Working with Moraph
Who does what on a managed platform
When Moraph runs a third-party platform for you, the work is shared between Moraph, the platform’s vendor and your organization. Each managed-platform page sets out who is responsible for what. This page explains how that split works and lists all 49 of them.
Shared responsibility
How the work is shared
Clients license Moraph-built applications, have Moraph run third-party platforms for them, or both. Service levels and who is responsible for what are set in each agreement.
Moraph
Under a managed service, Moraph runs the system for you after go-live: administration, monitoring, security operations, changes, and reporting against the agreed service levels, from our follow-the-sun operations teams.
The platform’s vendor
The platform belongs to its vendor. What the vendor provides is in the vendor’s column of each platform’s table.
Your organization
Named administrators and contacts, people who can review controls, approve connections and answer for your own regulatory obligations, and decisions and sign-offs when the plan needs them.
Written into the plan
A typical proposal has a Responsibilities section: what Moraph does, what your organization provides, and the assumptions the plan depends on. Responsibilities between us are written into the plan so nothing falls between organizations.
Areas the tables cover most often
- Platform availability (45 of 49)
- Licensing (44 of 49)
- Incident response (36 of 49)
- Identity and access (29 of 49)
- Changes (25 of 49)
- Configuration (25 of 49)
- User support (25 of 49)
- Monitoring (24 of 49)
Financial Services
Financial Services: 20 managed platforms
API Security & Integration
Shared between Moraph, MuleSoft and your organization
MuleSoft provides the Anypoint Platform, Moraph builds and runs your integrations on it, and your organization owns the systems, the data and every decision about who may access them.
Areas: Licensing, Platform availability, Integration build, Security policies, Partner access, Monitoring and alerts, Incident response, Changes, Runtime updates, Core and mainframe systems
Business Continuity Planning
Shared between Moraph, Fusion Risk Management and your organization
Fusion Risk Management provides and operates the platform, Moraph configures and runs it as a service, and your organization owns the continuity program and every decision in it.
Areas: Licensing, Platform availability, Configuration, Identity and access, Data loads, Exercises and tests, Changes, Platform updates, Incident support, User support
Communication Archiving
Shared between Moraph, Smarsh and your organization
Smarsh provides and operates the archiving platform, Moraph configures and runs your use of it, and your firm makes the compliance decisions.
Areas: Licensing, Platform availability, Capture configuration, Capture monitoring, Retention and holds, Supervision policies, Access, Platform updates, Incidents, Regulatory obligations
CRM for Finance
Shared between Moraph, Salesforce and your organization
Salesforce runs the platform and Shield, Moraph configures and operates your org and holds the key material, and your institution owns the data and the decisions.
Areas: Licensing, Platform availability, Encryption keys, Key service availability, Configuration, Identity and access, Monitoring, Incident response, Releases and updates, User support
Data Loss Prevention
Shared between Moraph, Forcepoint and your organization
Forcepoint provides and supports the DLP platform, Moraph configures and runs it for you, and your organization owns the policies, the data and the decisions about people.
Areas: Licensing, Platform availability, Policy configuration, Identity and access, Agent deployment, Incident triage, Breach response, Changes, Patches and updates, User support
Database Security
Shared between Moraph, Imperva and your organization
Imperva provides the monitoring platform, Moraph implements and operates it, and your institution decides what is monitored and what happens when an alert is real.
Areas: Licensing, Platform availability, Configuration, Agents and coverage, Identity and access, Monitoring and alerts, Incident response, Changes, Patches and updates, Policy decisions
Digital Transaction Management
Shared between Moraph, DocuSign and your organization
DocuSign runs the signing platform, Moraph configures and operates your account on it, and your institution owns the documents, the disclosures and the decisions.
Areas: Licensing, Platform availability, Signing evidence, Consumer consent, Templates and configuration, Identity and access, Integrations, Incident response, Platform updates, User support
Endpoint Detection & Response
Shared between Moraph, CrowdStrike and your organization
CrowdStrike provides and operates the Falcon platform, Moraph monitors and responds on it for you, and your institution approves the rules and makes the business decisions.
