraph, data stays in the United States region. Deployments in your own environment run under your authority.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Facility operations

Who is inside

For entry controllers, custodians and the SSO

Everyone currently signed in to the facility, with entry time, purpose and escort.

Break down by
Facility, Visitor or roster, Escort
Delivered as
Live view
Used for
Closing the facility and accounting for everyone during an emergency.

Expected visitors

For entry controllers and sponsors

Approved visits for a day or week, with sponsor, purpose and escort.

Break down by
Date, Sponsor, Program, Facility
Delivered as
Live view; daily email to entry staff
Used for
Preparing the entry point for the day.

Visit request status

For sSO and sponsors

Visit requests by stage: received, awaiting sponsor, awaiting approval, approved and rejected.

Break down by
Stage, Sponsor, Visit date, Facility
Delivered as
Live dashboard
Used for
Keeping requests moving before visit dates.

Security events

IDS events and responses

For sSO and alarm responders

Alarm and tamper events with response times, findings and outcomes.

Break down by
Zone, Event type, Outcome, Period
Delivered as
Live view; CSV and PDF export
Used for
Reviewing alarm handling and spotting zones with recurring events.

Access exceptions

For sSO

Refused entries, escorted visitors without an escort recorded, late exits and badge events with no matching log entry.

Break down by
Exception type, Facility, Period
Delivered as
Live view; scheduled email
Used for
Following up on exceptions before they become inspection findings.

Opening and closing record

For sSO and custodians

Each opening, end-of-day and container check, who completed and confirmed it, and any exceptions.

Break down by
Facility, Check type, Custodian, Period
Delivered as
Live view; PDF export
Used for
Showing that the facility was secured as procedures require.

Inspection and audit

Access log extract

For sSO and inspectors

All entries and exits for a chosen facility and period, with purpose, escort and source.

Break down by
Facility, Person, Date range, Entry source
Delivered as
On request; CSV and PDF export
Used for
Answering inspection and investigation questions about who was present.

Roster verification history

For sSO and inspectors

Additions, removals and verifications on the access roster, with who approved each.

Break down by
Facility, Change type, Approver, Period
Delivered as
Live view; PDF export
Used for
Evidencing that unescorted access is controlled.

Period sign-off

For sSO, security management and inspectors

Each period's log review with exceptions found, actions taken and the SSO's sign-off.

Break down by
Facility, Period, Exception count
Delivered as
PDF
Used for
Showing logs are reviewed, not just collected.

Audit trail extract

For security management and inspectors

Who viewed, created, corrected or exported records for a chosen facility, record or period.

Break down by
User, Action, Record type, Date range
Delivered as
On request; CSV export
Used for
Demonstrating the integrity of the facility's records.

Exports, access and evidence

  • Every report can be exported to CSV, and evidence reports to PDF. Exports are recorded in the audit trail.
  • Reports respect each viewer's role and facilities: an entry controller sees their facility's current day, the SSO sees all of their facilities, and inspectors see what their scope allows.
  • Inspection reports can be run as of a past date and give the same result each time.
  • Data is available through the Moraph Work API for organizations that report across facilities in their own tools.
  • Reports contain unclassified facility management information. Organizations running the system on classified networks apply their own handling rules to exports.

Deployment

Where and how it runs

Moraph cloud (US)

Hosted and operated by Moraph in the United States region for unclassified facility management data.

Your environment

Installed in your own environment, including networks operated under your authority, with Moraph providing software and support as you allow.

Dedicated environment

A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Facility setup

Facilities, entry points, zones and checklists are configured from your standard operating procedures. We need your SSO and facility documents.

Roles and roster

Roles are mapped to your identity provider and the access roster is loaded and verified by your security office.

IDS and badge integration

Event feeds from your IDS monitoring interface and access control system are connected and mapped to zones, with your alarm vendor's involvement where needed.

Procedures review

Visit approval, escort and closing procedures are configured to match yours, and two-person rules set where you require them.

Parallel running

Paper and digital logs run side by side for a period you choose, and differences are reviewed with the SSO.

Training and go-live

Entry staff, custodians, sponsors and responders are trained on their own tasks before paper logs are retired.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • It does not accredit a facility or replace the accreditation process. Accreditation decisions belong to the accrediting official.
  • It is not an intrusion detection system or alarm monitoring station. It receives and records events from your IDS; alarm monitoring and response remain as your procedures require.
  • It does not grant clearances or decide need-to-know. Eligibility and accesses come from your security office and personnel security system.
  • It does not store safe or door combinations. Combination changes can be recorded as having occurred, but not the combinations themselves.
  • It is not a physical access control system and does not open doors. It records badge events from the system you have.
  • The Moraph-hosted service handles unclassified facility management information only. Operation on classified networks takes place in your environment, under your authority and accreditation.
  • Moraph does not claim accreditation for the product. Moraph maps controls and supports your own assessment and authorization.
  • Integrations depend on the interfaces your IDS and access control vendors provide.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Check a visitor in and out at a test entry point and review the log entry it creates
  2. Walk a visit request from receipt to SSO approval and confirm the sponsor cannot approve it
  3. Connect a test IDS event feed and record a response
  4. Complete a closing check with a second-person confirmation
  5. Try to edit a recorded entry and review how corrections are handled
  6. Produce an inspection pack for a sample period and review it with your SSO

Questions

Frequently asked questions

Does the system make our SCIF ICD 705 compliant?

No system does on its own. It supports the record-keeping that ICD 705 and its standards call for; compliance and accreditation depend on your facility, procedures and accrediting official.

Can it run on our classified network?

It can be installed in your own environment, including networks operated under your authority. Operation there is under your authority and accreditation, and Moraph supports it as you allow.

Does it replace our intrusion detection system?

No. It receives events from your IDS monitoring interface and records the response. Alarm monitoring remains with your IDS and response procedures.

Who owns the data?

Your organization does. How it is returned and deleted at the end of the agreement is set out in the contract.

How is it priced?

As a subscription, usually measured by the number of facilities, with implementation charged separately. See Working with Moraph for what drives a quotation.

Who supports us at Moraph?

Support tickets for defense and intelligence clients are handled only by Moraph staff who are US citizens with active clearances.

Next steps

Evaluate SCIF Access Control & Management System

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: SCIF Access Control & Management System guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: SCIF Access Control & Management System support guide.

Related products