The Solution Accelerators team is pleased to announce that the Data Classification Toolkit for Windows Server 2008 R2 is now available for download.

• Download the toolkit

The Data Classification Toolkit for Windows Server 2008 R2 is designed to help enable an organization to identify, classify, and protect data on their file servers. The out-of-the-box classification and rule examples help organizations build and deploy their policies to protect critical information in a cost-effective manner. 

Visit the Data Classification Toolkit for Windows Server 2008 R2 Page on Technet.  Learn more about IT Governance and Compliance Solution Accelerators.  Send your comments to the Solution Accelerator IT GRC Team at secwish@microsoft.com.

Successful data classification management programs require proper planning around these key critical areas:

The Data Classification Toolkit for Windows Server 2008 R2 helps organizations plan properly in these critical areas and enables governance of unstructured data scattered across any number of file servers. It integrates with the Microsoft System Center Service Manager IT GRC Process Management Pack to help organizations map classification requirements from various authority documents such as HIPAA and PCI DSS and to implement controls through File Classification Infrastructure.

Tell the Solution Accelerator IT GRC team what you think!

Join the Beta Program and tell the Solution Accelerator Team what you think!

• Help spread the word—share the beta invitation link with your friends
• Send your comments to the   Solution Accelerator IT GRC Team
• Learn more about IT Governance and Compliance Solution Accelerators.

 Next steps:

 To participate in the Data Classification Toolkit for Windows Server 2008 R2 Beta Program, download and test the tool in your environment and then provide timely feedback and suggestions to the development team. The beta runs through late June 2011. Submit your feedback through Connect and direct any support questions you may have to  secwish@microsoft.com  

Introducing Microsoft Assessment and Planning Toolkit

Microsoft Assessment and Planning Toolkit 4.0 is an integrated planning toolkit that makes it easier for Microsoft customers and partners to quickly identify what servers, workstations, and network devices are in their IT environment. This agentless and scalable toolkit has the ability to discover all computers within Active Directory and workgroup environments. It performs key functions that include hardware and device inventory, hardware compatibility analysis, and generation of actionable, environment-specific IT proposals for migration to most major Microsoft technologies.

What’s New with v4.0?

Version 4.0 of this toolkit has the following new features:

· Windows 7 Hardware and Device Compatibility Assessment

· Windows Server 2008 R2 Hardware and Device Compatibility Assessment

· Virtualization Candidates Assessment for Hyper-V R2 Server Consolidation

· Integration with the Microsoft Integrated Virtualization ROI Calculator

· Inventory of VMware Server Hosts and Guests

· User Interface and Proposal Customization for Partner co-branding

· Enhanced Usability and Improved Inventory Performance

Next Steps--How can I get Microsoft Assessment and Planning Toolkit 4.0 Beta?

· Download Microsoft Assessment and Planning Toolkit 4.0 Beta and give us your feedback (Live ID login and registration required)

· View the Webcast on MAP Toolkit 4.0 Beta (use Recording Key: fqX`%3t.X)

· Learn more about this toolkit and read case studies on TechNet

· To provide technical feedback on this Beta, please e-mail at MAPSBETA@microsoft.com

· Get the latest news from the Microsoft Assessment and Planning Toolkit Team Blog

We want to hear what you think about Solution Accelerators—if you’ve used a Solution Accelerator within your organization, help us by completing this short survey.

January 27, 2009

IT Manager Dialog Series:  Governance and Compliance In our monthly IT Manager Dialog Series we open up and talk to the experts both inside and outside of Microsoft about the latest trends impacting IT, and the resources and guidance available to help you plan and deploy the latest Microsoft technologies.  The often misunderstood and under-appreciated topic of governance and compliance is at the center of this episode. Joining us from Microsoft is Frank Simorjay, Product Manager for the Solution Accelerators Security and Compliance Team in Redmond. Length: 0:22:57 WMA | MP3 High | MP3 Low To save to your computer, right click and choose 'save target as…'.