Areas: Licensing, Platform availability, Sensor deployment, Policies and exclusions, Monitoring and triage, Threat hunting, Response actions, Recovery, Platform updates, Regulatory obligations
Identity Access Management
Shared between Moraph, Okta and your organization
Okta runs the platform, Moraph configures and operates your tenant on it, and your institution owns the policy decisions and its users.
Areas: Licensing, Platform availability, Configuration, Identity and access, Monitoring, Incident response, Changes, Platform updates, Policy decisions, User support
Marketing Automation
Shared between Moraph, HubSpot and your organization
HubSpot provides the platform, Moraph implements and runs it to your compliance rules, and your institution decides what is sent and to whom.
Areas: Licensing, Platform availability, Configuration, Identity and access, Content and audiences, Consent and opt-outs, Monitoring, Incident response, Changes and updates, Policy decisions
Mobile Device Management
Shared between Moraph, Microsoft and your organization
Microsoft provides and operates Intune, Moraph configures and runs it for you, and your firm decides the policies and supports its advisors.
Areas: Licensing, Platform availability, Tenant and identity, Policy configuration, Advisor onboarding, Monitoring, Selective wipe and offboarding, Changes and platform updates, Incident response, User support
Privileged Access Management
Shared between Moraph, CyberArk and your organization
CyberArk provides the platform, Moraph implements and runs it for you, and your institution keeps the decisions about who may have privileged access.
Areas: Licensing, Platform availability, Configuration, Account onboarding, Identity and access, Monitoring and alerts, Incident response, Changes, Patches and updates, Policy decisions
Public Cloud Infrastructure
Shared between Moraph, AWS and your organization
Cloud security is shared: AWS runs the cloud, Moraph runs your configuration of it under the service agreement, and your organization owns its data, its risk decisions and its applications.
Areas: Licensing and billing, Platform availability, Landing zone and guardrails, Identity and access, Monitoring, Incident response, Changes, Patching and updates, Data and encryption, Evidence and audit
Secure File Transfer
Shared between Moraph, Kiteworks and your organization
Kiteworks provides the platform, Moraph configures and runs it, and your firm decides who has access and how documents are handled.
Areas: Licensing, Platform availability, Configuration, Identity and access, Monitoring, Incident response, Patches and updates, Retention and sharing policy, User support
Security Awareness Training
Shared between Moraph, KnowBe4 and your organization
KnowBe4 provides and operates the training platform and content, Moraph runs your program on it, and your institution sets policy and owns the results.
Areas: Licensing, Platform availability, Program design, Campaign operations, Training, Identity and access, Use of results, Content and updates, Real phishing reports, Regulatory obligations
Spreadsheet Risk Control
Shared between Moraph, Apparity and your organization
Apparity provides the EUC control platform, Moraph configures and runs it with your teams, and your organization owns the policy, the files and the decisions.
Areas: Licensing, Platform availability, EUC policy, Discovery and inventory, Identity and access, Monitoring and alerts, Incident response, Changes to configuration, Updates and patches, User support
Third-Party Risk Scoring
Shared between Moraph, BitSight and your organization
BitSight provides the ratings and findings, Moraph runs the platform and the monitoring work, and your organization decides what the results mean for each vendor relationship.
Areas: Licensing, Platform availability, Ratings and findings, Portfolio setup, Identity and access, Alert monitoring, Finding follow-up, Incident response, Changes, User support
Virtual Desktop Infrastructure
Shared between Moraph, Citrix or Microsoft and your organization
The platform belongs to Citrix or Microsoft; Moraph supplies, configures and runs it for you, and your institution makes the policy decisions.
Areas: Licensing, Platform availability, Configuration, Identity and access, Monitoring, Incident response, Changes, Patches and updates, Data-transfer policy, User support
Voice Recording Compliance
Shared between Moraph, Verint and your organization
Verint provides the recording platform, Moraph configures and runs it for you, and your organization decides what is recorded and who may listen.
Areas: Licensing, Platform availability, Configuration, Recording coverage, Identity and access, Monitoring and alerts, Incident response, Changes, Updates and patches, User support
Vulnerability Management
Shared between Moraph, Tenable and your organization
Tenable provides the scanning platform, Moraph configures and runs it, and your institution fixes the findings and makes the risk decisions.
Areas: Licensing, Platform availability, Configuration, Scan credentials, Monitoring, Findings triage, Remediation, Risk decisions, Patches and updates, Incident response
Government
Government: 9 managed platforms
"Civic-Secure" Microsoft 365
Shared between Moraph, Microsoft and your organization
Microsoft provides Microsoft 365 GCC, Moraph configures and runs it for you, and your agency owns CJIS compliance and every decision about criminal justice information.
Areas: Licensing, Platform availability, CJIS agreements, Configuration, Identity and access, Monitoring, Incident response, Changes, Personnel screening, User support
DoD IL6 "Secret" Cloud Collaboration
Shared between Moraph, Microsoft and your organization
Microsoft provides the platform, Moraph administers it within the access your organization grants, and your organization keeps every authorization, security and policy decision.
Areas: Licensing, Platform availability, Authorization, Tenant configuration, Identity and access, Monitoring and incident response, Changes, Platform updates, Classification and content, User support
FedRAMP High Managed Landing Zone
Shared between Moraph, AWS or Microsoft and your organization
Moraph builds and runs the landing zone; AWS or Microsoft runs the underlying cloud under their own terms and authorizations; your agency owns its applications, data and risk decisions.
Areas: Licensing and billing, Platform availability, Configuration, Identity and access, Monitoring, Incident response, Changes, Patches and updates, Policy and risk decisions, Authorization
Mission Partner Environment (MPE) Builder
Shared between Moraph, Infrastructure and software providers and your organization
Moraph builds and runs the enclaves, the infrastructure and software providers you authorize supply the underlying components under their own terms, and your organization decides what is shared, with whom, and under whose authority.
Areas: Licensing, Infrastructure availability, Enclave templates, Partner identity and access, Disclosure and release, Monitoring, Incident response, Changes and patches, Teardown and sanitization, User support
Palantir "Gotham" Integration & Governance
Shared between Moraph, Palantir and your organization
Palantir provides and supports Gotham, Moraph builds and runs the pipelines and governance controls that feed it, and your organization owns the data, its classification and who may see it.
Areas: Licensing, Platform availability, Pipelines, Data quality rules, Classification and markings, Data model mapping, Access to data, Monitoring and incidents, Changes, User support
Satellite/Geospatial Data Lake
Shared between Moraph, Infrastructure and cloud providers and your organization
Moraph designs and runs the environment; the storage, compute and cloud services come from infrastructure providers under their own terms; your organization owns the data and the decisions about it.
Areas: Hardware, cloud services and licensing, Platform availability, Configuration, Identity and access, Monitoring, Incident response, Changes, Patches and updates, Data and policy decisions, Authorization
ServiceNow for Federal Service Management
Shared between Moraph, ServiceNow and your organization
ServiceNow provides the platform, Moraph implements and runs it for you, and your agency owns policy, approvals and the system's authorization.
Areas: Licensing, Platform availability, Configuration, Identity and access, Monitoring, Incident response, Changes, Platform upgrades and patches, Security documentation, User support
Wargaming & Simulation Sandbox
Shared between Moraph, Infrastructure and software providers and your organization
Moraph builds and runs the environments; compute, cloud and simulation software come from their providers under their own terms; your organization owns the exercises, the data and the decisions about them.
