Supply Chain Mapping & Risk Illuminator

Principal workflows

• Map: Contract and supplier data is loaded and resolved into a map of suppliers, their locations and their relationships, starting from your prime contractors and extending down as disclosures and data sources allow.
• Assess: Risk criteria your program sets are applied across the map: single sources, suppliers in countries of concern, unstable regions, prohibited entities and domestic content questions, each finding with its evidence.
• Engage: Where data is missing or a finding needs explanation, the analyst sends a structured request to the supplier and tracks the response.
• Decide and mitigate: Confirmed risks go to the people who own the decision. Contracting officers and program owners record the assessment, the mitigation chosen and its follow-up, with approval by the program lead where your procedures require it.

Who uses it

• Supply chain risk management (C-SCRM) programs in federal civilian agencies
• Contracting officers and acquisition staff applying domestic preference and sourcing rules
• Program offices that own critical systems and products
• Chief information security and acquisition officers who answer for supply chain risk
• Inspectors general and auditors who review supply chain decisions

Reporting

• Critical items with single-source or concentrated dependencies
• Suppliers located in designated countries or regions, by program
• Prohibited and excluded source checks and their results
• Open findings and supplier requests by age
• Risk decisions and mitigations with their follow-up status
• Map coverage: how many tiers are known for each critical item

Features

• Multi-tier supplier map: Prime contractors and their sub-tier suppliers shown as a navigable map, with each relationship's source and date.
• Entity resolution: Supplier records from different sources matched to a single entity, with uncertain matches flagged for an analyst to confirm.
• Critical item marking: Programs mark the products and services critical to their mission, so analysis focuses where disruption would matter most.
• Country and region risk: Supplier locations compared with the countries and regions your program designates, using lists your program approves.
• Prohibited and excluded sources: Suppliers checked against the prohibition and exclusion lists your program configures, with each check and its result recorded.
• Concentration analysis: Single-source and concentrated dependencies identified for critical items, including where several primes rely on the same sub-tier supplier.
• Domestic preference review: Supplier and component information organized to support contracting officers' domestic content and country-of-origin reviews.
• Supplier information requests: Structured questionnaires and document requests sent to suppliers through a portal, with responses tracked against each finding.
• Explained findings: Every finding shows the supplier path, the criterion applied and the data source behind each step.
• Risk assessments and mitigations: Assessment records with options, the decision taken, the approver and follow-up actions tracked to completion.
• Change monitoring: When a list, data source or supplier record changes, the map is re-checked and new findings are raised for review.
• Audit trail: Every data load, match, finding, decision and export recorded with the person and time.

Integrations

• Contract writing and acquisition systems: Contracts, line items and contractor details from your agency's acquisition systems, by scheduled file or API.
• SAM.gov entity data: Public entity registration information from SAM.gov, used to identify and match suppliers.
• Commercial supplier data: Supply chain, ownership and location data from commercial providers your agency licenses, connected during implementation.
• Asset and software inventories: Hardware and software inventories, including software bills of materials where available, link products in use to the suppliers behind them.
• Supplier portal: Suppliers sign in to answer questionnaires and upload disclosures, seeing only the requests sent to them.
• Single sign-on: Agency staff sign in through your identity provider, including PIV-based authentication where your provider supports it.
• Work API: Map, finding and decision data available to your agency's risk and reporting tools through the Moraph Work API.

Deployment

• Moraph cloud, United States: Hosted in the United States region, with data kept in the US.
• Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, data source maintenance and analyst support.

Security and privacy

• Data kept in the United States: Supplier maps, findings and decisions are hosted in the United States region.
• Cleared support lane: Support tickets from federal clients are routed only to US citizens with active security clearances.
• Access by role and program: Staff see the programs and contracts they are responsible for; suppliers see only their own requests and responses.
• Encryption under controlled keys: Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization.
• Complete audit trail: Every data load, finding, decision and export is recorded with the user and time, and cannot be edited.
• Independent audits: Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Limitations

• It informs decisions; it does not make them. Sourcing, exclusion, mitigation and domestic preference determinations belong to your contracting officers and officials.
• The map is only as complete as the data behind it. Sub-tier visibility depends on supplier disclosures and the commercial data your agency licenses, and gaps are shown as gaps, not filled by assumption.
• Country, region and entity lists are configured and approved by your program. Moraph does not designate countries of concern or decide which entities are prohibited.
• It does not issue FASCSA orders, exclusion or removal decisions, or debarments; it records the information and decisions your agency makes through its own processes.
• Commercial supplier data is subject to the provider's licence terms and accuracy, and is purchased by your agency or through a separate agreement.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
• It is not designed for classified supply chain information. Classified material must be handled outside it under your agency's procedures.
• It is not a contract writing or procurement system; it works alongside your acquisition systems.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/supply-chain-mapping-and-risk-illuminator. Purchasing routes and company information: www.moraph.com/how-to-buy.