Foreign Disclosure/Release (FDR) Workflow

The Foreign Disclosure/Release (FDR) Workflow takes requests to share information with foreign partners, checks the markings and the disclosure rules your organization configures, and routes each one to the Foreign Disclosure Officer who decides. It brings the originator, export control and other reviewers into the same record and keeps the rationale for every release or denial. The software checks and records; the disclosure decision always belongs to an authorized officer.

The problem it solves

Requests to release information to coalition partners arrive by email and in person, often close to a meeting or exercise. Foreign Disclosure Officers check classification and dissemination markings, the delegated disclosure authority, export control status and any applicable agreements largely by hand, and consult originators through separate channels. Decisions and their reasons are kept in personal files and logs, so the same question is answered differently from one office to the next, and it is hard to show later what was released, to whom and on what basis.

Who it’s for

• Foreign Disclosure Officers and their offices
• Designated and principal disclosure authorities
• Action officers and program staff who need to share information with partners
• Security managers and export control reviewers
• Inspectors and oversight staff who review disclosure programs

1. RequestAn action officer submits a request describing the information, the intended foreign recipient, the purpose and the date it is needed, with the material attached or referenced.
2. CheckThe workflow reads the markings recorded for each item and compares them with the release rules your organization has configured, flagging anything that needs closer review.
3. Review and consultThe Foreign Disclosure Officer reviews the request and the checks, consults the originator, export control and other reviewers as needed, and records every response in the request.
4. Decide and recordThe officer with the delegated authority approves, approves with conditions, or denies release, and the decision is recorded with its basis, the releasable version and any conditions.

Structured disclosure requests

One request form for the recipient, purpose, material and need date, so officers start with what they need instead of chasing it.

Marking checks

Classification and dissemination control markings recorded for each item are compared with the recipient and your configured release rules, with every flag explained.

Configurable release rules

Your disclosure office maintains the rules the workflow checks against, such as recipient groups and delegated authority by category, with each change approved and versioned.

Delegated authority routing

Each decision is routed to an officer whose recorded delegation covers the recipient and category, and escalated when it does not.

Export control flags

Material that may be subject to ITAR is flagged for export control review before release is considered.

Originator consultation

Requests to originators and original classification authorities are sent, tracked and answered inside the request record.

Precedent search

Earlier decisions on similar material and recipients can be found and compared, so similar questions are answered consistently.

Sanitization tracking

Versions prepared for release are kept with the request, with who prepared and approved each version.

Conditions of release

Handling conditions, such as restrictions on further transfer, are recorded with the decision and passed to the requester.

Disclosure log

A searchable record of every request, decision, basis and recipient, for program reporting and oversight.

Suggestions, not decisions

Where the workflow suggests a likely outcome or relevant precedent, it shows its reasons; an authorized officer makes and records every decision.

Complete audit trail

Every view, check, consultation, decision and export is recorded with the person and time.

Requester

Submits disclosure requests and sees the status and outcome of their own

Foreign Disclosure Officer

Reviews requests, consults others, and decides within their delegated authority

Disclosure authority

Decides requests above an officer's delegation and approves changes to release rules

Originator or classification authority

Answers consultations on material they originated or classified

Export control or legal reviewer

Reviews flagged material for export control and legal issues

Auditor or inspector (read-only)

Reviews requests, decisions and the audit trail without changing them

Document and records systems

Material can be referenced from your document management or records system rather than uploaded again, where your environment allows it.

Classification marking data

Markings applied by your marking or labeling tools are read where they are available in document metadata, and confirmed by the officer.

Personnel and organization data

Requesters, offices and officers from your personnel or directory system, so requests route to the right office.

Visit and assignment records

Approved foreign visits and assignments can be referenced on a request so the officer sees the context of the release.

Export control records

Export authorizations or agreements your organization records can be linked to a request for the reviewer.

Single sign-on

Users sign in through your identity provider using SAML or OpenID Connect, including certificate-based sign-in where your provider supports it.

Work API

Request and decision data available to your reporting tools through the Moraph Work API, within the environment where the workflow runs.

Records kept in the United States

For US government clients, data in Moraph's cloud is hosted only in the United States region.

Cleared support lane

Support tickets from federal and defense clients are handled only by US citizens with active security clearances.

Access by role and office

People see only the requests their role, office and consultations allow.

Encryption under controlled keys

Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, check, consultation, decision and export is logged with the person and time, and cannot be edited.

People decide

The workflow checks, flags and suggests; every disclosure decision is made and recorded by an authorized officer.

Client-operated environment

Installed in an environment your organization operates, including classified networks. Operation there is under your authority and accreditation process, and Moraph provides control documentation to support it.

Moraph cloud, United States

Hosted by Moraph in the United States region for unclassified use, such as training, evaluation and requests that involve only unclassified information.

With a managed service

Optionally supported by a Moraph managed service for administration and configuration, delivered by cleared US citizen staff under the access your organization grants.

Disclosure program review

We review your disclosure procedures, offices, delegations and recipient groups with your disclosure authority to design routing and roles.

Release rules

Your disclosure office defines the release rules and recipient groups the workflow checks against. Moraph configures them; it does not supply disclosure policy.

Environment setup

The workflow is installed in the environment your organization chooses. Installation on a classified network is carried out under your authority, by personnel you approve.

Integrations

Document, personnel and identity connections are set up and tested within that environment.

Historical comparison

Past requests your office has already decided can be run through the checks so officers can compare the flags with their own decisions before go-live.

Training and go-live

Requesters, officers, reviewers and authorities are trained on their own workflows, and offices move over in the order you choose.

• It does not make disclosure decisions. An officer with delegated authority decides every request, and the release rules are your organization's policy, not Moraph's.
• The checks are only as good as the markings recorded on the material and the rules your office configures. Unmarked or incorrectly marked material must be reviewed by the officer.
• It does not determine whether material is subject to export control. It flags material for review by your export control and legal staff.
• Moraph does not host classified information. Use with classified material happens only in environments your organization operates, under your authority.
• Moraph holds no accreditation or authorization for classified systems, and no FedRAMP or DoD impact level authorization for this product. We map controls and provide documentation to support your organization's own decision.
• It does not transfer information to foreign partners. Releasable material is passed through the channels your organization approves.
• It does not apply classification markings or replace your marking tools.
• Moraph does not supply the content of disclosure policies or agreements; your office loads and maintains the rules it applies.

• Configure a small set of your office's release rules and recipient groups in an unclassified evaluation environment
• Run past unclassified requests your office has decided through the checks and compare the flags with the actual decisions
• Have a requester submit a request and judge whether the form captures what officers need
• Send a consultation and confirm the response and its effect on the request are clear
• Test that a request above an officer's delegation is routed to the disclosure authority
• Review the disclosure log and audit trail for one request from submission to decision