Federal civilian · Managed platform (ServiceNow)

ServiceNow for Federal Service Management

A federal IT service desk on ServiceNow, configured for agency workflows and run by Moraph

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs ServiceNow as a managed service for federal civilian agencies, with a service portal and request workflows configured for federal needs such as PIV credential support and classified-network token requests. ServiceNow provides the platform; Moraph configures it, migrates you from your legacy ticketing system, and operates it day to day. Your agency keeps the decisions on policy, approvals and who gets access.

The problem it solves

Many agency help desks still run on ticketing systems that were built for a different era: separate queues for each bureau, email and phone as the main way in, and federal-specific requests such as PIV card problems handled through workarounds and paper forms. Employees do not know where to go, requests bounce between groups, and the agency cannot see how long things take. Moving to a modern platform is attractive, but configuring it for federal workflows, keeping it documented for the agency's authorization, and running it well takes skills many IT shops do not have spare.

  • Employees reach the help desk by phone and email, with no single place to ask for help or check status
  • Federal requests such as PIV credential resets and token issuance follow manual, paper-based steps
  • Requests pass between bureaus and fulfillment groups with no shared record of who holds them
  • Platform configuration and control documentation drift away from what the agency's authorization describes

Who uses it

  • Agency CIO offices replacing a legacy IT ticketing system
  • Federal service desk managers and their contracted help desk teams
  • Credentialing and identity offices that handle PIV and token requests
  • Information system security officers who maintain the system's authorization
  • Bureau IT leads who need a shared service portal across components

Requirements it supports

Federal Information Security Modernization Act of 2014 (FISMA)NIST SP 800-53 Rev. 5 security and privacy controlsHSPD-12 and FIPS 201-3 (Personal Identity Verification)OMB Memorandum M-19-17 (Identity, Credential, and Access Management)21st Century Integrated Digital Experience ActSection 508 of the Rehabilitation Act

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

ServiceNow provides the platform, Moraph implements and runs it for you, and your agency owns policy, approvals and the system's authorization.

AreaMoraphServiceNowYour organization
LicensingResells ServiceNow subscriptions and tracks usage against themSets licence terms and entitlementsDecides how many users and which products to license
Platform availabilityMonitors the instance and integrations and raises cases with ServiceNowHosts and operates the platform under its own service commitmentsTells employees about planned outages Moraph and ServiceNow announce
ConfigurationBuilds and maintains the portal, catalog, workflows and baselineProvides the platform's configuration capabilitiesDecides what the service should do and approves each design
Identity and accessConfigures sign-in and group mapping, and supports access reviewsProvides the platform's authentication and role featuresRuns the identity provider, approves privileged access and certifies access reviews
MonitoringWatches platform health, integrations and job failuresMonitors its infrastructure and platform servicesMonitors the service from the agency's side and reports problems
Incident responseTriages instance issues, fixes what is in scope and coordinates with ServiceNowResponds to platform incidents and notifies customersLeads the agency's incident response and reporting obligations
ChangesEstimates, builds, tests and releases approved changesNone for agency configurationRequests and approves changes and sets release windows
Platform upgrades and patchesPlans upgrades, runs regression testing and fixes configuration issues they causeIssues releases and patches on its own scheduleApproves upgrade windows and takes part in user acceptance testing
Security documentationMaps configured settings to NIST SP 800-53 controls and keeps descriptions currentMaintains the platform's own security documentationOwns the system's authorization and accepts risk
User supportSupports agency administrators and the service desk on platform questionsSupports Moraph through its support channelsRuns the service desk that supports employees

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of the platform itself, which belongs to its vendor.

  1. Step 1

    The onboarding tracker

    During implementation the agency and Moraph follow one tracker of workstreams, owners and status.

    WorkstreamOwnerAgency contactStatus
    Instance setupMoraphExample Agency CIO officeComplete
    Identity provider sign-inMoraphIdentity teamIn testing
    Federal service catalogMoraphService desk managerIn design
    Legacy ticket migrationMoraphBureau IT leadWaiting on data extract
    Control descriptionsMoraphISSODrafting
    During implementation the agency and Moraph follow one tracker of workstreams, owners and status.

  2. Step 2

    A catalog item in the baseline

    Each catalog item is recorded in the configuration baseline with its approvals and fulfillment steps, so the agency can review what it does.

