Look Before You Leap into Google Apps. WORLDWIDE PUBLIC SECTOR SUPPLEMENT microsoft.com/realimpact

Transcription

1 Look Before You Leap into Google Apps WORLDWIDE PUBLIC SECTOR SUPPLEMENT microsoft.com/realimpact

2 EXECUTIVE SUMMARY PUBLISHED FEBRUARY 2012 Public Sector organizations have specific requirements that must be taken into consideration when evaluating cloud computing solutions. These include accessibility, records retention, archiving, and security requirements that need to comply with local and regional regulations as well as support improved services for citizens. Microsoft Office 365 provides the right set of tools for productivity and collaboration with appropriate layers of security and compliance technologies. In comparison, Google Apps may not be an enterprise-ready solution and may not meet Public Sector requirements without costly add-on applications. This white paper, a supplement to the Look Before You Leap Into Google Apps white paper, which describes the major hidden cost areas associated with Google Apps, will help you evaluate a cloud computing solution for productivity, messaging, and collaboration in light of the specific concerns of the Public Sector. UNIQUE CONSIDERATIONS FOR PUBLIC SECTOR ORGANIZATIONS Public Sector organizations around the world are looking for transformative ways to serve their citizens and spur economic growth and opportunity. The challenges of the Public Sector are growing more complex, with the impact of globalization on economies and the Earth, evolving security threats, and the need to provide accessible education, healthcare, and other vital services to growing populations. With ongoing global economic pressures, Public Sector organizations have to address these challenges, and create jobs and opportunity, with shrinking financial resources. In addition, organizations must meet increased expectations of citizens for higher standards of service, provide greater transparency, and be fiscally responsible to their constituents. As a result, Public Sector organizations are turning to technology to increase productivity, reduce costs, and help communicate and engage with the communities they serve. Cloud computing has emerged as a viable and cost-effective technology solution for the Public Sector. Many organizations are looking at moving their productivity tools and services to the cloud to reduce costs, decrease the burden on information and communication technology (ICT) staff, and improve the user experience. Moving productivity tools and services to the cloud, at a controlled pace that makes sense for your organization, gives you the flexibility and capabilities you need to meet your objectives. And using a subscription service helps relieve you of the expense of maintaining software and hardware on-premises. Office 365 combines the familiar Microsoft Office applications your organization uses every day with cloud-based versions of Microsoft communication and collaboration services Microsoft Exchange Online, Microsoft SharePoint Online, and Microsoft Lync Online. With Office 365, you can extend the suite of applications seamlessly from the desktop to the web 1 and even to mobile devices 2 to empower telework and deskless workers, ensure continuity of operations, help improve security, and manage compliance. As you consider the move to cloud computing, you may be evaluating other offerings. Google Apps might seem like an acceptable solution but the unique requirements of Public Sector organizations for accessibility, records retention, archiving, and security may require enterprise-grade products such as Microsoft Exchange Server and Microsoft Office. With a careful review of key issues, which includes answering the questions presented in the sections below, you should have a better understanding of how your cloud computing solution can address the specific concerns of your Public Sector organization. 2 microsoft.com/realimpact February 2012

