Nuclear Command & Control (NC3) Assurance Check

The NC3 Assurance Check runs scheduled, read-only integrity checks on the software and configurations of critical command and communication systems, comparing what is installed with the baseline your approving authority has signed off. It records the results of link health checks drawn from your existing monitoring and test procedures, and turns every difference into a discrepancy that a person investigates and closes. It runs entirely in your environment, under your authority.

The problem it solves

For the most critical systems, operators need confidence that the software and configurations in service are exactly the ones that were approved, and that communication paths are working. In practice, verification often relies on manual checklists, separate tools for each system type, and results recorded in logs and spreadsheets. Differences can go unnoticed between inspections, and assembling evidence for an inspection or authorization review takes weeks of effort.

Who it’s for

• System owners and operations centers responsible for critical command and communication systems
• Configuration managers who maintain approved baselines
• Information system security managers and officers
• Authorizing officials and approving authorities who sign off baselines
• Inspectors and auditors who review integrity and configuration evidence

1. BaselineConfiguration managers record the approved software and configuration baseline for each system, and the approving authority signs it off under two-person control before checks use it.
2. CheckCollectors read software, file and configuration state from each system on a schedule or on demand, without changing anything, and compare it with the signed baseline.
3. Link healthResults from your existing monitoring systems and from operator-run test procedures are brought together so the status of each communication path is recorded in one place.
4. ResolveEvery difference becomes a discrepancy that is investigated, explained and closed by a person, with the evidence kept.

Signed baselines

Approved software and configuration baselines held as data, with who prepared, verified and approved each version.

Software integrity checks

Installed software versions and file hashes compared with the approved baseline on every check.

Configuration checks

Settings compared with the approved baseline and with applicable STIG settings, with each difference listed.

Read-only collection

Collectors read state from systems and never change it; the product has no ability to send commands to the systems it checks.

Unverified is not passing

A system that could not be reached or fully read is shown as unverified, so a gap in checking is never mistaken for a pass.

Link health record

Status from your monitoring systems and results of operator test procedures, brought together for each communication path.

Discrepancy management

Every difference tracked from detection to closure, with investigation notes, cause and approval.

Two-person control

Baseline changes and discrepancy closures need a second person, and nobody approves their own work.

Change correlation

Differences linked to authorized change records, so expected changes are explained and unexplained ones stand out.

Pre-activity checks

On-demand checks before an exercise, maintenance window or critical activity, with the result recorded for the record.

Signed results

Check results are digitally signed when recorded, so later alteration can be detected.

Evidence packages

Baselines, check history, discrepancies and closures assembled for an inspection or authorization review.

Assurance operator

Runs and monitors checks, records test procedure results and opens discrepancies

Configuration manager

Prepares and verifies baselines and links authorized changes

Cybersecurity analyst

Investigates discrepancies and records their cause

ISSM or approving authority

Approves baselines and discrepancy closures, and owns the assurance results

Inspector or auditor (read-only)

Reviews baselines, results and discrepancies without changing them

System administrator

Manages users, collectors and schedules without access to approve anything

Read-only collectors

Collectors installed in your environment read software inventories, file hashes and settings using accounts with read-only rights that your administrators create.

Network and link monitoring

Status feeds from the monitoring systems you already operate, received through the interfaces they provide.

Configuration management database

System inventory and authorized change records from your configuration management and change control tools.

STIG and benchmark content

Applicable STIG content imported in standard SCAP formats, so configuration checks can include required settings.

Security monitoring

Discrepancies and suspected tampering events sent to your security monitoring or incident system.

Identity and access

Staff sign in through your identity provider with CAC, PIV or your multi-factor policy.

Software bill of materials

Component lists from Moraph's Software Bill of Materials (SBOM) Watchtower or your own SBOM tool can inform baselines.

Single sign-on

Staff sign in through your identity provider with CAC, PIV or your multi-factor policy.

Role-based access

What each person sees and does follows their role and their sites; preparing, verifying and approving a baseline are separate.

Append-only audit trail

Every check, view, decision and export is logged with the person and time, and records cannot be edited or deleted.

Encryption and keys

Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Cleared US-person support

Support tickets for defense and intelligence clients are handled only by Moraph staff who are US citizens with active clearances.

Your environment only

Operational use runs in your environment under your authority; Moraph hosting, in the United States region, is limited to unclassified evaluation with fictional data.

Your environment

Installed in your own environment, including networks operated under your authority, with Moraph providing software and support as you allow.

Disconnected installation

For isolated networks, updates and content are delivered as signed packages for your staff to verify and transfer.

Unclassified evaluation

A Moraph-hosted evaluation environment in the United States region, using fictional systems and data only.

Scoping

We work with your system owners and ISSM to agree which systems, system types and paths are in scope and what each check should cover, in the unclassified terms needed for our work.

Installation in your environment

The product and collectors are installed in your environment by your staff or by cleared Moraph staff under your authority.

Collector accounts and access

Your administrators create read-only accounts for collectors, and we confirm that collectors can read what each check needs and nothing more.

Baselines

Your configuration managers prepare the first baselines from known-good systems or approved builds, and they are verified and approved through the product.

Parallel checking

Automated checks run alongside your current manual procedures for a period you choose, and the results are compared before you rely on them.

Authorization support and training

We provide control mapping and evidence for your Risk Management Framework assessment, and train operators, analysts, configuration managers and approvers.

• It verifies; it does not control. It cannot send commands to, reconfigure or repair the systems it checks.
• No check can prove a system is uncompromised. The product compares systems with their approved baseline and records what it finds; a baseline that is itself wrong will not be detected.
• It checks only what its collectors are permitted to read. Components without a readable interface must be verified by your own procedures, and their results recorded.
• Link health depends on your existing monitoring systems and test procedures; the product records their results and does not test links itself.
• Moraph does not claim accreditation or an authorization to operate for the product. Moraph maps controls and supports your own assessment and authorization.
• Operation on classified networks takes place in your environment, under your authority and accreditation. Moraph does not hold your operational data.
• Decisions about discrepancies, escalation and response belong to your personnel and procedures.
• Remediation is out of scope; differences are fixed through your own change and maintenance processes.

• Run the unclassified evaluation environment against fictional systems and introduce a deliberate configuration difference
• Make a fictional system unreachable and confirm it shows as unverified, not passing
• Walk a baseline through preparation, verification and approval with three people
• Investigate and close a discrepancy and review the record it leaves
• Assemble an evidence package and check the result signatures
• Review the control mapping against your authorization requirements