FedRAMP High Managed Landing Zone

Moraph sets up and operates a landing zone in AWS GovCloud (US) or Azure Government: the account structure, network boundary, identity, logging and guardrails that every application in the cloud depends on, configured against the NIST SP 800-53 High baseline. Moraph maintains the boundary and patches the shared components, and documents which controls the landing zone provides so application teams know what is left for them. Your agency's authorizing official decides what operates; Moraph supports that decision with control mappings and evidence.

The problem it solves

Agencies moving to the cloud find that each application team ends up building its own network, logging and identity setup, each with its own security documentation. The result is inconsistent configurations, duplicated effort in every authorization package, and a boundary nobody fully owns. Security staff struggle to see across accounts, and application teams wait months for a compliant place to deploy.

Who it’s for

• Agency CIO and cloud program offices
• Application and product teams that deploy to the cloud
• Information system security officers and authorizing officials
• Security operations centers that need visibility across cloud accounts
• Inspectors general and auditors reviewing cloud controls

1. EstablishMoraph builds the landing zone in your agency's AWS GovCloud (US) or Azure Government organization: account or subscription structure, network hub, identity, logging and guardrails, to a baseline your ISSO approves.
2. Onboard an applicationWhen an application team needs a place to deploy, Moraph provisions an account or subscription inside the landing zone with the guardrails, network connections and logging already in place.
3. OperateMoraph monitors the shared components, maintains the boundary, patches what it manages and checks the configuration for drift, reporting each month.
4. Support authorizationThe landing zone's control implementations are documented once, so application packages can reference them rather than repeat them. Evidence is kept current for continuous monitoring.

Account and subscription structure

A multi-account or multi-subscription layout that separates shared services, security tooling and each application's environments.

Boundary protection

A network hub with controlled ingress and egress, inspection, and connections to the agency network aligned with your TIC 3.0 approach.

Federated identity

Sign-in through your agency's identity provider, including PIV, with privileged access separated and recorded.

Guardrails

Preventive policies, applied through AWS Organizations or Azure Policy, that stop accounts from disabling logging, using unapproved regions or creating public exposure without approval.

Central logging

Logs from every account collected centrally and retained to support OMB M-21-31, and forwarded to your security operations.

Encryption and key management

Encryption at rest and in transit using the cloud provider's key management services, with keys controlled by your agency.

Environment provisioning

New accounts or subscriptions for application teams created from a standard pattern, with guardrails, logging and networking already applied.

Patching of shared components

Moraph patches the landing zone's own components, such as network appliances, bastion hosts and shared tooling, on the schedule your ISSO agrees.

Drift detection

The approved configuration is checked continuously, and differences are reported and corrected through change requests.

Control inheritance documentation

Control implementation statements and a customer responsibility matrix, so application teams know which controls the landing zone provides and which remain theirs.

Cost and tagging

Tagging standards and cost reports by account, application and program, so spending can be attributed.

Backup and recovery

Backup policies for shared components and an agreed recovery approach, tested with your staff.

Cloud program lead

Owns the landing zone for the agency and approves new environments

Application team

Deploys and runs applications inside their own accounts or subscriptions

ISSO

Approves the baseline, changes and exceptions, and owns the authorization evidence

SOC analyst

Receives and investigates security events from the landing zone

Moraph cloud engineer

Builds, operates and patches the landing zone's shared components

Auditor (read-only)

Reviews configuration, access and change records

AWS GovCloud (US) or Azure Government

The landing zone is built in your agency's organization or tenant on the cloud provider, using its native account, network, policy and key management services.

Agency identity provider

Users sign in through your identity provider with PIV or other approved authenticators, and roles follow its groups.

Agency network and TIC

Connections between the landing zone and your agency network follow your TIC 3.0 architecture.

Security operations and SIEM

Logs and security events from every account forwarded to your agency's security operations tooling.

Continuous Diagnostics and Mitigation

Asset and configuration data made available to your agency's CDM tooling where your agency requires it.

Governance, risk and compliance tooling

Control implementation statements and evidence shared with your GRC tool or Moraph's FedRAMP ATO Accelerator.

Moraph Work API

Environment requests, changes, findings and service reports available to your service management tools.

Single sign-on

Users sign in through your agency's identity provider, so your authentication policies, including PIV, apply.

Role-based and privileged access

Access follows each person's role; privileged access to shared components is time-bound, approved and recorded.

Encryption and keys

Data is encrypted at rest and in transit, with keys controlled by your agency that Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every configuration change, privileged session and approval is logged with the person and time, and the logs cannot be edited.

US-only hosting and cleared staff

The landing zone runs only in US government cloud regions, and Moraph's federal work is handled by US citizens with active clearances.

Tested releases

Security testing gates every change to Moraph's templates and automation, and a software bill of materials is kept for the components Moraph supplies.

AWS GovCloud (US)

Built in your agency's AWS GovCloud (US) organization, using AWS Organizations, Control Tower or equivalent native services.

Azure Government

Built in your agency's Azure Government tenant, using management groups, Azure Policy and equivalent native services.

Both providers

Landing zones in both clouds with a common set of guardrails, logging and reporting, scoped in the proposal.

Discovery

We review your cloud agreements, network and identity architecture, existing accounts and the applications waiting to move. We need contacts from your network, identity and security teams.

Design

Account structure, network hub, TIC alignment, identity, logging and guardrails are designed and agreed with your architects and ISSO.

Build

The landing zone is built as code in your cloud organization, so its configuration is repeatable and every change is reviewable.

Control documentation

Control implementation statements and the customer responsibility matrix are written for the landing zone and reviewed with your ISSO.

First applications

One or more application teams are onboarded first, and the provisioning process is adjusted from what they find.

Assessment support and operations

We support your assessment with evidence, then move to steady-state operations with drift monitoring, patching and monthly service reviews.

• Moraph is not the cloud provider. AWS and Microsoft's own service commitments, roadmaps and outages apply, and cloud services and licences are subject to their terms.
• Moraph does not hold a FedRAMP authorization for the landing zone. The underlying cloud services carry the provider's own authorizations; your authorizing official decides whether systems built on the landing zone operate, and Moraph supports that with control mappings and evidence.
• The name refers to the FedRAMP High baseline the landing zone is configured against. How many controls an application inherits depends on the application and is set out in its customer responsibility matrix.
• Application teams remain responsible for their own workloads, code, data and the controls the matrix assigns to them, including patching their workloads unless contracted separately.
• The landing zone does not replace your security operations center; it forwards logs and events for your SOC to monitor and investigate.
• It is built only in US government cloud regions and is not intended for workloads that require a classified environment.
• Bringing existing accounts that were built differently into the landing zone may require rework, assessed account by account during discovery.
• Cost reporting depends on the provider's billing data and on application teams applying the agreed tags.

• Ask for a sample customer responsibility matrix and check it against one of your applications
• Walk through onboarding an application from request to a ready environment
• Review how drift is detected, reported and corrected, and who approves the correction
• Confirm how logs reach your SOC and what is retained
• Check the responsibilities table against your agency's operating model and your cloud agreement
• Ask your ISSO to review sample control implementation statements