Your Show Host and TechNet Radio Producer

Audience Marketing Director, Microsoft

Product Manager, Microsoft Solution Accelerators Security and Compliance

Program Manager, Microsoft Usability

**More about Technet radio can be found here!**

http://technet.microsoft.com/radio

‘Reduce the cost and effort of configuring and validating Microsoft products to address customer IT GRC requirements.’ - Project Tribeca Team

Does your IT team struggle to cope with the ever-changing demands of domestic and international governance, risk, and compliance (GRC) requirements? Microsoft is working to provide product configuration guidance to help IT professionals achieve compliance with hundreds of GRC authority documents, including SOX, PCI, HIPAA, GLBA, and EUDPD.

Join the Microsoft Project Tribeca team in weekly discussions to help shape content, GRC authority document alignment, and technology configuration guidance that directly affects your organization.

Topics

•  GRC Authority Document Scope: U.S., European Union (EU), International
•  GRC Control Objectives, Activities, and Tests

Open Questions

•  What GRC authority documents affect your organization?
•  How does your IT department manage change/configuration for GRC requirements?
•  How does your IT department associate required change and configuration management with GRC objectives?
•  What types of GRC guidance and tools do you expect or desire from Microsoft?
•  Has your organization used the IT Compliance Management Guide?

Meeting Dates

Attend any single or multiple Connect meetings

In addition, three lucky qualified attendee will Win a copies of Windows Vista Business Edition!!!!

• 1/28/09 8 AM PT - What GRC Authority Documents impact your organization?
• 2/04/09 8 AM PT - How does your IT department manage change/configuration for GRC requirements.

Please join us by signing up for the IT governance and Compliance program in Microsoft Connect. Click here to join the program.

 After you have joined the program, bookmark the following link to return to the program site and get the latest information about upcoming events:

https://connect.microsoft.com/site/sitehome.aspx?SiteID=657

Focus on markets with similar GRC needs

If your organization can identify a market segment that shares similar GRC requirements, a focused compliance effort can result in domination of that market. If your organization steadily raises the compliance bar, it can build a solid GRC solution that forces the competition to follow your lead. More complex GRC markets can then be tackled, easing the organization's compliance burden through paced incorporation of a truly functional and auditable GRC solution. Soon you aren't blindly promising that your customer can trust you, hoping nothing happens. Instead you can let your GRC solution speak for you, while your competition is left scrambling for evidence they can meet the new bar you've set.

Regardless of the size of your organization, your customers will expect its GRC requirements are your GRC requirements. These requirements can quickly overwhelm your organization if you are a small vendor catering to a fortune 100 client. Gather your head of marketing, sales, and your GRC subject matter expert(s) to create a heat map of potential industries, locations, and customer groups that share common GRC requirements that are applicable to your service. This exercise shouldn't take more than a few hours, and you will likely be able to quickly identify customers who share common GRC requirements due to region or industry, for example. Your GRC subject matter expert will also be able to quickly judge the complexity of the regulations that apply to these customer groups. Government and healthcare organizations will top the list of complex GRC requirements. Customers in Europe will top the list of regions with the most complex GRC requirements. Is your organization prepared to handle such complex requirements, or should you aim for less complicated industries and locations with requirements that can immediately be met? International, government, and healthcare industries are lucrative, but they maintain significant and often hidden costs that will be forced onto your organization once a deal is signed.  

Tally the cost of customer GRC requirements

 Greater GRC expectations include documented business processes, a regularly tested disaster recovery plan, dedicated hardware, security staff, and complex, customized configurations along with regular onsite audits. Beware the executive who dismisses these requirements as mere paperwork or worse, that they limit the liability of non-conformity to the cost of the contract.  The costs of non-conformity will not end at the value of a contract, and could potentially dwarf any profit.  Your organization's insurance might not cover any breach or failure to apply required controls. Non-compliance could even ruin the reputation of your business through a publically communicated security breach, required under many privacy laws. 