3 ACCESSIBILITY Accessibility enables people of all abilities to realize their full potential. Microsoft creates technology that is accessible to people around the world. Office 365 extends our commitment to making productivity and collaboration products available to people with disabilities, as well as to helping users create more accessible content. For Public Sector organizations, providing an accessible computing environment is just as important for inclusion as making a facility physically accessible. In contrast, the web-only architecture of Google Apps may significantly limit accessibility features, making it more difficult for Public Sector organizations to achieve their goals for digital inclusion. Microsoft provides a superior experience for accessibility, with rich applications and advanced accessibility features such as Accessibility Checker in Office 2010, which helps all users create accessible content. The Windows operating system also benefits Office and many other Microsoft products. For example, with Windows Internet Explorer, users can view Office 365 pages in high-contrast mode to make them easier to read. With Alt tags, users can place a cursor over an image in Office 365 pages to make a text description of the image appear for use with screen readers or other assistive technologies. With Outlook Web App, users with visual impairments can turn on the blind and low vision setting to access , calendar, and contacts, and Office Web App provides support for assistive technologies such as screen readers and speech recognition. For additional information, visit the Microsoft Accessibility website. One of the most widely accepted international standards for accessibility is the Web Content Accessibility Guidelines 2.0 (WCAG 2.0), which is published by the World Wide Web Consortium (W3C), an industry consortium that develops web standards. Many governments and organizations also publish guidelines on how to create accessible applications, but most of them derive from WCAG. Microsoft is a sponsor of the W3C s Web Accessibility Initiative and is helping implement key technology standards for accessibility, contributing to the development of new standards, and working to improve existing standards. In SharePoint 2010 and SharePoint Online, Microsoft conforms with Level AA of WCAG 2.0 for the general end user interface and has published statements on conformance with the accessibility standard. Google programs hard for blind students The National Federation of the Blind (NFB) in the United States requested a Justice Department investigation into the use of Gmail and other Google programs by two universities, saying that requiring students to use them violates the Americans with Disabilities Act because they are not accessible to blind students. Read the NFB press release Microsoft collaborates and communicates with governments around the world to promote principles that we believe lie at the core of successful e-accessibility policy frameworks and underpin the development and implementation of accessible technologies. To increase accessibility awareness and expertise, Microsoft published Microsoft Accessibility Tools and Training, an online package of free training courses for developers and guidance on using technology to mitigate the effects of many disabilities. These tools were recognized in October 2010 by the U.S. Federal Communications Commission with a Chairman s Award for Advancement in Accessibility. 3 microsoft.com/realimpact February 2012

4 When evaluating solutions for productivity, messaging, and collaboration in your Public Sector organization, consider asking your technology providers the following questions about accessibility. questions to ask about accessibility ACCESSIBILITY CONCERNS How do accessibility features in the solution help organizations meet the requirements of the accessibility laws and regulations in their areas? What capabilities does the product have to help those with disabilities perform their tasks? QUESTIONS TO ASK Will the provider share documentation describing how accessibility features in the solution help our organization meet accessibility requirements? What third-party tools may be needed to enable accessibility and what are the costs of those tools? What are our organizational obligations and goals around accessibility? What limitations or features help our various populations? RECORDS RETENTION Public Sector organizations face unique challenges in retaining records and ensuring the fidelity of archived content so they can respond to public inquiries and meet compliance mandates. Documents, files, s, instant messaging chats, and the metadata associated with this content may all be considered government records in many countries. Failure to meet records retention requirements can lead to penalties for noncompliance, loss of public confidence, and in some cases, even national security risk. The importance of public records is reinforced by records retention laws around the world. In 2001, the European Commission published the Model Requirements for the Management of Electronic Records (MoReq), which was updated and extended with MoReq2 in 2008 and MoReq These requirements help organizations evaluate, test, and procure electronic records management systems. In Australia, the Victorian Electronic Records Strategy (VERS) provides a framework of standards, guidance, training, consultancy, and implementation with the goal of reliably and authentically archiving electronic records. 4 In the United States, the Federal Records Act, the E-Government Act of , and the implementing regulations issued by the National Archives and Records Administration (NARA) require that all government records must be maintained in a way that retains their functionality and integrity. Additionally, some U.S. state and local laws require that records be retained in their original format for a minimum time period. Office 365 plans with Office Professional Plus include Office 2010 and SharePoint Online modules that provide functionality to help customers and partners build solutions that comply with these worldwide records retention standards. When evaluating solutions for productivity, messaging, and collaboration in your Public Sector organization, consider asking your technology providers the following questions about records retention. 4 microsoft.com/realimpact February 2012

