Cross-Domain Solution (CDS) Transfer Agent

The CDS Transfer Agent is a software guard component that inspects and sanitizes files moving between networks of different security levels. It verifies each file's true type, removes macros, embedded objects, hidden content and metadata, rebuilds documents and images from their visible content, and routes transfers that need a person's review to a trained reviewer. Every transfer keeps a record of what was received, what was removed, who reviewed it and what was released, under the cross-domain approval your organization holds.

The problem it solves

Mission work depends on moving files between networks: imagery, reports, software updates and orders moving from lower to higher networks, and approved releases moving the other way. Each transfer carries risk. Malware can ride in on a document macro or an embedded object, and sensitive information can leak out in hidden text, tracked changes, metadata or content concealed in images. Manual transfer processes depend on removable media and individual diligence, reviewers lack consistent tools, and the record of what moved, when and why is often incomplete.

Who it’s for

• Cross-domain and network operations teams in defense and intelligence organizations
• Information system security managers and officers responsible for transfer paths
• Data transfer officers and trained human reviewers who approve releases
• Mission users who need files moved between networks to do their work
• Assessors and security staff who audit cross-domain transfers

1. RequestA user submits files for transfer on the source network, naming the destination, the purpose and any classification or release markings. The request follows the transfer path and rules your organization has approved.
2. InspectEach file is checked against the rules for its path. The Agent verifies the true file type from its content rather than its name, unpacks archives, and scans with the malware engines your organization provides.
3. SanitizePermitted files are rebuilt from their visible content. Macros, scripts, embedded objects, hidden text, comments, tracked changes and metadata are removed, and images are re-encoded to strip data hidden in them. A report lists what was removed from each file.
4. Review and releaseWhere your rules require it, such as for transfers to a lower network, a trained reviewer examines the sanitized files and the automated keyword and marking checks before release. A second person approves where your procedures require two-person review.

True type verification

Each file's type is identified from its content, and files whose content does not match their name or declared type are blocked.

Content disarm and reconstruction

Office documents, PDFs and images are rebuilt from their visible content, leaving behind macros, scripts, embedded objects and other active content.

Metadata and hidden content removal

Author names, revision history, comments, tracked changes, hidden text and hidden sheets are removed and listed in the sanitization report.

Image re-encoding

Images are decoded and re-encoded, which strips metadata and disrupts data hidden in the original file's encoding.

Path rules

Each approved transfer path has its own permitted directions, file types, sizes and review requirements, set and changed only by authorized staff.

Malware scanning

Files are scanned with the malware engines your organization licenses and maintains, and results are kept with the transfer record.

Keyword and marking checks

Content is checked against the keyword lists and marking rules your security office maintains, and matches are highlighted for the reviewer.

Human review queue

Reviewers see the sanitized files, what was removed and the results of every check side by side, and record their decision.

Two-person review

Paths can require a second reviewer, and nobody can approve a transfer they requested.

Archive handling

Archives are unpacked and each file inside is inspected and sanitized on its own; nested archives beyond the depth your rules allow are blocked.

Sanitization reports

Every file has a report of what was found, removed or changed, available to the requester, reviewer and auditors.

Complete transfer record

Each transfer keeps the original file's hash, the released file's hash, the checks run, the reviewers and the times, for audit.

Requester

Submits files for transfer on an approved path and sees the status and reports for their own requests

Reviewer

Examines sanitized files and check results and approves or rejects releases

Second reviewer

Provides the second approval on paths that require two-person review

Security officer

Owns transfer paths and rules, keyword lists and reviewer appointments

Auditor (read-only)

Views transfer records, reports and the audit trail without changing them

Administrator

Manages users, connections and the system without access to transfer content

Source and destination networks

Connects to the file shares, transfer folders or applications on each side of an approved path, configured to your cross-domain architecture.

Cross-domain guard

Works within the transfer path your organization has approved, alongside the cross-domain guard or data diode that enforces the boundary.

Malware engines

Uses the antivirus and malware scanning engines your organization licenses, with signature updates loaded through your approved process.

Keyword and marking lists

Keyword lists and marking rules maintained by your security office are loaded and versioned.

Single sign-on

Users sign in through the identity provider on each network, including smart-card authentication where your provider supports it.

Security monitoring

Transfer events, blocks and review decisions are sent to your security information and event management system.

Work API

Transfer records and statistics are available to your reporting tools through the Moraph Work API on the network where they are held.

Single sign-on

Users sign in through your identity provider, so your authentication and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; requesting a transfer is separate from approving it.

No execution

Files are parsed and rebuilt, never opened in their native applications or executed during inspection.

Encryption and keys

Files at rest and in transit are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every request, inspection, removal, review and release is logged with the person and time, and cannot be edited.

Your authority, cleared support

On classified networks the Agent is installed and operated under your authority. Support tickets for defense and intelligence clients are handled only by US citizens with active clearances.

Client-hosted across domains

Installed in your environment on each side of an approved transfer path, operated under your authority and within your cross-domain approval.

Unclassified boundary

For files entering an unclassified network from the internet or from partners, available hosted in Moraph's United States region.

With a managed service

Optionally supported by a Moraph managed service for rule maintenance and administration, with staff who hold the clearances your environment requires.

Path design

We work with your cross-domain and security staff to document each transfer path, its direction, permitted file types and review requirements, within the architecture your organization has approved.

Sanitization rules

Sanitization settings are configured for each file type and path, and tested with sample files your team provides.

Checks and lists

Your malware engines, keyword lists and marking rules are connected and their update process agreed.

Reviewer setup

Reviewer appointments, two-person rules and review queues are configured to match your procedures.

Authorization support

We provide control mappings, design documentation and test evidence to support your organization's cross-domain approval and authorization.

Training and go-live

Requesters, reviewers and security officers are trained on their own workflows, and each path is enabled once your organization has approved it.

• Moraph does not claim that the Transfer Agent is listed on the NCDSMO Baseline or accredited for any classified environment. Using it on a path between classification levels requires your organization's own cross-domain approval and authorization.
• It is a software sanitization and review component. It does not replace the cross-domain guard, data diode or network controls that enforce the boundary.
• Sanitization reduces risk but cannot guarantee that every hidden channel is removed. Data concealed in the visible content of an image or document can survive re-encoding, which is why human review remains part of the process.
• File types outside the supported list are blocked rather than passed through; formats that cannot be rebuilt cannot be sanitized.
• Malware detection depends on the engines your organization provides and how current their signatures are.
• Keyword and marking checks support reviewers; they do not make classification or release decisions. Those remain with your trained reviewers and security officers.
• Rebuilt documents may lose features such as macros, form logic, embedded media and some formatting, by design.
• Encrypted or password-protected files cannot be inspected and are blocked unless your rules provide another route.

• Run a set of your own unclassified sample files through the Agent and review the sanitization reports
• Submit a file renamed to look like a different type and confirm it is blocked with the reason recorded
• Submit a document with macros, tracked changes and hidden text and compare the original with the rebuilt file
• Work a high-to-low request through two-person review and check nobody can approve their own request
• Change a path rule and confirm the change and its approver are recorded
• Review the control mappings and documentation against what your cross-domain approval process requires