Before someone dismisses these costs as inconsequential to the potential profit, you should tally and review all potential costs of the customer's requirements. Passing these costs to the potential customer doesn't work in all situations, especially if the GRC requirement will benefit many or all of your customers once instantiated, or if it requires significantly more investment in the GRC solution than will be realized by the customer. For example, it is doubtful (although possible) that a single customer would pay for a disaster recovery site. Potential profit requires accurate tallying of GRC requirement costs. 

Develop a cohesive GRC message

Does your organization manage customer GRC requirements individually, or are the lessons learned from each engagement brought together under a GRC solution? Could the sales staff use a secret weapon to thwart the competition? Gather the sales executives, sales engineers, and deployment team managers together to determine whether GRC requirements are important to your customers. Determine what types of questions come up during demonstrations, RFCs, RFPs, and deployment of the customer's newly purchased solution. Questions don't end when a deal is signed! Determine if a cohesive GRC message could be created that enables the sales team to close deals quickly and confidently. The GRC solution could span from a sales presentation to a repository of answers used to quickly and uniformly fulfill customer RFCs and RFPs. Determine how the competition deals with these issues, and make your solution more professional than any available. Train the sales staff so that they understand why this is a secret weapon, and raise their confidence that your organization has the best solution.  

Pace the GRC solution

 Your organization cannot certify to every available set of GRC documents, commonly referred to as GRC authority documents. There are more than 400 GRC authority documents, many of which carry certifications. Determine which certifications would close deals, and which are too costly to consider. This determination will lead to new markets and possibly close others. Consult with your GRC subject matter expert to determine the best course of action. 

Keep competitors in the rear-view mirror 

The competition won't be ready for the bad news when your GRC solution becomes a deal-closing trump card. They also won't be prepared to immediately close the gap. After all, consider how much thought went into the analysis, planning, and execution of your new GRC solution. Consider what questions your customers should ask the competition. Improve and expand those questions as your organization matures, gains certifications, and increases market penetration. You'll be leading the pack, closing deals while others aren't even invited to the table.

Jeffrey Miller

Today we published a new and improved TechNet site that focuses on governance, risk, and compliance (GRC)! This site will provide you with all kinds of great information about tools and capabilities to help you realize the full potential of your Microsoft GRC investment. If you don't think you have one, take a look at the site; I challenge everyone to look carefully at the job aids provided there. http://technet.microsoft.com/en-us/regulatorycompliance/bb544955.aspx

What are the job aids?

Over the past several years, Microsoft has been steadily building great compliance resources. In the past, one could say that they were sometimes a bit hard to find. However that is now all changed! The job aids provide a one-stop shop of compliance-related resources from across Microsoft. No matter if you're looking for a guide that provide details on Microsoft® SQL Server®2008 compliance or Microsoft Dynamix AX Security capabilities—you can access both resources from one place!

This new site also offers the ability to provide feedback to the Solution Accelerators team.  They have posted a short survey that provides you with a chance to be heard: http://go.microsoft.com/fwlink/?LinkID=132579

Looking to participate in a compliance community? Maybe you just want to read up on the latest Microsoft solutions? Visit the TechNet Compliance Site at

http://technet.microsoft.com/en-us/regulatorycompliance/default.aspx.

Take a look at let us know what you think.

Frank

This Accelerator helps you better understand how an IT process framework can help you implement GRC controls in your Microsoft infrastructure.

The IT Compliance Management Guide includes a Microsoft® Operations Framework (MOF) 4.0 companion guide that is based on the Regulatory Compliance Planning Guide.

The IT Compliance Management Resources workbook saves you time by bringing together the information you need. It provides an extensive inventory of GRC-related configuration tasks and guidance organized by Microsoft product name.

Numerous resources are available to help address GRC requirements for Microsoft products and solutions.

The IT Compliance Management Guide ships with the IT Compliance Management Resources workbook, which provides job aids to locate these resources and conduct changes to your IT infrastructure.