    Catalog item · PIV PIN reset

    Available to
    All badged employees and contractors
    Approval
    None for PIN reset
    Fulfillment group
    Credentialing office, Example Field Office
    In-person step
    Yes, identity verified by issuer
    Baseline version
    1.4 (fictional)

    Fulfillment steps

    • Service desk confirms request details
    • Credentialing office schedules appointment
    • Issuer verifies identity and resets PIN
    • Requester confirms sign-in works
    Each catalog item is recorded in the configuration baseline with its approvals and fulfillment steps, so the agency can review what it does.

  3. Step 3

    A change request

    New catalog items and workflow changes follow one path: request, estimate, agency approval, test and release.

    CHG-0412 · Add token replacement catalog item

    1. Change requestedAgency service owner
    2. Estimate and design notes addedMoraph service engineer
    3. Change approvedAgency service owner
    4. Built and tested in non-productionMoraph service engineer
    5. User acceptance test passedCredentialing office
    6. Released in agreed windowMoraph service engineer
    New catalog items and workflow changes follow one path: request, estimate, agency approval, test and release.

  4. Step 4

    Alert triage

    Moraph's operations team works platform and integration alerts, and raises cases with ServiceNow when the platform itself is the cause.

    AlertSourceRaisedOwnerStatus
    Directory sync job failedIntegration06:10MoraphInvestigating
    Inbound email delayedPlatform07:45ServiceNow case openedWaiting on vendor
    Endpoint inventory import partialIntegration08:20MoraphFixed, rerun complete
    Scheduled report failedConfiguration09:05MoraphResolved
    Moraph's operations team works platform and integration alerts, and raises cases with ServiceNow when the platform itself is the cause.

  5. Step 5

    The monthly service review

    Each month Moraph and the agency review volumes, changes, incidents and risks, and agree priorities for the next month.

    Monthly service review · Example Agency (fictional)

    Tickets opened
    4,218
    Tickets resolved
    4,031
    Open backlog
    612
    Changes released
    7
    Platform incidents
    1, vendor-side

    Open items

    • !Directory sync failures on two nights
    • Upcoming ServiceNow release: test window to agree
    • Two catalog items awaiting agency approval
    Each month Moraph and the agency review volumes, changes, incidents and risks, and agree priorities for the next month.

  6. Step 6

    Access review

    Privileged and fulfillment access is reviewed on the agency's schedule, and the agency certifies each decision.

    UserRoleBureauLast sign-inDecision
    User 30418Service desk agentBureau AYesterdayKeep
    User 30552Fulfillment: credentialingBureau B3 days agoKeep
    User 29907Agency administratorHeadquarters94 days agoRemove
    User 31120Auditor (read-only)Headquarters12 days agoExpires end of review
    Privileged and fulfillment access is reviewed on the agency's schedule, and the agency certifies each decision.

Workflows

The principal workflows

  1. Request

    Employees and contractors use one service portal to report a problem or ask for something, choosing from a catalog configured for the agency's services, including federal items such as PIV credential support and classified-network token requests.

    • Employee signs in to the portal with their PIV card through the agency's identity provider
    • Chooses a catalog item or describes the problem in their own words
    • Answers the questions that item needs, such as credential type or location
    • Request is routed to the right group and the employee can follow its status

  2. Fulfill

    ServiceNow routes each request through the approvals and tasks the agency defined, so the service desk, the credentialing office and other fulfillment groups each see only their part.

    • Supervisor or sponsor approves where the catalog item requires it
    • Tasks are created for each fulfillment group in order
    • Identity-sensitive steps, such as verifying the employee in person, are recorded by the fulfilling office
    • Requester is notified as each stage completes
    • Request is closed with its outcome recorded

  3. Operate

    Moraph runs the instance as a managed service: monitoring platform health and integrations, triaging alerts, handling the agency's change requests, and keeping configuration aligned with the agreed baseline.

    • Integration failures and platform alerts arrive in Moraph's operations queue
    • Moraph triages, fixes what is within its scope and raises cases with ServiceNow for platform issues
    • Agency change requests are estimated, approved by the agency and scheduled
    • Changes are tested in a non-production instance before release
    • Configuration is compared with the agreed baseline and differences resolved

  4. Govern

    The agency stays in control of policy and access. Moraph reports on service performance each month, supports access reviews, and keeps control documentation current for the agency's own authorization.

    • Monthly service review covers volumes, backlog, changes and open risks
    • Privileged and fulfillment-group access is reviewed and certified by the agency
    • ServiceNow release upgrades are planned and regression tested with the agency
    • Control implementation statements are updated when configuration changes
    • Evidence is provided for the agency's continuous monitoring and assessments

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Requester

Federal employee, contractor, detailee

Gets help or asks for something through one portal and can see where their request stands.

