Mission Partner Environment (MPE) Builder

The Mission Partner Environment (MPE) Builder is a Moraph-managed service that builds secure network enclaves from approved templates so US forces can share information with mission partners for a defined mission and period. Moraph builds and operates each enclave on infrastructure your organization authorizes, and partner access follows the disclosure decisions your foreign disclosure officers make. When the mission ends, Moraph tears the enclave down, revokes access and sanitizes storage, and records each step as evidence.

The problem it solves

Coalition and partner operations need a place where US forces and allies can work on the same information, but each enclave is often built by hand, under time pressure, with its own one-off configuration. Partner accounts accumulate, data is copied in without a clear record of what was released to whom, and when the mission ends nobody can say with confidence that every account, copy and connection has gone. The same work is repeated for the next mission with little reuse.

Who it’s for

• Combatant command and service component staff who plan partner information sharing
• Foreign disclosure officers who approve what partners may receive
• Information system security managers responsible for enclave authorization
• Network operations teams who provide connectivity to partners
• Assessors and inspectors who review partner access and teardown evidence

1. Request and approveA mission owner requests an enclave for a named mission, its partners and its period. The foreign disclosure officer records what categories of information may be shared with each partner, and the ISSM approves the template and boundary.
2. BuildMoraph builds the enclave from an approved, versioned template using infrastructure as code, so each enclave starts from the same hardened configuration and differences are recorded.
3. OperatePartners are onboarded as your organization approves them, and Moraph runs the enclave: monitoring, patching, change control and user support for the life of the mission.
4. Tear downWhen the mission owner closes the mission, Moraph revokes every partner account and connection, transfers the records your organization keeps, removes the remaining data and sanitizes storage, and records each step for your ISSM.

Approved enclave templates

Versioned, hardened templates for common partner-sharing patterns, each approved by your ISSM before use.

Infrastructure as code

Enclaves are built from code rather than by hand, so each build is repeatable and its configuration is recorded.

Disclosure-linked sharing

Sharing rules for each partner are configured from the disclosure decision your foreign disclosure officer recorded, and the decision is kept with the enclave.

Partner onboarding

Partner organizations and named users are added only after approval, with each account tied to the mission and its end date.

Mission-bound access

Every account, key and connection carries the mission's end date, and reminders go out before it is reached.

Configuration baseline

Each enclave is compared with its template baseline, and differences are reported for a decision.

Data movement records

Information moved into and out of the enclave is logged with who moved it and under which disclosure decision.

Monitoring and alert triage

Moraph watches enclave health, access and data movement, and escalates confirmed issues to your security operations team.

Controlled teardown

A teardown runbook revokes access, transfers retained records, deletes data and sanitizes storage, step by step.

Teardown evidence

Each teardown produces a record of what was revoked, transferred, deleted and sanitized, signed off by your ISSM.

Change control

Changes to a running enclave are raised, approved through your process, applied and recorded.

Enclave inventory

One view of every enclave: its mission, partners, template version, users and end date.

Mission owner

Requests the enclave, names partners and decides when the mission ends

Foreign disclosure officer

Records what each partner may receive and approves sharing rules

ISSM

Approves templates, builds, changes and teardown evidence

Partner administrator

Manages their own organization's users within what has been approved

Moraph service manager and engineers

Build, run and tear down enclaves under your approvals

Assessor or inspector (read-only)

Reviews access, disclosure and teardown records without changing anything

Your identity provider

US users sign in through your identity provider, with groups used to assign enclave roles.

Partner identity

Partner users are given enclave accounts, or federated with a partner's identity service where your ISSM approves it.

Disclosure records

Disclosure decisions are recorded in the service or referenced from the system your foreign disclosure office already uses.

Cross-domain transfer

Where information must move between enclaves or networks, transfers go through the cross-domain solution your organization has approved, including Moraph's Cross-Domain Solution (CDS) Transfer Agent.

SIEM

Enclave access, data movement and administrator events are sent to your SIEM.

IT service management

Requests, changes and incidents are tracked in your service management tool, or in Moraph's if you have none.

Records repository

Records your organization keeps from a mission are transferred to your designated repository before teardown.

Single sign-on

US users and administrators sign in through your identity provider, so your authentication policies apply.

Role-based access

What each person can see and do follows their role and the mission they belong to; partners see only their own enclave.

Encryption and keys

Enclave data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization, and keys are destroyed at teardown.

Complete audit trail

Every request, approval, build, change, data movement and teardown step is logged with the person and time.

Cleared US support staff

Tickets for federal and defense clients are handled only by US citizens with active clearances.

Your authority, your networks

Enclaves on classified networks are built and operated under your organization's authority and procedures; Moraph does not hold the authorization.

Commercial cloud in US regions

Enclaves for unclassified sharing built in the US government cloud regions your organization authorizes, with Moraph's service tooling hosted in the United States region.

Your data centers

Enclaves built on infrastructure you own or operate, with Moraph working under your access procedures.

Classified networks

Where enclaves run on classified networks, Moraph's cleared staff work under your organization's authority and procedures, scoped in the proposal.

Requirements and authority

We work with your mission owners, foreign disclosure office and ISSM to agree the sharing patterns, boundaries and approvals the service must follow.

Template design

We design and harden the enclave templates for those patterns on the infrastructure you authorize, and document them for your ISSM.

Template approval

Templates are built in a test environment, assessed by your team, and approved before any mission uses them.

Runbooks

Request, build, onboarding, change, incident and teardown runbooks are agreed, including the sanitization method for each type of storage.

Exercise

A full lifecycle is run on an exercise mission, from request to teardown evidence, before the first operational enclave.

Transition to operations

Escalation paths, reporting and service reviews are agreed, and the service moves into steady-state management.

• Moraph is not the vendor of the cloud, network or software products the enclaves are built on. Those vendors' own service commitments, roadmaps and outages apply.
• Licenses for underlying products are subject to each vendor's terms.
• Moraph does not make disclosure or release decisions. Your foreign disclosure officers decide what each partner may receive; the service configures and records what they approve.
• Moraph does not authorize enclaves. Your authorizing official makes that decision; Moraph maps controls and supplies evidence.
• Build time depends on the template, the infrastructure and your approvals, and is agreed per mission rather than guaranteed.
• Teardown removes data from the enclave's own storage. Copies a partner has legitimately taken out under an approved disclosure are governed by your agreements with that partner, not by the service.
• Connectivity to partner networks is provided by your organization and its partners; Moraph configures the enclave side.
• The service is not a cross-domain solution; information moving between classification levels uses the cross-domain solution your organization has approved.

• Pick a recent or planned partner mission and walk it through the request, build, operate and teardown steps
• Check that each sharing rule can be traced to a recorded disclosure decision
• Review a template with your ISSM against your authorization boundary
• Run an exercise teardown and review the evidence it produces
• Agree with your foreign disclosure office how decisions are recorded and referenced
• Read the responsibilities table against your existing support and network arrangements