Release Notes

Archer SmartSuite Framework™ 4.5 Release Notes

The Archer SmartSuite Framework version 4.5 is a release that addresses specific client requests. To upgrade to 4.5,
please download the installer package from the Archer Community.

If you would like to view a complete listing of enhancements as well as client-reported issues that were resolved in this
release, please see the Client Requests Addressed in 4.5 report on the Archer Community.

Important: If you are upgrading to version 4.5 of the Archer SmartSuite Framework from a pre-4.3 version, please
review the Release and Migration Notes for the 4.3 release. These documents are available on the Archer
Community, and they provide important information on steps you need to take before, during and after the
installation process to ensure the success of your product upgrade.

Requirements for Running the Archer SmartSuite Framework Version 4.5

The following actions are required to utilize version 4.5.

Install the Microsoft .NET Framework 3.5 on Your Servers

You must have version 3.5 of the .NET Framework installed on your web server(s) before you can upgrade to version 4.5
of the Archer SmartSuite Framework. Major components of the Archer SmartSuite Framework have been significantly
enhanced to take advantage of functionality that only .NET 3.5 provides. