Data Loss Prevention

Moraph resells, implements and runs Forcepoint data loss prevention for banks, credit unions, lenders and investment firms. We configure Forcepoint to recognize Social Security numbers, payment card numbers and your own customer data, enforce policies on endpoints and network channels, and triage the incidents it raises so your team only handles the ones that need a decision. Forcepoint provides the platform; Moraph operates it; your organization decides the policies and what happens to people who break them.

The problem it solves

Consumer financial data leaves institutions in ordinary ways: a spreadsheet of account holders emailed to a personal address, a file of card numbers uploaded to a web form, a customer list copied to a USB drive. Many institutions own a DLP tool but run it in monitor-only mode because the policies were never tuned, the false positives overwhelm the security team, and nobody has time to review incidents. When a regulator or customer asks how sensitive data is protected in transit, the honest answer is that the tool is installed but not really used.

Who it’s for

• Banks, credit unions, lenders and investment firms that handle Social Security and payment card numbers
• CISOs and security teams who own data protection controls
• Privacy, compliance and fraud teams who decide what happens after an incident
• IT teams who deploy and maintain endpoint agents
• Internal audit and examiners reviewing safeguards for customer information

1. DiscoverBefore blocking anything, Moraph configures Forcepoint to watch the channels in scope and learn where sensitive data actually moves.
2. EnforceOnce a policy is tuned, your organization approves moving it from audit to warn or block, channel by channel.
3. TriageMoraph analysts work the incident queue, close false positives with a reason, and send real incidents to the people at your institution who decide on them.
4. ImproveEach month Moraph reviews incidents, coverage and tuning with you and proposes the next policy changes.

Social Security number detection

Forcepoint classifiers configured to find Social Security numbers in documents, email and uploads, tuned to reduce matches on numbers that only look similar.

Payment card number detection

Forcepoint detects primary account numbers using pattern matching with checksum validation, so random strings of digits are less likely to trigger.

Your own data identifiers

Account number formats, member numbers and customer files fingerprinted so Forcepoint recognizes data specific to your institution.

Endpoint enforcement

The Forcepoint endpoint agent applies policy to removable media, printing, browser uploads and other endpoint channels you choose.

Network enforcement

Policies applied to outbound email and web traffic through Forcepoint's network components or your existing gateways.

Graduated actions

Each policy can audit, warn the user, require a business justification or block, and moves between them only with your approval.

Staged rollout

Policies tested in audit mode and on pilot groups before they block anyone, with the expected impact shown first.

Managed incident triage

Moraph analysts review incidents, close false positives with a reason and escalate the rest to your reviewers.

Policy version record

Every policy, classifier and action change kept with its reason, test result and approver.

Agent coverage monitoring

Endpoints missing an agent, running an old version or not reporting are listed for your IT team to fix.

Restricted evidence access

Incident evidence, which can include the sensitive data itself, is visible only to the roles you approve.

Exam-ready reporting

Policies in force, incidents and outcomes for a chosen period, exportable for internal audit and examiners.

DLP policy owner (your organization)

Decides what data is protected and approves every move from audit to block

Compliance or privacy officer (your organization)

Decides whether escalated incidents are reportable and what follow-up is needed

Incident reviewer (your organization)

Investigates escalated incidents and records the outcome

Moraph DLP engineer

Configures and tunes Forcepoint policies and applies approved changes

Moraph security analyst

Triages incidents, closes false positives and escalates the rest

Auditor or examiner (read-only)

Reviews policies, incidents and evidence without changing anything

Your directory

User and group information from your directory so policies can apply by group and incidents show the user's department and manager.

Email gateway

Outbound email inspected by Forcepoint, either through its own components or alongside the gateway you already run.

Web proxy

Web uploads inspected through Forcepoint's web components or an existing proxy that supports content inspection.

Endpoint management

Agent packages deployed and updated through the software distribution tools your IT team already uses.

Your SIEM

DLP incidents forwarded to your security information and event management tool for correlation with other alerts.

IT service management

Escalated incidents, change requests and agent issues raised in your ticketing system.

Moraph managed services

Coordinated with Moraph's Mobile Device Management, Secure File Transfer or Public Cloud Infrastructure services where you use them, so allowed routes for sensitive data are consistent.

Single sign-on

Your reviewers sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Configuring policies, triaging incidents and seeing evidence are separate roles, granted only as you approve.

Encryption and keys

Incident data held by the service is encrypted, and Moraph staff cannot reach it without your explicit, time-bound authorization.

Complete audit trail

Every policy change, incident decision and evidence view is logged with the person and time, and cannot be edited.

Tested changes

Moraph's own configuration tooling and scripts pass security testing gates before release, and a software bill of materials is kept for them.

Data residency

Incident data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Forcepoint-hosted components

Where you use Forcepoint's hosted options, Moraph configures and runs them; Forcepoint operates the hosting.

Components on your infrastructure

Management and network components installed in your data center or cloud account, operated by Moraph under the service agreement.

Existing deployment

Where you already own Forcepoint, Moraph takes over its operation and tuning without a fresh installation.

With other Moraph services

Run alongside Moraph's Mobile Device Management, Secure File Transfer or Public Cloud Infrastructure services.

Scoping

We agree the data types, channels, users and locations in scope, and review any existing Forcepoint deployment. We need contacts from security, compliance and your endpoint team.

Platform setup

Forcepoint management components, network channel integration and directory connections are configured, or an existing deployment is taken over.

Agent rollout

Endpoint agents are packaged and tested with your IT team, then deployed in waves with coverage tracked.

Discovery in audit mode

Policies run in audit mode so legitimate data flows can be found and documented as allowed routes before anything is blocked.

Enforcement by stages

Tuned policies move to warn or block on a pilot group and then wider, each step approved by your policy owner.

Triage handover

Escalation routes, reviewer roles and runbooks are agreed, staff communications are prepared, and Moraph's analysts take over the incident queue.

• Moraph is not Forcepoint. Forcepoint's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Forcepoint's licence terms.
• DLP reduces the chance of sensitive data leaving; it cannot stop every route, such as photographs of a screen or data typed out by hand.
• Policies are only enforced on endpoints with a working agent and on network traffic routed through the inspection points.
• Encrypted or password-protected files may not be inspectable; how they are treated is a policy decision you make.
• Decisions about staff conduct, breach determination and customer or regulator notification remain with your organization.
• Mobile devices and cloud applications are outside this service unless covered by separate policy or another Moraph service.
• Moraph supports your PCI DSS and other assessments with evidence; it does not certify your environment.

• Send test messages and uploads with fictional Social Security and card numbers and see what is caught and how the user is told
• Review the audit-mode impact report for a policy before approving it to block
• Walk through an incident from detection to escalation and outcome
• Check who can see incident evidence and how that is controlled
• Review agent coverage reporting against your device inventory
• Review the responsibilities table with your third-party risk team