5 questions to ask about records retention RECORDS RETENTION CONCERNS Does the solution ensure accurate representation of the facts to which the record attests? How does the solution protect against unauthorized use or alteration of the record? Will the solution maintain the physical and logical format of the records, and the relationships between the data elements? Will the solution enable the transfer of records, including their associated metadata, to new storage media or formats? QUESTIONS TO ASK Are the essential elements of content retained, including electronic signatures and page numbers? If users delete s does a record still exist of the ? How can an organization maintain proof that deleted existed? How is the format translated or transformed when uploading from, or downloading to common/standard document formats such as.doc or.pdf? Is metadata retained when uploading or downloading to documents? Does the transfer of records create breaks in content that commonly result in core data and format loss? Microsoft supports records management with Office 2010, SharePoint Online, and Exchange Online. These solutions help organizations improve document fidelity and functionality while enhancing the ability to meet compliance measures with features such as document types, retention policies, and automatic content sorting. Specifically, SharePoint Online for Enterprises has built-in records management tools to apply retention schedules, declare records, and place legal holds, whether your organization is dealing with traditional content, web content, or social content. 6 Exchange Online comes with advanced archiving capabilities and an immutable database. 7 Microsoft solutions also support enhanced document fidelity when files move from the desktop to the web or to a mobile device. In contrast, Google Apps may not support the level of document fidelity required by your organization s records retention policies. For example, commonly used Microsoft Word features such as watermarks, tables of contents, headers and footers, page numbers, tables, and formatting can be lost when converting a Word document to Google Docs. 5 microsoft.com/realimpact February 2012

6 ARCHIVING messages and their metadata are also considered records in most countries and jurisdictions. contains much of the information organizations use daily, making the ability to easily preserve and search this information essential. Microsoft Office 365 offers search, archiving, and compliance features for Public Sector organizations. 8 With role-based access control in Exchange Online, administrators can grant users such as records managers, compliance officers, and legal professionals specific rights to perform multi-mailbox searches and other rolespecific tasks. Retention policies can be used to apply settings to specific items, conversations, or folders in a mailbox. Public Sector organizations may also require that records data, including , remain within specific geographic boundaries or reside in servers where the operation and maintenance are subject to the laws of a specific country. For example, the European Union Model Clauses put limitations on the transfer or movement of organizational data outside European Union member countries. To meet these requirements, Microsoft has signed the European Union Model Clauses and, additionally, provides a data-processing agreement for customers to help meet these requirements. We are also self-certified to the European Union/United States Safe Harbor framework, which provides a means to help U.S. organizations comply with the European Commission s Directive on Data Protection. This certification means that Office 365, if needed, can transfer data from the European Union to the United States for processing. 9 As quoted by the IDG News Service, Stephen McGibbons, Microsoft Chief Technology Officer for the Europe, Middle East, and Africa region says, We want to make sure that customers using our cloud services can demonstrate that they're complying with their regulation responsibilities, and we also want to make it easier for customers to move to the cloud quickly. The Office 365 Trust Center provides detailed information related to privacy, security, and compliance practices for customers and partners worldwide. Through our Trust Center, we provide information about where our services store and process data 10 and the logic used to determine that. We offer clear information on who can access Office 365 customer data 11 and under what circumstances. And we describe our role in helping organizations comply with regulatory needs. 12 St. Augustine Beach deploys cloud-based using Microsoft Office 365 One of the reasons that we were looking for a different solution was to meet records retention requirements from state and local authorities. We retain the majority of our records for a year. Some messages are kept for up to 10 years. Others require permanent retention. We have a really diverse amount of retention requirements that we have to comply with. Anthony Johns, IT Specialist City of St. Augustine Beach, United States Office 365 Trust Center The Office 365 Trust Center provides in-depth information about Office 365 privacy and security practices. Because Microsoft appreciates the trust customers place in Office 365 to manage valuable data, Microsoft strives to provide as much information as possible about how customer information is handled. The Trust Center provides information to help customers understand and assess Microsoft practices for handling and securing data on Office microsoft.com/realimpact February 2012

7 The United Arab Emirates University (UAEU) recently replaced its system with Microsoft Exchange Server 2007 for on-campus users and after considering Google Apps for Education it chose Microsoft a cloud service, for its alumni accounts. One reason the university decided to deploy was the lack of calendar-sharing interoperability between Google Apps for Education and Exchange Server The Google service was also not as compatible as Exchange Server 2007 with the electronic discovery, auditing, and other legal requirements with which UAEU must comply. 13 When evaluating solutions for productivity, messaging, and collaboration in your Public Sector organization, consider asking your technology providers the following questions about archiving. ARCHIVING CONCERNS Does the solution offer enterprise-class information rights protection? Does the provider guarantee archiving and backup are located within specific geographic boundaries? QUESTIONS TO ASK In addition to encryption of and attachments, does the solution offer the ability to restrict the rights of recipients to forward, copy, print, or reply? With the web-only architecture of the solution, is data stored across distributed servers around the world? What guarantee is provided for locationspecific data storage? questions to ask about archiving Is rich content archived in its original format? How does the web-only architecture of the solution limit formatting options? Do calendar archives record mandatory and optional attendee lists from appointments? Does the solution retain all attachments, including those in calendar appointments? Will users retain the ability to select and use Rich Text Format, HTML format, and Plain Text format for messages? Does the solution allow distinction between mandatory and optional attendees in calendar appointments? How are mandatory and optional attendee lists recorded in calendar archives? Does spam filtering block attachments, whether in or in appointments, preventing the archiving of attachments? Do scheduled appointments with attachments make attachments available to all users, regardless of the system being used? Does the solution offer the ability to provide delivery and read receipts? If the solution does not provide delivery or read receipts, how will archives retain information about whether s were received or read? 7 microsoft.com/realimpact February 2012

8 SECURITY In the face of tough economic conditions and constant pressure to accomplish more with fewer resources, Public Sector organizations are looking into cloud computing solutions for fast access to best-of-breed applications, computing resources, storage, and other infrastructure at a much lower cost. However, Public Sector data includes classified or confidential documents, court records, and other files and information that should be stored in secure data centers. With a 25-year history in infrastructure technology and security innovations, Microsoft has the proven track record and expertise with end-to-end solutions that go beyond to help keep a whole organization and its records more secure. Our data centers are built from the ground up to help protect services and data from harm, whether natural disaster or unauthorized access. Physical security best practices are maintained, including state-of-the-art hardware, 24-hour secured access, redundant power supplies, multiple fiber trunks, and other features. International standards and certifications allow organizations to assess the compliance of a solution with standard security measures. The Cloud Security Alliance 14 is an international, not-for-profit organization that promotes the use of best practices for security assurances within cloud computing. The Cloud Security Alliance published the Cloud Control Matrix to support the evaluation of cloud services and to identify prudent questions to ask before moving to cloud services. In response to this publication, Microsoft published a detailed overview of how we fulfill the security, privacy, and risk management requirements defined in the Cloud Control Matrix and mapped them to International Standards Organization (ISO) certification. 15 Office 365 employs a security framework based on ISO/IEC 27000:2005 and is ISO certified by independent auditors. Office 365 is the first major business productivity public cloud service to implement the rigorous set of physical, logical, process, and management controls defined by ISO Additionally, Microsoft has self-certified with the Safe Harbor program 17, and our Office 365 data centers and physical infrastructure (provided by Microsoft Global Foundation Services) are SAS 70 Type II-certified today and will be audited against SSAE 16 at the next regularly scheduled audit. Microsoft s cloud infrastructure also received the Federal Information Security Management Act (FISMA) Authorization to Operate (ATO) within the U.S., and we have developed our online services to provide physical, administrative, and technical safeguards that facilitate full compliance with the U.S.-mandated Health Insurance Portability and Accountability Act (HIPAA). 18 Security is a priority throughout the entire development process of our products. Microsoft has formalized the rigorous security practices employed by its development teams into a process called the Security Development Lifecycle (SDL) 19, which ensures security and privacy are incorporated by design, from software development to service operations. The SDL consists of security practices grouped by seven phases: training, requirements, design, implementation, verification, government agency cuts costs by 12% annually with cloud productivity solution Because Office 365 comes equipped with enterprisegrade antivirus, anti-spam, and disaster recovery features, EPF no longer needs to allocate resources to maintaining and managing separate solutions. Thirdparty security solutions are not cheap. It was such a relief to find out Office 365 included not only the communication tools we needed, but also top-notch reliability and protection. Since we ll no longer need separate solutions, we ll save 12% in IT costs this year. Mazlena Fauzi, Manager Strategic Planning & Architecture Employees Provident Funds (EPF), Malaysia 8 microsoft.com/realimpact February 2012

