DoD IL6 "Secret" Cloud Collaboration

Moraph helps defense organizations bring Microsoft 365 email and Teams into use in Microsoft's US government Secret cloud, and then administers the environment as a managed service. Administration is carried out by Moraph staff who are US citizens holding active clearances, working only under the access, facilities and procedures your organization authorizes. Authorization decisions, classification decisions and the platform itself stay with your authorizing official, your users and Microsoft respectively.

The problem it solves

Commercial collaboration tools are available at the Secret level, but standing them up and running them is a different job from running them on unclassified networks. Configuration has to follow the security requirements of a classified environment, every change has to go through your authorization process, and the people who administer the tenant must hold the right clearances and qualifications. Many organizations have the requirement and the licences but not enough cleared, qualified administrators to run the environment day to day.

Who it’s for

• DoD components and commands adopting Microsoft 365 at the Secret level
• Command IT leads and program offices who own the collaboration service
• Information system security managers and officers responsible for the environment
• Authorizing officials' staff who need evidence of how the environment is run
• Defense agencies supplementing their own cleared administration teams

1. OnboardMoraph works with your program office, security staff and Microsoft to bring your organization into use on the platform, following the steps your authorization process requires.
2. AdministerDay-to-day administration of email, Teams, users, groups and policies is carried out by cleared Moraph staff, within the permissions your organization grants.
3. ChangeConfiguration changes follow your change and authorization process. Moraph prepares the request and its security impact notes, and implements only what your organization approves.
4. Monitor and reviewMoraph watches service health and the alerts your organization routes to it, supports your security staff on incidents, and reviews the service with you on a regular cycle.

Cleared administration

Administration carried out by Moraph staff who are US citizens with active clearances at the level your organization requires, verified by your security office.

Classified email

Exchange Online, as available in Microsoft's Secret cloud, configured for your mailboxes, distribution groups, transport rules and retention.

Teams chat and meetings

Microsoft Teams, as available in that cloud, configured with the team, channel, meeting and external access policies your organization approves.

Configuration baseline

The approved tenant configuration documented as a baseline, checked by Moraph on a regular cycle, with any drift reported to your security staff.

Change management

Every configuration change prepared, approved through your process, implemented and verified, with the record kept for your authorization package.

User and group administration

Accounts, groups, licences and mailboxes created, changed and removed as requested through your process.

Privileged access control

Administrative roles in the platform assigned with least privilege and, where your organization enables it, time-bound elevation.

Alert triage

Alerts from the platform that your organization routes to Moraph are reviewed and passed on with context to your security operations or CSSP.

Incident support

Moraph administrators support investigations and containment actions as directed by your security staff.

Access reviews

Periodic reviews of administrative and privileged access prepared for your ISSM to certify.

Licence management

Licence counts and assignments tracked against what your organization has purchased, with changes requested through your contracting office.

Service reporting

Regular reports on requests, changes, alerts, access reviews and Microsoft service notices, for your program office and security staff.

Service owner

Owns the collaboration service for your organization, sets priorities and approves the scope of Moraph's work

ISSM or ISSO

Approves security-relevant changes, certifies access reviews and directs incident response

Moraph cleared administrator

Administers the tenant within the permissions and procedures your organization grants

Moraph service manager

Runs the service day to day, leads service reviews and is your point of contact

Site IT lead

Raises requests for their unit or site and confirms when work is complete

Assessor (read-only)

Reviews configuration evidence, change records and access reviews without changing them

Your identity and credentials

Users and Moraph administrators sign in with identities and credentials issued by your organization; Moraph does not issue or hold them.

Your ticketing system

Requests, changes and incidents are worked in your organization's ticketing system where you require it, or in Moraph's service records on the classified network you approve.

Security operations or CSSP

Alerts and incident information are passed to your security operations team or cybersecurity service provider as your procedures set.

Change board

Change requests and security impact notes are prepared in the format your change board and ISSM use.

Records management

Retention and records settings in the platform are configured to follow your records schedule as approved by your records officer.

Moraph Zero Trust overlay

Where your organization also uses Moraph's Zero Trust "Black Cloud" Overlay, administration of both is coordinated by the same service manager.

Cleared US personnel

Every ticket for this service is handled only by Moraph staff who are US citizens with active clearances, verified by your security office.

Access under your authority

Moraph administrators use credentials and access your organization issues, from facilities and networks it approves, and lose access when you remove it.

Least privilege

Administrators hold only the platform roles their work needs, with time-bound elevation where your organization enables it.

Complete audit trail

Every Moraph action is tied to a request or change record and appears in the platform's audit log.

Encryption and keys

Moraph staff cannot use client encryption keys without explicit, time-bound authorization from your organization.

US-only operations

Service operations for US government clients take place only in the United States.

Fully managed administration

Moraph's cleared staff carry out day-to-day administration of the tenant, with your organization approving changes and access.

Co-administration

Moraph administrators work alongside your own administration team, with responsibilities split as agreed in the service description.

Onboarding support only

Moraph supports configuration and onboarding, then hands day-to-day administration to your team.

Scope and baseline

We agree with your program office and ISSM which workloads, units and users are in scope, and document the configuration baseline your organization will approve.

Personnel verification

Moraph nominates administrators for your service, and your security office verifies their clearances, citizenship and qualifications before any access is granted.

Access and facilities

Your organization issues credentials and approves the facilities and networks from which Moraph staff will work.

Configuration

The tenant is configured against the approved baseline, and the evidence is recorded for your authorization package.

Procedures

Request handling, change, alert routing, incident support and access review procedures are agreed and written into the service description.

Onboarding and handover

Units and users are brought on in the order you choose, site IT leads are briefed, and the service moves into day-to-day operation.

• Moraph is not Microsoft. The platform, its features and its operation belong to Microsoft, and Microsoft's own service commitments, roadmap and outages apply.
• Licences are bought and held under Microsoft's terms and your organization's contract vehicle; Moraph resells and manages them but does not set their terms.
• Moraph does not hold or claim any authorization or accreditation for the platform or your environment. Authorization is maintained by Microsoft for the platform and by your authorizing official for your use.
• Features available in Microsoft's Secret cloud can differ from commercial Microsoft 365, and Moraph cannot add features the platform does not provide.
• Moraph staff work only under your organization's authority, with the access, credentials, facilities and networks it provides and approves.
• Moraph does not provide classified network connectivity, end-user devices or facilities.
• Moraph does not classify, mark or review content. Classification and handling decisions remain with your users and classification authorities.
• Transfers of information between networks at different classification levels are not included in this service.

• Ask how Moraph's nominated administrators' clearances and qualifications will be verified by your security office
• Review a sample change request and security impact note in the format your ISSM uses
• Check the responsibilities table against your own authorization boundary
• Walk through how an alert would move from the platform to your security operations
• Review a sample access review and decide whether your ISSM could certify it
• Confirm which administration your team will keep and which Moraph will take on