Sees

  • The service catalog and knowledge articles available to them
  • Their own incidents and requests with status and comments
  • Approvals waiting on them if they are a supervisor or sponsor

Does

  • Signs in with their PIV card through the agency's identity provider
  • Reports problems and submits catalog requests
  • Adds comments and attachments to their own tickets
  • Approves requests for their staff when named as approver
  • Rates resolved tickets where the agency enables surveys

Cannot

  • See other people's tickets unless the agency grants it
  • Change the priority or assignment of a ticket
  • Approve their own request
Approvals
Catalog items the agency marks for approval go to the requester's supervisor or sponsor before work starts.
Notified about
Ticket received, status changes, requests for more information, and resolution.

Service desk agent

Help desk technician, tier 1 or tier 2 support specialist

Works the incident and request queue, resolves what it can at first contact, and routes the rest to the right group.

Sees

  • Incidents and requests in their assignment groups
  • Requester details and recent ticket history
  • Knowledge articles and known issues
  • Their own open work by priority and age

Does

  • Logs tickets taken by phone or walk-up
  • Resolves incidents and records the resolution
  • Reassigns tickets to fulfillment groups
  • Proposes knowledge articles for approval
  • Escalates tickets in line with the agency's priority rules

Cannot

  • Complete credentialing tasks reserved for the credentialing office
  • Change catalog items, workflows or assignment rules
  • Grant roles or group membership
Approvals
Their work needs no approval; knowledge articles they draft are approved by a knowledge owner before publication.
Notified about
Tickets assigned to them or their group, tickets nearing the response targets the agency set, and requester replies.

Fulfillment group member

Credentialing specialist, PIV issuer, desktop support technician, network operations staff

Completes the tasks routed to their group, such as resetting a PIV PIN in person or preparing a token for issuance by the agency's issuing office.

Sees

  • Tasks assigned to their group with the request details needed
  • The request's approval status and earlier tasks
  • Their group's queue by age

Does

  • Accepts and completes assigned tasks
  • Records identity checks and actions in the task notes
  • Returns tasks to the requester or agent for missing information
  • Closes tasks with an outcome

Cannot

  • See tasks for other fulfillment groups unless granted
  • Skip a required approval step
  • Change the workflow for their catalog items
Approvals
Tasks only reach them after the approvals the catalog item requires have been given.
Notified about
New tasks for their group, and tasks waiting longer than the agency's target.

Agency service owner

Service desk manager, IT service management lead, bureau IT lead

Owns the service for the agency: sets priorities and policy, approves changes and decides who has access.

Sees

  • All tickets and dashboards across their bureaus
  • Change requests, their estimates and test results
  • Monthly service review reports and open risks
  • Access lists for agents, fulfillment groups and administrators

Does

  • Approves or rejects change requests
  • Sets catalog approval rules and assignment policy
  • Certifies access in periodic access reviews
  • Approves knowledge and communications to employees
  • Reviews service performance with Moraph each month

Cannot

  • Edit or delete platform audit logs
  • Release a change to production that has not passed testing
  • Bypass ServiceNow's terms or licence limits
Approvals
Approves changes, new catalog items, privileged access and release schedules.
Notified about
Change requests awaiting decision, major incidents, access reviews due, and the monthly service review.

Moraph service engineer

Moraph ServiceNow administrator, platform engineer, service manager

Runs the instance for the agency: monitors health and integrations, makes approved configuration changes and keeps the baseline and control documentation current.

Sees

  • Platform health, integration status and system logs
  • Configuration, update sets and the agreed baseline
  • Ticket data only where needed to fix a reported problem

Does

  • Builds and tests approved changes in non-production
  • Releases approved changes on the agreed schedule
  • Triages platform alerts and raises cases with ServiceNow
  • Plans and regression tests ServiceNow release upgrades
  • Prepares the monthly service review and control evidence

Cannot

  • Release a change the agency has not approved
  • Grant access to agency users without agency approval
  • Approve requests or complete fulfillment tasks on the agency's behalf
Approvals
Every production change is approved by the agency service owner; emergency fixes are reported to the agency and recorded.
Notified about
Platform and integration alerts, approved changes ready for release, and ServiceNow notices about releases and incidents.

Auditor or assessor (read-only)

ISSO, security control assessor, inspector general staff, internal auditor

Reviews tickets, configuration evidence and logs for assessments and audits, without changing anything.