Views compliance obligations through a 'lens' of 8 authority documents. The example authority documents include SOX, GLBA, HIPAA, EUDPD, PCI DSS, ISO 27002, COBIT 4.1, and AICPA GAPP.

Takes advantage of your current Microsoft investment. Configure Microsoft products in your environment to address GRC objectives.

Reviewed by auditing firm Grant Thornton LLP. "The Microsoft Operations Framework (MOF) referenced in the guide is both a reasonable and extensible framework by which an organization may manage GRC requirements and solutions."

Reduces complexity. Provides guidance to consolidate and address GRC requirements from multiple authority documents such as regulations, publications, and agreements.

Clarifies configuration requirements. Includes a Microsoft Excel® workbook with a detailed inventory list and job aids.

Free. The IT Compliance Management Guide is a free download.

Download it NOW.

Clouds Are on the Rise

Cloud computing has been variously described as utility computing, hosting applications off-premises, on-demand computing, Web-based computing, software-as-a-service, and in many other ways. No matter the description, its implementation generally takes some of the on-premise burden of holding or processing data and puts it to off-premise servers “in the cloud.” 

The big attraction of cloud computing has been lowered cost. A business that outsources its server services to the cloud might reduce costs by getting them on-demand and paying for them only when needed. Economies of scale give cloud computing an attractive advantage. Costs are kept down through usage of common hardware and increased rack density.  Organizations can simply pay for virtual machines when needed, and shut them down when not needed. Undoubtedly the cost advantage will continue to drive adoption of cloud computing. 

With a world-wide economic downturn, the prospects for low-cost overcast [SW1] skies of cloud computing are increasing. Small and medium-size businesses might especially feel the crunch and look for ways to reduce costs, such as by sourcing some or all of their computing services in the cloud.

Clouds Must be Reasonably Available

Clouds are subject to regulations. The low costs of cloud services help them work well for garden-variety commoditizable [SW2] IT functional areas such as e-mail, data storage, backup, and CRM[SW3] . These areas are core to many regulatory compliance controls. As these functions go into the cloud, so does regulatory responsibility. Regulations, risk, and governance principles aren’t eliminated when enterprise servers are turned off and services move to the clouds. In a globalized economy we might see increasing regulation and risk reduction of cloud computing.

Among cloud computing, regulations, risk, and governance concerns (such as security, privacy, backup and recovery, monitoring, reporting, and auditing to name a few) is cloud availability. The low-cost advantage of cloud computing is outweighed when and if unavailable clouds put an organization's business in jeopardy of being shut down or fined by regulators, successfully sued by litigants, or shunned by disgruntled customers. Many regulations allow governments to shut down businesses or levy large fines by government order if businesses fail to comply with regulations that require records to be available. Litigation rules allow unfavorable inferences to be made when records cannot be provided. Customers can quickly become angry when their records are not made available to them. The bottom line is that clouds must be reasonably available.

Servers Are Not Always Available

Cloud servers might not always be available, and there might be instances when we know there will be a drought.

In-house (non-cloud) infrastructure is not immune from outages, either. E-mail outages, for example, do occur in organizations that use internal enterprise servers. Servers do go down from time to time, whether they are in house or in the cloud. The question is not whether clouds will always be available, but instead whether or not organizations can continue in a compliant manner when the cloud is not available. 

The best IT operations actually plan for downtime. Software maintenance, new software releases, software upgrades, andr scheduled equipment repairs all can be part of planned downtime during periods of low usage to avoid unplanned downtime during periods of high usage. Downtime can be a good thing. It is ironic that the forecast can call for clear skies and not be a bad forecast. 

Still, the business cloud will have to be reasonably available and accountable. Let’s take a look at some specific examples.

Cloud Regulatory Availability Examples

Cloud financial records must be easily readable from a non-rewritable, non-erasable, and duplicated source. Electronics records under SOX must be provided to regulators with “facilities for immediate, easily readable projection or production of electronic storage media images and for producing easily readable images.” Records must be stored on non-rewritable and non-erasable media, and a duplicate copy of records must be stored separately from the original. So for purposes of SOX, the cloud needs to be easily readable, non-rewritable, non-erasable and duplicated. Ouch, that is a complicated cloud.

