and audit professionals want to see an audit trail of changes to such spreadsheets that shows who accessed them, what was modified, and when. The 2007 Microsoft Office System Products This section describes the products within the 2007 Microsoft Office system that are most relevant to compliance. Compliance solutions on the 2007 release deliver significant return on investment by using the ease-of-use and users’ familiarity with the most widely deployed desktop productivity environment. Although the 2007 release is an application suite, it is also a full-featured development platform ready to be exploited by developers. With this release you can build collaboration, workflow, knowledge management, and business process automation solutions with fewer lines of code than on other platforms. And you deliver a solution with which users are immediately comfortable and productive. In particular, the 2007 release lends itself to being a platform for powerful compliance solutions thanks to its advanced audit trail, encryption, information rights management, records and document management, and more. Description of the Products Relevant to Compliance The following describes the products in the 2007 release that are relevant to regulatory compliance. Feature-to-Compliance Mapping Product Description Feature Confidentiality Integrity Availability Procedural Auditing and Logging Microsoft Office SharePoint® Server 2007 Office SharePoint Server 2007 enables development of intelligent portals that seamlessly connects teams, and knowledge. Such portals can help people take advantage of relevant information across business processes and help them work more efficiently. An important feature is the business data catalog, which indexes data from external systems and databases, such as CRM systems, so that it can be searched by the portal search feature. Web content management (WCM) X X search X Document and records management X X X X X Auditing and logging X X X X
Records center X X X X X Information rights management () X X Document policies X X X Extensible hold and content expiration infrastructure X X Role-based targeting and security X X X Microsoft Office SharePoint Designer 2007 Office SharePoint Designer 2007 provides you with tools to create and deploy interactive solutions based on SharePoint Products and Technologies, without having to write code. You can automate business processes such as document approval, custom event notification, and other collaboration tasks by using the workflow designer feature. Custom workflows X X Custom notifications X X Custom tasks X Data aggregation and reporting X Microsoft Windows® SharePoint Services Windows SharePoint Services allows teams to create Web sites for information sharing and document collaboration, benefits that help increase individual and team productivity. By supporting such IT resources as portals, team workspaces, e-mail messaging, and presence awareness, Windows SharePoint Services enables users to locate distributed information quickly and Workflow processes X X X E-mail messages and alerts X X Content types X X X X Search X X
Microsoft Office Outlook® 2007 Office Outlook 2007 provides an integrated solution for managing your time and information, connecting across boundaries, and remaining in control of the information that reaches you. Classified X Information Rights Management () X X E-mail records management X X E-mail search X X Secure X Excel® Services Excel Services, a feature of Office SharePoint Server 2007, supports loading, calculating, and displaying Microsoft Office Excel spreadsheets in a Web browser. Users can publish spreadsheets and view them with any modern browser, without installing any software on the local client computer. This capability allows organizations to share spreadsheets without exposing sensitive business information. Spreadsheet integrity X Spreadsheet archiving and centralization X X Role-based views and access control X X Data security X Microsoft Office Project 2007 Office Project 2007 helps project managers, business managers, and planners manage schedules and resources. Office Project 2007 helps you set up projects quickly with templates, communicate project data, and track and analyze project status. Sarbanes-Oxley (SOX) templates X X ISO 9001 templates X Finance and accounting templates X
Feedback monitoring X Report preparation X Microsoft Office Forms Server 2007 Office Forms Server 2007 provides scalable, standards-based electronic forms solutions with enhanced security that can help your organization extend the reach of forms-driven business processes to anyone with a Web browser. Forms archiving and centralization X X Data validation X Microsoft Visual Studio® 2005 Tools for the Microsoft Office System Visual Studio 2005 Tools for the Microsoft Office System* is a professional development environment for individual developers building applications using the Microsoft Office System. These tools enable developers to more easily extend solutions using managed controls, and provide a more intuitive design, development, and debugging experience. Custom development and extensibility X X Architecture Overview The following figure the communication channels between the various products in the 2007 Office system.
Signature Criteria To make assurances, the content creator must digitally sign the content by using a signature that satisfies the following criteria: The digital signature is valid. Valid refers to the status of a certificate checked against a certificate authority’s database and found to be legitimate, current, and not expired or revoked. Documents signed by a valid certificate and not altered since signing are considered valid. The certificate associated with the digital signature is current (not expired). A certificate is a digital means of proving identity and authenticity. Certificates are provided by a certification authority, and like a driver's license, can expire or be revoked. The signing person or organization, known as the publisher, is trusted. Trust is an indication of whether you trust the individual or group for whom the certificate is provided. The default setting is Inherit Trust from Issuer, which means that the certificate is trusted because the issuer, usually a certificate authority, is trusted. The certificate associated with the digital signature is provided to the signing publisher by a reputable certificate authority (CA). A certificate authority (CA) is usually a commercial organization that issues digital certificates, keeps track of who is assigned to a certificate, signs certificates to verify their validity, and tracks which certificates are revoked or expired. 2007 Microsoft Office system programs detect these criteria for you and alert you if there is a problem with the digital signature. The ability to capture digital signatures by using signature lines in Office documents makes it possible for organizations to use paperless signing processes for documents such as contracts and other agreements. In the 2007 Office release, signatures “feel” like wet-ink signatures, because of the signature line: you know where to sign a paper document, and that a similar experience is now in the software. Two advantages that digital signature lines offer are that—unlike signatures on paper—they can provide a record of exactly what was signed and they allow the signature to be verified in the future. After a document has been digitally signed, it becomes read-only to prevent modifications. Extending Digital Signatures Digital signatures offer ample opportunities for extensibility and customization with the IXMLDigitalSignature API and other interfaces. For example, you can write custom code to digitally verify the signatures written with a tablet pen. You can build conditional use of
Requirements for Extensibility Opportunities to Major Regulations This table shows whether each custom coding scenario is required or applicable for each of the 8 major regulations. Item Level Audit View IM History as Records Server-Side Signing Protected Classified Client-Side Auditing SOX Required Required if related to financial reporting Required N/A Required HIPPA Applicable Applicable Applicable Required for patient information Applicable GLBA Required Applicable Applicable Applicable Required II Applicable Applicable Applicable N/A Applicable Required Required Applicable Applicable for customer communications Applicable 21 Could be Required N/A Applicable N/A Applicable DoD 5015.2 Required Applicable (might be in DoD 5015v3) N/A Applicable Applicable ISO Required for RM N/A Applicable for RM Applicable for RM