Supply Chain Mapping & Risk Illuminator

The Supply Chain Mapping & Risk Illuminator builds a map of an agency's suppliers and their own suppliers from contract data, supplier disclosures and the commercial data sources you choose. It shows where critical products and services depend on a single source, on suppliers in countries of concern or on unstable regions, and records the evidence behind each finding. Analysts and contracting officers use it to document risk assessments, domestic preference reviews and mitigation decisions, which stay with people.

The problem it solves

Agencies are expected to understand where their critical goods and services come from, apply domestic preference rules, and keep prohibited sources out of their supply chains. In practice, most agencies know their prime contractors well and their sub-tier suppliers hardly at all. Supplier information sits in contract files, questionnaires and spreadsheets, commercial data is bought separately by different offices, and when a supplier is named in a new prohibition or a region becomes unstable, finding which programs are exposed takes weeks of emails.

Who it’s for

• Supply chain risk management (C-SCRM) programs in federal civilian agencies
• Contracting officers and acquisition staff applying domestic preference and sourcing rules
• Program offices that own critical systems and products
• Chief information security and acquisition officers who answer for supply chain risk
• Inspectors general and auditors who review supply chain decisions

1. MapContract and supplier data is loaded and resolved into a map of suppliers, their locations and their relationships, starting from your prime contractors and extending down as disclosures and data sources allow.
2. AssessRisk criteria your program sets are applied across the map: single sources, suppliers in countries of concern, unstable regions, prohibited entities and domestic content questions, each finding with its evidence.
3. EngageWhere data is missing or a finding needs explanation, the analyst sends a structured request to the supplier and tracks the response.
4. Decide and mitigateConfirmed risks go to the people who own the decision. Contracting officers and program owners record the assessment, the mitigation chosen and its follow-up, with approval by the program lead where your procedures require it.

Multi-tier supplier map

Prime contractors and their sub-tier suppliers shown as a navigable map, with each relationship's source and date.

Entity resolution

Supplier records from different sources matched to a single entity, with uncertain matches flagged for an analyst to confirm.

Critical item marking

Programs mark the products and services critical to their mission, so analysis focuses where disruption would matter most.

Country and region risk

Supplier locations compared with the countries and regions your program designates, using lists your program approves.

Prohibited and excluded sources

Suppliers checked against the prohibition and exclusion lists your program configures, with each check and its result recorded.

Concentration analysis

Single-source and concentrated dependencies identified for critical items, including where several primes rely on the same sub-tier supplier.

Domestic preference review

Supplier and component information organized to support contracting officers' domestic content and country-of-origin reviews.

Supplier information requests

Structured questionnaires and document requests sent to suppliers through a portal, with responses tracked against each finding.

Explained findings

Every finding shows the supplier path, the criterion applied and the data source behind each step.

Risk assessments and mitigations

Assessment records with options, the decision taken, the approver and follow-up actions tracked to completion.

Change monitoring

When a list, data source or supplier record changes, the map is re-checked and new findings are raised for review.

Audit trail

Every data load, match, finding, decision and export recorded with the person and time.

Supply chain risk analyst

Builds and reviews the map, confirms or dismisses findings, and sends supplier requests

Contracting officer

Uses findings in acquisition decisions and records sourcing and mitigation decisions for their contracts

Program owner

Marks critical items for their program and owns risk decisions about them

C-SCRM program lead

Sets risk criteria and lists, approves decisions and sees the whole portfolio

Supplier contact (external)

Responds to information requests about their own organization and suppliers

Auditor or oversight reviewer (read-only)

Views the map, findings, decisions and the audit trail, with no ability to change them

Contract writing and acquisition systems

Contracts, line items and contractor details from your agency's acquisition systems, by scheduled file or API.

SAM.gov entity data

Public entity registration information from SAM.gov, used to identify and match suppliers.

Commercial supplier data

Supply chain, ownership and location data from commercial providers your agency licenses, connected during implementation.

Asset and software inventories

Hardware and software inventories, including software bills of materials where available, link products in use to the suppliers behind them.

Supplier portal

Suppliers sign in to answer questionnaires and upload disclosures, seeing only the requests sent to them.

Single sign-on

Agency staff sign in through your identity provider, including PIV-based authentication where your provider supports it.

Work API

Map, finding and decision data available to your agency's risk and reporting tools through the Moraph Work API.

Data kept in the United States

Supplier maps, findings and decisions are hosted in the United States region.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Access by role and program

Staff see the programs and contracts they are responsible for; suppliers see only their own requests and responses.

Encryption under controlled keys

Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every data load, finding, decision and export is recorded with the user and time, and cannot be edited.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Moraph cloud, United States

Hosted in the United States region, with data kept in the US.

Dedicated environment

A single-tenant environment for agencies that require isolation, scoped in the proposal.

With a managed service

Optionally run alongside a Moraph managed service for administration, data source maintenance and analyst support.

Scope and critical items

We agree with your C-SCRM lead which programs, contracts and critical items are in scope first.

Data integration

Connections to your acquisition systems and the data sources you choose are built and tested. We need data extracts and a contact from each system's team.

Risk criteria and lists

Your program defines and approves the country, region, prohibition and concentration criteria, and the lists they use, with their sources documented.

Initial map and review

The first map is built and reviewed with analysts, uncertain entity matches are confirmed, and initial findings are triaged.

Workflow, roles and supplier portal

Assessment steps, approvers, roles and supplier questionnaires are configured to match your procedures.

Training and go-live

Analysts, contracting officers, program owners and approvers are trained on their own workflows, and supplier contacts receive instructions for the portal.

• It informs decisions; it does not make them. Sourcing, exclusion, mitigation and domestic preference determinations belong to your contracting officers and officials.
• The map is only as complete as the data behind it. Sub-tier visibility depends on supplier disclosures and the commercial data your agency licenses, and gaps are shown as gaps, not filled by assumption.
• Country, region and entity lists are configured and approved by your program. Moraph does not designate countries of concern or decide which entities are prohibited.
• It does not issue FASCSA orders, exclusion or removal decisions, or debarments; it records the information and decisions your agency makes through its own processes.
• Commercial supplier data is subject to the provider's licence terms and accuracy, and is purchased by your agency or through a separate agreement.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
• It is not designed for classified supply chain information. Classified material must be handled outside it under your agency's procedures.
• It is not a contract writing or procurement system; it works alongside your acquisition systems.

• Load contract data for a few critical items and check how the prime contractors and their suppliers are resolved
• Review uncertain entity matches and judge whether the explanations are enough to confirm them
• Add a test entry to a designated list and see which findings it raises and how quickly analysts can trace them
• Send a sample information request through the supplier portal and review the response flow
• Walk a finding through assessment, mitigation and approval
• Confirm role separation: who can change lists, who can decide, and what suppliers can see