Areas: Hardware, cloud and software licensing, Platform availability, Templates and configuration, Identity and access, Monitoring, Incident response, Changes, Patches and updates, Exercise data and results, User support
Zero Trust "Black Cloud" Overlay
Shared between Moraph, Zscaler and your organization
Zscaler provides and operates the platform, Moraph designs, configures and runs it for you, and your organization owns the access decisions and the authorization of your systems.
Areas: Licensing, Platform availability, Architecture and configuration, Identity and access, App Connectors, Monitoring and alert triage, Incident response, Changes, Authorization support, User support
Healthcare
Healthcare: 20 managed platforms
Asset Tracking
Shared between Moraph, Stanley Healthcare (AeroScout) and your organization
Stanley Healthcare provides the AeroScout platform, Moraph implements and runs it for your hospital, and your hospital owns the equipment, the network it runs on and the decisions about how equipment is managed.
Areas: Licensing and hardware, Platform availability, Configuration, Wireless network, Tags and exciters, Monitoring, Incident response, Changes, Software updates, Equipment management decisions
Clinical Collaboration
Shared between Moraph, Microsoft and your organization
Microsoft provides and operates Teams, Moraph configures and runs your clinical use of it, and your organization makes the privacy and clinical decisions.
Areas: Licensing, Business associate terms, Platform availability, Configuration, Identity and access, Monitoring, Incident response, Platform updates, Policy decisions, User support
Cloud Contact Center
Shared between Moraph, Five9 and your organization
Five9 runs the platform, Moraph configures and operates your Five9 environment, and your organization owns the staff, the clinical decisions and the policy choices.
Areas: Licensing, Platform availability, Telephone numbers and carriers, Configuration, Users and access, Integrations, Monitoring and incidents, Changes and updates, Clinical decisions, Compliance decisions
Cloud Content
Shared between Moraph, Box and your organization
Box provides and supports the content platform, Moraph configures, administers and supports it for you, and your organization owns the content and the decisions about access, sharing and retention.
Areas: Licensing, Business associate agreements, Platform availability, Configuration, Identity and access, Retention and legal holds, Monitoring and incidents, Changes and updates, Migration, User support
Cloud Fax
Shared between Moraph, Consensus Cloud Solutions (eFax Corporate) and your organization
Consensus Cloud Solutions provides and operates eFax Corporate, Moraph configures it and runs the routing into your EMR, and your organization decides how documents are handled and files them to the chart.
Areas: Licensing, Platform availability, Numbers, Routing, EMR interface, Indexing and filing, Monitoring, Retention, Incidents, Regulatory obligations
Email Security
Shared between Moraph, Proofpoint and your organization
Proofpoint provides and supports the email security platform, Moraph configures and runs it for you, and your organization owns the mail system, the policies and the decisions about breaches and people.
Areas: Licensing, Platform availability, Policy configuration, Mail routing and DNS, Identity and access, Monitoring and triage, Incident response, Changes, Platform updates, User support
Enterprise Mobility
Shared between Moraph, Jamf / Workspace ONE and your organization
The platform vendor provides and operates Jamf or Workspace ONE, Moraph configures and runs your use of it, and your organization makes the policy decisions and owns the devices.
Areas: Licensing, Platform availability, Device configuration, Enrollment, Daily monitoring, Lost devices, Updates, Identity and network, Incidents, Hardware
Identity Governance
Shared between Moraph, SailPoint and your organization
SailPoint runs the platform, Moraph configures and operates your identity governance on it, and your organization decides who should have access.
Areas: Licensing, Platform availability, Configuration, Identity data, Access decisions, Monitoring, Incident response, Changes, Platform updates, Policy decisions
Integration Engine
Shared between Moraph, NextGen Healthcare or Rhapsody and your organization
NextGen Healthcare (for Mirth Connect) or Rhapsody provides the engine software, Moraph builds and runs your interfaces on it, and your organization owns the connected systems, the data and every decision about where it goes.