Cloud medical records must be reviewable and available for copying. Under HIPAA, patients have a right to obtain copies of their medical records within 30 days. That might seem like a long time to make copies available, but some state laws, such as that of California, shorten the time to 5 days for review and 15 days for a copy. Even if a physician has moved, retired, or died, his or her estate has an obligation to retain and make available medical records. Under state law this can be up to 10 years following a last patient visit. Disgruntled patients can file complaints. If a medical care provider decides to maintain medical data in the cloud, then the cloud better be available to provide medical data to patients when they demand it. Patients are also entitled to an accounting of disclosures of health information. That is, they are entitled to know who accessed their health records for a period of six years prior to the request. If medical records are kept in the cloud, accounting of cloud disclosures is required.

Microsoft Cloud Availability

With this big wind-up, let’s take a look at a sampling of what some Microsoft products and services offer in terms of cloud availability. Ultimately, the availability of records in the cloud for purposes of regulatory compliance can be greatly enhanced by the cloud software that houses the data, and Microsoft does a great job making the cloud available.

SharePoint

Microsoft SharePoint Online has a 99.99 percent scheduled uptime backed by a service level agreement. This means that it is down less than an hour per year. Nice! SharePoint is designed to work in conjunction with desktop software. In the event of network outage, critical information is still accessible. This is a big advantage of working with Office and SharePoint over other solutions.

Exchange

Microsoft Exchange Online has a 99.99 percent scheduled uptime backed by a service level agreement.

Business Productivity Online Suite (BPOS)

The Microsoft Business Productivity Online Suite consists of Microsoft Exchange Online, Microsoft Office SharePoint Online, Microsoft Office Live Meeting, Microsoft Office Communications Online, and Microsoft Exchange Hosted Filtering. The suite provides “business-class reliability” to customers and a guaranteed 99.9% service level agreement.

SQL Server Data Services

SQL Server Data Services (SSDS) is built on time-tested and robust SQL Server technologies that help insure business-ready, high availability. SSDS data is provided “reliably virtually anywhere, anytime.” One way that SDSS ensures high availability is by managing multiple copies of data. It maintains a backup of data stored in each data cluster. Partitions are replicated. Copies of data are maintained on servers at different physical locations. Geo-redundancy of data helps ensure business continuity.

Virtual Server and Windows Server 2008 Hyper-V

Organizations can help ensure availability by maintaining master copies of virtual platform images that run on cloud infrastructures. Microsoft has enabled organizations to do this for free with Virtual Server, and now with Microsoft Hyper-V Server 2008 - the “next-generation hypervisor-based server virtualization technology” (also available as a free download). Take a snapshot of your virtual machine while it is running so it can easily revert back to its previous state. Should the cloud ever disappear, such as a vendor going out of business or exorbitantly raising its prices, an organization can simply and easily move the image to another host vendor or even in house. Physical machines can take hours or days to replace. Virtual machines can be replaced in minutes. This kind of increasingly common dynamic scaling is not possible without virtual machines in the cloud.

Hyper-V supports virtual switch capabilities so that the Windows Network Load Balancing (NLB) service can be used to balance loads across virtual machines on different servers.  And with Hyper-V, virtual machines can be rapidly migrated while they are running from one physical host machine to another. Now that is high availability!

Microsoft has also made licensing of virtual machines very straightforward. For Windows Server 2008, if you want to run a single virtual machine, choose Standard Edition. If you want to run four virtual machines or fewer, run Enterprise Edition. If you want unlimited virtual machines, run Datacenter Edition. Wow, simple!

Clouds are on the rise, together with regulation, risk, and governance concerns. Among those concerns, availability is critical. Yet cloud computing can be made reliably available. In a world that is increasingly looking to the clouds, several Microsoft technologies are helping make cloud reliably a reality.