Lesson plan

Defense and intelligence mission systems (unclassified overview)

Learn how Moraph's eleven defense and intelligence products record, check and route security work, and where every decision stays with your officers and your authority.

Back to the course

Product: SCIF Access Control & Management System
Level: Practitioner
For: Users, Administrators
Total time: 2 hr 47 min
Lessons: 14 in 3 modules
Assessments: 4

Course objectives

Explain the deployment options for the defense and intelligence products and why operation on classified networks happens under your organization's authority
Describe the shared controls the products use, such as append-only records, two-person rules and scoped, time-limited auditor access
Work the everyday records in facility access, personnel security, insider threat and foreign disclosure, and name the decisions that stay with your officers
Follow a software package, a cross-domain transfer and an item of keying material through their stages and evidence
Use the accountability, edge compute, offline planning and UAV maintenance products the way they are designed, including while disconnected
Recognize what each product does not do, such as accrediting facilities, adjudicating clearances or deciding releases

Before the course

You have completed Security, privacy and compliance with Moraph, or you know how Moraph handles security and compliance in general
You work in, or support, a security, operations, logistics or IT function at a defense or intelligence organization or a cleared contractor
You know your own organization's procedures for the areas you work in

Module 1: Shared ground, facilities and people (44 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Working under your authority	Reading 10 min	Choose between the hosted, dedicated and client-operated deployment options for an unclassified or classified use Explain what Moraph does and does not claim about accreditation and authorization Recognize the controls the eleven products share, such as append-only records and two-person rules	Reading
Facility access and personnel security	Reading 13 min	Check a person in and out of a SCIF and follow a visit request from receipt to SSO decision Describe the records the PerSec Clearance Tracker keeps and who can see reported events Explain how the two products work together for roster verification Name the decisions that stay with the SSO, the accrediting official and the adjudicating authority	Reading
Insider threat analytics and foreign disclosure	Reading 13 min	Work an anomaly in Insider Threat UBA from the queue to a closure or inquiry without revealing identity early Describe the review steps a referral must pass before it is delivered Take a foreign disclosure request from submission through checks, consultation and a recorded decision Explain why both products suggest and record while authorized people decide	Reading
Module 1 knowledge check	Assessment 8 min	Check your understanding of deployment, authority and the shared controls Apply the facility, personnel, insider threat and disclosure procedures to realistic situations	5 questions · pass mark 70% · unlimited attempts

Module 2: Software, transfers and keys (59 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Checking software with SBOM Watchtower	Reading 12 min	Follow a software package from intake through decomposition, evaluation and a recorded decision Review a held package and write a recommendation an approver can act on Use continuous watch and the affected-systems search when a new vulnerability is published	Reading
Moving files with the CDS Transfer Agent	Reading 12 min	Explain what the CDS Transfer Agent inspects, removes and records for each file Submit a transfer request and fix the common reasons a request is blocked Review and second-review a transfer using the sanitization report and flagged matches Describe where the Agent sits relative to the cross-domain guard and your approvals	Reading
Accounting for keying material with CKMS	Reading 12 min	Follow keying material from receipt through issue, device load, supersession and destruction Apply two-person integrity steps and know who can confirm them Work a compromise incident from the controlling authority's direction to holder confirmations	Reading
Practical: review a held package	Practical exercise 15 min	Turn SBOM Watchtower findings into a recommendation an approver can act on Decide when conditional admission, rejection or a supplier follow-up is the right call Trace a newly vulnerable component to the systems that use it	Practical exercise with a checklist
Module 2 knowledge check	Assessment 8 min	Check your understanding of software intake, cross-domain transfer and key accounting Apply the review and two-person rules to realistic situations	5 questions · pass mark 70% · unlimited attempts

Module 3: Field operations and accountability (1 hr 4 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
The Munitions Accountability & Audit Ledger	Reading 12 min	Record issues, returns and transfers so every movement is signed for by a named person Run an inventory under separation of duties and open a discrepancy case for anything that does not match Correct a mistaken entry without editing or deleting it Keep accountability while disconnected and resolve sync conflicts	Reading
Edge nodes and offline mission planning	Reading 13 min	Follow an update bundle from build through security review, delivery, mission owner approval and verification Recognize drift and nodes that have not reported, and decide what to do about them Plan, approve and sync a plan in the Air-Gapped Mission Planning Suite without losing conflicting edits	Reading
UAV flight logs and maintenance	Reading 11 min	Log a sortie so aircraft and battery counters update correctly Take a write-up through a work order, inspection sign-off and return to service Use the readiness board and fleet holds to see which aircraft can fly	Reading
Module 3 knowledge check	Assessment 8 min	Check your understanding of accountability, edge, planning and maintenance records Apply separation of duties and offline rules to realistic situations	5 questions · pass mark 70% · unlimited attempts
Final assessment	Assessment 20 min	Show you can apply what you learned across all eleven products Judge which decisions each product supports and which stay with your officers and your authority	12 of 18 questions · pass mark 80% · 3 attempts

Completing the course

Every lesson must be completed: reading lessons are marked complete by the learner, exercises when every checklist item is confirmed, and assessments only when passed. Completing the course issues a certificate of completion with a verification code.