Sees

  • Tickets and approvals within the scope granted
  • Configuration baseline, change history and control documentation
  • Audit logs and access review results

Does

  • Searches and reads records within their scope
  • Exports evidence, with each export logged
  • Records assessment notes outside the operational queues

Cannot

  • Create, change or close tickets
  • Change configuration or access
  • Keep access after it expires
Approvals
Access is approved by the agency service owner with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the approver.

Agency administrator

Agency platform administrator, identity and access team member

Manages agency users, groups and role assignments, within limits the service owner sets.

Sees

  • Users, groups and role assignments
  • Identity provider group mappings
  • The record of access changes

Does

  • Adds and removes users or maps them from identity provider groups
  • Assigns users to assignment and fulfillment groups
  • Runs access review reports
  • Disables accounts for departing staff

Cannot

  • Grant privileged administrator roles without service owner approval
  • Change workflows or catalog items
  • Edit audit logs
Approvals
Privileged role grants are approved by the agency service owner.
Notified about
Access reviews due and accounts not used for the period agency policy sets.

Permissions at a glance

ActionRequesterAgentFulfillerService ownerMoraph eng.AuditorAgency admin
Submit requests and incidentsOwn work onlyFullFullFullNo accessNo accessNo access
Work and resolve incidentsNo accessFullOwn work onlyFullNo accessNo accessNo access
Approve catalog requestsOwn work onlyNo accessNo accessApprovesNo accessNo accessNo access
Complete fulfillment tasksNo accessNo accessOwn work onlyView onlyNo accessNo accessNo access
Publish knowledge articlesNo accessOwn work onlyNo accessApprovesNo accessNo accessNo access
Request a configuration changeNo accessNo accessNo accessFullNo accessNo accessNo access
Approve a configuration changeNo accessNo accessNo accessApprovesNo accessNo accessNo access
Build and release approved changesNo accessNo accessNo accessView onlyFullNo accessNo access
Manage users and groupsNo accessNo accessNo accessApprovesView onlyNo accessFull
Grant privileged rolesNo accessNo accessNo accessApprovesNo accessNo accessOwn work only
View audit logs and change historyNo accessNo accessNo accessView onlyView onlyView onlyView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Nobody approves their own request or their own change: requests go to a supervisor or sponsor, and every production change is approved by the agency service owner before Moraph releases it.
  • Roles, assignment groups and fulfillment groups are configured with you during implementation and can be limited by bureau, component or location.
  • Moraph engineers work on the platform under the agency's approval and do not complete fulfillment tasks or approve requests. Federal support tickets are handled only by Moraph staff who are US citizens with active clearances.
  • Users sign in with their PIV card through the agency's identity provider, and group membership can follow its groups. Auditors and assessors get temporary read-only access with a defined scope and end date.

Features

What it does

Unified service portal

One place for employees and contractors to ask for help, find answers and follow their requests, configured with the agency's branding and services.

Federal service catalog

Catalog items for common federal requests such as PIV PIN resets and certificate updates, replacement credentials, and classified-network token requests, each with the questions and approvals the agency sets.

Incident management

ServiceNow tracks reported problems from first contact to resolution, with assignment, priority and escalation rules configured for the agency's support model.

Request fulfillment

Multi-step requests are broken into tasks for each fulfillment group, so the service desk, credentialing office and field support each work their own step.

PIV sign-in

Employees sign in with their PIV card through the agency's identity provider, so the portal follows the agency's existing credential policy.

Knowledge base

Articles written and approved by the agency's support teams are shown in the portal and to agents as they work a ticket.

Multi-bureau structure

Bureaus and components can share one portal while keeping their own queues, fulfillment groups and reporting.

Legacy migration

Open tickets, users, groups and knowledge from the legacy system are mapped and moved, or closed out in the old system by agreement.

Configuration baseline

Moraph keeps a documented baseline of the instance's configuration and checks the live instance against it.

Managed change control

Agency requests for new catalog items, workflows or fields go through estimate, agency approval, testing and scheduled release.

Control documentation

Moraph maps the agency-configured settings to NIST SP 800-53 controls and keeps the descriptions current to support the agency's authorization.

Service reporting

Dashboards and a monthly service review show volumes, backlog, time to resolve and request types by bureau.