9 release, and response. Organizations required to comply with a variety of regulations can benefit from this lifecycle approach to security development. 20 In comparing productivity solutions, Google Apps might seem like an adequate solution on the surface, but Public Sector organizations may require systems that deliver enhanced capabilities across a range of productivity applications. For example, many organizations must be able to respond to citizen requests using systems that are interoperable with a customer relationship management (CRM) application while maintaining security throughout. Microsoft designs interoperability into Office, Exchange Online, SharePoint Online, and Microsoft Dynamics, so these systems enable seamless productivity experiences for Public Sector use scenarios. The web-only architecture of Google Apps may significantly limit the ability of your organization to connect backend systems and respond to citizen requests. Google Apps may also create serious desktop management and security challenges for Public Sector organizations, adding large hidden costs for ICT administration. Use of many Google products for example Outlook Sync, Google Talk, and Google Chrome requires installing local software and allowing local administrator rights, which then must be administered by each individual desktop user. Public Sector organizations may increase their security risk as more end users gain local administrator rights. When evaluating solutions for productivity, messaging, and collaboration in your Public Sector organization, consider asking your technology providers the following questions about security. questions to ask about security SECURITY CONCERNS How is the solution packaged for central deployment or streamlined management? Does the solution offer enterprise-class information rights protection? QUESTIONS TO ASK Does the solution require installation of local software? Does the solution require an organization to allow local administration rights? In addition to encryption of and attachments, does the solution offer the ability to restrict the rights of recipients to forward, copy, print, or reply? Is there a guaranteed backup of for data recovery? 9 microsoft.com/realimpact February 2012

10 CONCLUSION Microsoft provides Public Sector organizations with enterprise-class solutions that integrate with each other and meet rigorous compliance requirements for accessibility, records retention, archiving, and security. With Office 365, Public Sector employees receive the productivity and collaboration tools they want, while ICT departments use a single administration console to manage features and policies and monitor service health with an easy-to-use, cloud-based tool. These familiar productivity and collaboration tools are backed by the security, 24x7 support, and reliability you expect from Microsoft. ADDITIONAL INFORMATION White Paper: Look Before You Leap Into Google Apps Office 365 Website Office 365 Trust Center Microsoft Privacy Office 365 FAQ Office 365 Standard Response to Request for Information Security and Privacy White Paper: Counting the Hidden Costs of Google Apps Video: Why Customers Choose Microsoft Over Google Microsoft Accessibility Office 365 for Enterprise Service Description White Paper: Security in Office 365 Addressing Cloud Computing Security Considerations with Office 365 Building Blocks for an Accessible Cloud Privacy in the Public Cloud: The Office 365 Approach Microsoft Security Development Lifecycle 1 Some Office 365 plans require Office desktop software to extend the suite of applications to the web. 2 Access from mobile devices depends on WiFi capability or mobile network availability. 3 Model Requirements for the Management of Electronic Records 4 Victorian Electronic Records Strategy (VERS) 5 E-Government Act of Microsoft SharePoint Online for Enterprises: Implement Records Management 7 Achieving Immutability with Exchange Online and Exchange Server Office 365 for Enterprise Service Description 9 Microsoft Online Services Trust Center Security, Audits, and Certifications 10 Microsoft Online Services Trust Center Geographic Boundaries 11 Microsoft Online Services Trust Center Administrative Access 12 Microsoft Online Services Trust Center Regulatory Compliance 13 University Enhances Messaging While Saving IT Time and Cutting Storage Costs Enterprise-Edition/United-Arab-Emirates-University/University-Enhances-Messaging-While-Saving-IT-Time-and-Cutting-Storage- Costs/ Cloud Security Alliance 15 Standard Response to Request for Information Security and Privacy 16 As of December Safe Harbor Certification 18 Office 365 Becomes First and Only Major Cloud Productivity Service to Comply With Leading EU and U.S. Standards for Data Protection and Security 19 Microsoft Security Development Lifecycle 20 SDL Practices Align With Many Compliance Activities Microsoft Corporation. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. 10 microsoft.com/realimpact February 2012