Areas: Licensing, Engine hosting and availability, Interface build, Access to the engine, Monitoring and alerts, Message errors, Incident response, Changes, Engine upgrades and patches, Connected systems
IT Service Management
Shared between Moraph, ServiceNow and your organization
ServiceNow provides and operates the platform, Moraph configures and runs your use of it, and your organization does the clinical engineering and IT work and makes the decisions.
Areas: Licensing, Platform availability, Configuration, Identity and access, Device inventory, Integrations and monitoring, Incident response, Upgrades and patches, Policy decisions, User support
Learning Management
Shared between Moraph, HealthStream and your organization
HealthStream provides the learning platform and its course content, Moraph configures and runs it for your compliance program, and your organization decides what training is required and acts on the results.
Areas: Licensing, Platform availability, Training requirements, Course content, HR and identity data, Monitoring, Incident response, Changes, Platform updates, Learner support
Network Access Control
Shared between Moraph, Cisco and your organization
Cisco provides Identity Services Engine and the network equipment it relies on, Moraph designs, configures and runs the access policies, and your organization owns the network, the devices and every decision to restrict them.
Areas: Licensing, Platform software, Network equipment, Access policy, Enforcement, Device classification, Monitoring and alerts, Incident response, Patches and upgrades, Exceptions
Patient Privacy Monitoring
Shared between Moraph, FairWarning and your organization
FairWarning provides and supports the monitoring platform, Moraph configures and runs it and triages its alerts, and your organization owns the investigations, findings, sanctions and breach decisions.
Areas: Licensing, Platform availability, Data feeds, Detection configuration, Identity and access, Alert triage, Sanctions and breaches, Changes, Platform updates, Patient access requests
Policy Management
Shared between Moraph, RLDatix and your organization
RLDatix provides the policy management platform, Moraph configures and runs it for your policy program, and your organization writes, approves and owns every policy.
Areas: Licensing, Platform availability, Policy content, Approval routes, Review cycles, Attestations, Identity and access, Incident response, Changes and updates, User support
Remote Patient Monitoring
Shared between Moraph, Vivify Health and your organization
Vivify Health runs the platform, Moraph configures and operates your program on it, and your organization owns the clinical, consent and billing decisions.
Areas: Licensing, Platform availability, Configuration, Devices and kits, Data feeds and EHR, Clinical monitoring, Incident response, Platform updates, Billing, Support
Secure Messaging
Shared between Moraph, TigerConnect and your organization
TigerConnect provides and operates the messaging platform, Moraph configures and runs your use of it, and your organization makes the clinical and privacy decisions.
Areas: Licensing, Business associate terms, Platform availability, Configuration, Identity and access, Interfaces, Monitoring, Incident response, Platform updates, Devices
Secure Printing
Shared between Moraph, PaperCut and your organization
PaperCut provides the software, Moraph implements and runs it for you, and your organization owns the devices, the network, the users and the privacy decisions.
Areas: Licensing, Platform availability, Configuration, Devices and badge readers, Identity and badges, Monitoring, Incident response, Changes, Software updates, Policy decisions
Single Sign-On
Shared between Moraph, Imprivata and your organization
Imprivata provides the software and its support, Moraph configures and runs your deployment, and your organization makes the access policy decisions and owns the directory and workstations.
Areas: Licensing, Platform software, Policies, Application profiles, Identity, Badges, Monitoring, Updates, Incidents, Regulatory obligations
Virtual Scribe
Shared between Moraph, Nuance (Microsoft) and your organization
Nuance runs the Dragon platform, Moraph configures and operates your organization's use of it, and your organization owns clinical, privacy and documentation decisions.
Areas: Licensing, Platform availability, Configuration, Users and access, EHR integration, Monitoring, Incident response, Platform updates, Policy decisions, User support
Visitor Management
Shared between Moraph, Envoy and your organization
Envoy runs the platform, Moraph configures and operates your entrances on it, and your organization owns the decisions about who may enter and what is recorded.
Areas: Licensing, Platform availability, Configuration, Watchlist, Devices, Access and identity, Monitoring, Incident response, Policy decisions, User support