Integrations

How it connects to your systems

Connects toHowWhat flows
Agency identity providerUsers sign in through the agency's identity provider with PIV, and roles can follow its groups (SAML or OpenID Connect).In: user identity and group membership.
Directory and HR dataUser records, organization, supervisor and location from the agency directory or HR feed, so approvals and routing know who reports to whom.In: users, supervisors, organizations and locations on a schedule.
Credentialing systemWhere the agency's credential management system offers an interface, request details can be passed to it and status returned; otherwise the credentialing office records the outcome in the task.Out: credential request details. In: status where available.
Endpoint and asset toolsHardware and software inventory from the agency's endpoint management tools, so agents see the device behind a ticket.In: devices, assigned users and installed software.
Monitoring and alertingEvents from the agency's monitoring tools can create incidents automatically under rules the agency approves.In: events and alerts that meet agreed rules.
Email and phoneInbound email creates or updates tickets, and the agency's contact center platform can open tickets for calls.In: emails and call records. Out: notifications.
Legacy ticketing systemA one-time migration of open tickets, history the agency chooses to keep, users, groups and knowledge.In: tickets, users, groups and articles, once at cutover.
Agency data warehouseTicket and request data exported to the agency's reporting environment for analysis alongside other IT data.Out: tickets, tasks, approvals and timestamps.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

PIV sign-in

Users sign in through the agency's identity provider with their PIV card, so the agency's credential and multi-factor policies apply.

Role-based access

What each person can see and do follows their role and group; fulfillment groups see only the tasks routed to them.

Cleared US-person support

Federal support tickets are handled only by Moraph staff who are US citizens with active clearances, and Moraph's access to the instance is logged.

Encryption and keys

Data is encrypted using the ServiceNow platform's encryption, and Moraph staff cannot access agency data without explicit, time-bound authorization from the agency.

Complete audit trail

Changes to tickets, configuration and access are logged with the person and time, and the logs are available to the agency's assessors.

US-only hosting

The instance runs in a ServiceNow US government cloud offering selected with the agency, and Moraph's operations for it stay in the United States.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Service performance

Open tickets by age

For service desk managers and the agency service owner

Every open incident and request with its age, priority, assignment group and status, oldest first.

Break down by
Bureau, Assignment group, Priority, Age band, Ticket type
Delivered as
Live dashboard; CSV export
Used for
Finding stuck work and rebalancing queues.

Time to resolve

For agency service owner and bureau IT leads

How long incidents and requests took from submission to resolution, against the targets the agency set.

Break down by
Bureau, Catalog item, Priority, Assignment group, Period
Delivered as
Live dashboard; scheduled email
Used for
Tracking whether the service meets the agency's own targets.

Credential request status

For credentialing office and service owner

PIV and token requests by stage: awaiting approval, awaiting the requester, in fulfillment and complete.

Break down by
Request type, Location, Stage, Period
Delivered as
Live dashboard; CSV export
Used for
Keeping credential work moving and planning in-person appointments.

First-contact resolution

For service desk managers

Tickets resolved by the service desk without reassignment, compared with those routed on.

Break down by
Agent, Category, Channel, Period
Delivered as
Live dashboard
Used for
Targeting knowledge articles and agent training.

Managed service

Monthly service review

For agency service owner and CIO office

Ticket volumes and backlog, changes released, platform incidents, upgrade plans and open risks for the month.

Break down by
Bureau, Month, Change type
Delivered as
PDF; review meeting
Used for
Governing the managed service and agreeing priorities with Moraph.

Change request log

For agency service owner and ISSO

Each change request with its estimate, approval, test result and release date.

Break down by
Status, Requester, Change type, Release
Delivered as
Live view; CSV export
Used for
Tracking requested work and evidencing change control.

Platform alerts and incidents

For agency service owner and Moraph service manager

Platform and integration alerts, how each was handled, and cases raised with ServiceNow.

Break down by
Alert type, Integration, Outcome, Period
Delivered as
Live view; monthly summary
Used for
Seeing recurring problems and whether fixes held.

Security and compliance

Configuration baseline comparison

For iSSO and Moraph service engineers

Differences between the live instance and the agreed configuration baseline, with how each was resolved.

Break down by
Area, Difference type, Resolution
Delivered as
Monthly PDF; on request
Used for
Supporting configuration management controls and continuous monitoring.

Access review

For agency service owner, agency administrators and ISSO

Every user with an agent, fulfillment or administrator role, when they last signed in, and the reviewer's decision.

Break down by
Role, Bureau, Last sign-in, Decision
Delivered as
Periodic review; CSV and PDF export
Used for
Certifying privileged and operational access.

Control evidence package

For iSSO and security control assessors

Control descriptions for the configured settings, with change history and access review results as supporting evidence.

