SCIF Access Control & Management System

Principal workflows

• Request: Visit access requests are recorded when the security office receives them, checked against the facility's rules, and approved or rejected by the SSO, so the door knows in advance who is expected.
• Enter: At the entry point, staff check each person against the access roster or the approved visit, record entry and exit, and assign an escort where required.
• Monitor: Events from your intrusion detection system are received and shown alongside the access log, so security staff can see alarm, access and secure states in one place and record the response.
• Close and review: Opening and closing checks are recorded digitally, and the SSO reviews logs, events and exceptions on a schedule and before inspections.

Who uses it

• Special Security Officers and SCIF managers in defense and intelligence organizations
• Facility security officers at cleared contractors operating accredited SCIFs
• Entry control and security staff who staff the door
• Program security leads who sponsor visitors
• Inspectors and security officials who review facility records

Reporting

• Who is inside each facility now
• Visit requests by stage and expected visitors
• IDS events, responses and recurring zones
• Access exceptions for SSO follow-up
• Opening and closing checks completed and confirmed
• Inspection extracts of logs, roster history and sign-offs

Features

• Digital access log: Every entry and exit recorded with person, time, purpose and escort, replacing paper sign-in sheets.
• Visit access requests: Incoming visit requests tracked from receipt through sponsor confirmation and SSO approval, with validity dates.
• Access roster: The list of people authorized for unescorted access, maintained by the security office with the date each entry was last verified.
• Escort tracking: Escort assignments recorded for each escorted visitor, with handovers between escorts logged.
• IDS event display: Alarm, tamper and access-mode events received from your intrusion detection system and shown with the zone and time.
• Alarm response records: Who responded to each alarm, what they found and how it was resolved, kept with the event.
• Opening and closing checks: Digital opening, end-of-day and container checks that replace paper checklists, with a second-person confirmation where required.
• Prohibited items acknowledgment: Visitors' acknowledgment of the facility's rules on personal electronic devices and other prohibited items recorded at entry.
• Append-only audit trail: Records cannot be edited or deleted; corrections are added as new entries that reference the original.
• Facility document library: Accreditation documents, the fixed facility checklist, standard operating procedures and inspection reports stored with version history.
• Inspection readiness: Views that bring together logs, events, checks and exceptions for a chosen period, ready for an inspector.
• Multi-facility view: Organizations with several SCIFs see each facility separately, with roles limited to the facilities a person supports.

Integrations

• Physical access control system: Badge reader events from your access control system can be recorded with the access log, so badge entries and manual entries sit side by side.
• Intrusion detection system: Alarm, tamper and access-mode events from the IDS monitoring interface, mapped to zones during implementation.
• Personnel security system: Eligibility and access information from your personnel security system, including Moraph's Personnel Security (PerSec) Clearance Tracker, to support roster verification.
• Single sign-on: Staff sign in through your identity provider (SAML or OpenID Connect), including CAC or PIV authentication.
• Security monitoring: Audit events forwarded to your security information and event management tool.
• Work API: Access logs, visits and events available to your reporting tools through the Moraph Work API.

Deployment

• Moraph cloud (US): Hosted and operated by Moraph in the United States region for unclassified facility management data.
• Your environment: Installed in your own environment, including networks operated under your authority, with Moraph providing software and support as you allow.
• Dedicated environment: A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.

Security and privacy

• Single sign-on: Staff sign in through your identity provider with CAC, PIV or your multi-factor policy.
• Role-based access: What each person sees and does follows their role and their facilities; approving a visit is separate from sponsoring one.
• Append-only audit trail: Every entry, view, change and export is logged with the person and time, and records cannot be edited or deleted.
• Encryption and keys: Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.
• Cleared US-person support: Support tickets for defense and intelligence clients are handled only by Moraph staff who are US citizens with active clearances.
• US-only hosting: When hosted by Moraph, data stays in the United States region. Deployments in your own environment run under your authority.

Limitations

• It does not accredit a facility or replace the accreditation process. Accreditation decisions belong to the accrediting official.
• It is not an intrusion detection system or alarm monitoring station. It receives and records events from your IDS; alarm monitoring and response remain as your procedures require.
• It does not grant clearances or decide need-to-know. Eligibility and accesses come from your security office and personnel security system.
• It does not store safe or door combinations. Combination changes can be recorded as having occurred, but not the combinations themselves.
• It is not a physical access control system and does not open doors. It records badge events from the system you have.
• The Moraph-hosted service handles unclassified facility management information only. Operation on classified networks takes place in your environment, under your authority and accreditation.
• Moraph does not claim accreditation for the product. Moraph maps controls and supports your own assessment and authorization.
• Integrations depend on the interfaces your IDS and access control vendors provide.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/scif-access-control-and-management-system. Purchasing routes and company information: www.moraph.com/how-to-buy.