ServiceNow for Federal Service Management

Moraph resells, implements and runs ServiceNow as a managed service for federal civilian agencies, with a service portal and request workflows configured for federal needs such as PIV credential support and classified-network token requests. ServiceNow provides the platform; Moraph configures it, migrates you from your legacy ticketing system, and operates it day to day. Your agency keeps the decisions on policy, approvals and who gets access.

The problem it solves

Many agency help desks still run on ticketing systems that were built for a different era: separate queues for each bureau, email and phone as the main way in, and federal-specific requests such as PIV card problems handled through workarounds and paper forms. Employees do not know where to go, requests bounce between groups, and the agency cannot see how long things take. Moving to a modern platform is attractive, but configuring it for federal workflows, keeping it documented for the agency's authorization, and running it well takes skills many IT shops do not have spare.

Who it’s for

• Agency CIO offices replacing a legacy IT ticketing system
• Federal service desk managers and their contracted help desk teams
• Credentialing and identity offices that handle PIV and token requests
• Information system security officers who maintain the system's authorization
• Bureau IT leads who need a shared service portal across components

1. RequestEmployees and contractors use one service portal to report a problem or ask for something, choosing from a catalog configured for the agency's services, including federal items such as PIV credential support and classified-network token requests.
2. FulfillServiceNow routes each request through the approvals and tasks the agency defined, so the service desk, the credentialing office and other fulfillment groups each see only their part.
3. OperateMoraph runs the instance as a managed service: monitoring platform health and integrations, triaging alerts, handling the agency's change requests, and keeping configuration aligned with the agreed baseline.
4. GovernThe agency stays in control of policy and access. Moraph reports on service performance each month, supports access reviews, and keeps control documentation current for the agency's own authorization.

Unified service portal

One place for employees and contractors to ask for help, find answers and follow their requests, configured with the agency's branding and services.

Federal service catalog

Catalog items for common federal requests such as PIV PIN resets and certificate updates, replacement credentials, and classified-network token requests, each with the questions and approvals the agency sets.

Incident management

ServiceNow tracks reported problems from first contact to resolution, with assignment, priority and escalation rules configured for the agency's support model.

Request fulfillment

Multi-step requests are broken into tasks for each fulfillment group, so the service desk, credentialing office and field support each work their own step.

PIV sign-in

Employees sign in with their PIV card through the agency's identity provider, so the portal follows the agency's existing credential policy.

Knowledge base

Articles written and approved by the agency's support teams are shown in the portal and to agents as they work a ticket.

Multi-bureau structure

Bureaus and components can share one portal while keeping their own queues, fulfillment groups and reporting.

Legacy migration

Open tickets, users, groups and knowledge from the legacy system are mapped and moved, or closed out in the old system by agreement.

Configuration baseline

Moraph keeps a documented baseline of the instance's configuration and checks the live instance against it.

Managed change control

Agency requests for new catalog items, workflows or fields go through estimate, agency approval, testing and scheduled release.

Control documentation

Moraph maps the agency-configured settings to NIST SP 800-53 controls and keeps the descriptions current to support the agency's authorization.

Service reporting

Dashboards and a monthly service review show volumes, backlog, time to resolve and request types by bureau.

Requester

Employee or contractor who reports problems and makes requests through the portal

Service desk agent

Works incidents and requests, resolves what it can and routes the rest

Fulfillment group member

Completes assigned tasks such as credential actions or equipment delivery

Agency service owner

Owns the service, approves changes and sets policy, priorities and access

Moraph service engineer

Operates and configures the instance under the agency's approved changes

Auditor or assessor (read-only)

Reviews tickets, configuration evidence and logs without changing anything

Agency identity provider

Users sign in through the agency's identity provider with PIV, and roles can follow its groups (SAML or OpenID Connect).

Directory and HR data

User records, organization, supervisor and location from the agency directory or HR feed, so approvals and routing know who reports to whom.

Credentialing system

Where the agency's credential management system offers an interface, request details can be passed to it and status returned; otherwise the credentialing office records the outcome in the task.

Endpoint and asset tools

Hardware and software inventory from the agency's endpoint management tools, so agents see the device behind a ticket.

Monitoring and alerting

Events from the agency's monitoring tools can create incidents automatically under rules the agency approves.

Email and phone

Inbound email creates or updates tickets, and the agency's contact center platform can open tickets for calls.

Legacy ticketing system

A one-time migration of open tickets, history the agency chooses to keep, users, groups and knowledge.

Agency data warehouse

Ticket and request data exported to the agency's reporting environment for analysis alongside other IT data.

PIV sign-in

Users sign in through the agency's identity provider with their PIV card, so the agency's credential and multi-factor policies apply.

Role-based access

What each person can see and do follows their role and group; fulfillment groups see only the tasks routed to them.

Cleared US-person support

Federal support tickets are handled only by Moraph staff who are US citizens with active clearances, and Moraph's access to the instance is logged.

Encryption and keys

Data is encrypted using the ServiceNow platform's encryption, and Moraph staff cannot access agency data without explicit, time-bound authorization from the agency.

Complete audit trail

Changes to tickets, configuration and access are logged with the person and time, and the logs are available to the agency's assessors.

US-only hosting

The instance runs in a ServiceNow US government cloud offering selected with the agency, and Moraph's operations for it stay in the United States.

ServiceNow US government cloud

The instance runs in a ServiceNow US government cloud offering chosen with the agency, with Moraph operating it from the United States.

Multi-bureau instance

One instance shared by several bureaus or components, each with its own queues, catalog items and reporting.

Existing ServiceNow instance

Where the agency already licenses ServiceNow, Moraph can take over configuration and operation of that instance after an assessment.

Discovery

We review your current ticketing system, support model, bureaus and federal request types, and agree what the first release includes.

Licensing and instance setup

Moraph arranges the ServiceNow subscriptions you choose and sets up production and non-production instances in a US government cloud offering selected with you.

Design and configuration

Portal, catalog, workflows, approvals, assignment rules and roles are configured to your procedures and recorded in the configuration baseline.

Integrations

Identity provider, directory, endpoint and other integrations are built and tested. We need contacts from your identity, directory and network teams.

Migration and cutover

Open tickets, users, groups and knowledge are migrated, and the legacy system is retired or kept read-only by agreement.

Documentation and handover to operations

Control descriptions are written for your authorization package, agents and fulfillment groups are trained, and the instance moves into Moraph's managed service.

• Moraph is not ServiceNow. ServiceNow's own service commitments, release schedule, roadmap and outages apply to the platform.
• Licences are subject to ServiceNow's terms, which Moraph cannot change.
• Moraph does not issue PIV credentials or classified-network tokens. Those actions remain with the agency's credentialing and issuing offices, which record their outcomes in the workflow.
• The instance is for unclassified information only. Classified details must not be entered in tickets; classified-network requests carry only the unclassified information needed to route them.
• Moraph does not grant or hold an authorization to operate for the agency. Moraph maps controls and provides evidence; the agency's authorizing official makes the risk decision.
• Moraph does not staff the agency's tier 1 service desk under this service unless that is contracted separately.
• Configuration changes follow the agreed change process; Moraph does not release changes the agency has not approved.
• Integrations depend on interfaces the agency's other systems provide. Where a system has no interface, the step is recorded manually.

• Walk a PIV PIN reset request from the portal through to the credentialing office and back to the requester
• Check that fulfillment groups see only the tasks routed to them
• Review a sample configuration baseline entry and the matching control description
• Follow a change request from submission to release and review the evidence it leaves
• Review a sample monthly service review and the responsibilities table with your contracting officer
• Test PIV sign-in through your identity provider in a demonstration instance