Break down by
Control family, Period, Evidence type
Delivered as
On request; PDF and spreadsheet
Used for
Supporting the agency's assessments and authorization.

Audit log extract

For iSSO, inspectors and auditors

Who did what and when for a selected ticket, configuration item, user or period.

Break down by
Record, User, Action, Date range
Delivered as
On request; CSV export
Used for
Answering audit and investigation requests.

Exports, access and evidence

  • Dashboards are built in ServiceNow's reporting features and configured by Moraph; reports can be exported to CSV and summary reports to PDF.
  • Each bureau can see its own dashboards, while the agency service owner sees the whole service.
  • Ticket and request data can be delivered to the agency's data warehouse for reporting alongside other IT data.
  • The monthly service review is prepared by Moraph and agreed with the agency service owner, and the agency keeps the record.
  • Reports respect each viewer's role, and access granted to assessors is read-only with a scope and end date.

Deployment

Where and how it runs

ServiceNow US government cloud

The instance runs in a ServiceNow US government cloud offering chosen with the agency, with Moraph operating it from the United States.

Multi-bureau instance

One instance shared by several bureaus or components, each with its own queues, catalog items and reporting.

Existing ServiceNow instance

Where the agency already licenses ServiceNow, Moraph can take over configuration and operation of that instance after an assessment.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Discovery

We review your current ticketing system, support model, bureaus and federal request types, and agree what the first release includes.

Licensing and instance setup

Moraph arranges the ServiceNow subscriptions you choose and sets up production and non-production instances in a US government cloud offering selected with you.

Design and configuration

Portal, catalog, workflows, approvals, assignment rules and roles are configured to your procedures and recorded in the configuration baseline.

Integrations

Identity provider, directory, endpoint and other integrations are built and tested. We need contacts from your identity, directory and network teams.

Migration and cutover

Open tickets, users, groups and knowledge are migrated, and the legacy system is retired or kept read-only by agreement.

Documentation and handover to operations

Control descriptions are written for your authorization package, agents and fulfillment groups are trained, and the instance moves into Moraph's managed service.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not ServiceNow. ServiceNow's own service commitments, release schedule, roadmap and outages apply to the platform.
  • Licences are subject to ServiceNow's terms, which Moraph cannot change.
  • Moraph does not issue PIV credentials or classified-network tokens. Those actions remain with the agency's credentialing and issuing offices, which record their outcomes in the workflow.
  • The instance is for unclassified information only. Classified details must not be entered in tickets; classified-network requests carry only the unclassified information needed to route them.
  • Moraph does not grant or hold an authorization to operate for the agency. Moraph maps controls and provides evidence; the agency's authorizing official makes the risk decision.
  • Moraph does not staff the agency's tier 1 service desk under this service unless that is contracted separately.
  • Configuration changes follow the agreed change process; Moraph does not release changes the agency has not approved.
  • Integrations depend on interfaces the agency's other systems provide. Where a system has no interface, the step is recorded manually.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Walk a PIV PIN reset request from the portal through to the credentialing office and back to the requester
  2. Check that fulfillment groups see only the tasks routed to them
  3. Review a sample configuration baseline entry and the matching control description
  4. Follow a change request from submission to release and review the evidence it leaves
  5. Review a sample monthly service review and the responsibilities table with your contracting officer
  6. Test PIV sign-in through your identity provider in a demonstration instance

Questions

Frequently asked questions

Do we contract with Moraph or ServiceNow?

With Moraph, which resells the ServiceNow subscriptions and provides implementation and the managed service. ServiceNow's licence terms apply to the platform.

Can Moraph take over an instance we already have?

Yes, after an assessment of its configuration, integrations and documentation. Findings and any remediation are agreed before the managed service starts.

Does this give us an authorization to operate?

No. Moraph maps the configured controls and provides evidence and documentation; your authorizing official makes the authorization decision.

Who handles our support tickets at Moraph?

Federal support tickets are handled only by Moraph staff who are US citizens with active clearances.

How is it priced?

ServiceNow subscriptions are priced by the products and users licensed. Implementation is charged separately, and the managed service as a recurring fee scoped to the instance. See Working with Moraph for what drives a quotation.

Is there an accessibility conformance report?

ServiceNow publishes conformance information for its platform. For Moraph's configured portal, ask through the procurement request form at /how-to-buy/request.

Next steps

Evaluate ServiceNow for Federal Service Management

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: ServiceNow for Federal Service Management guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: ServiceNow for Federal Service Management support guide.

Related products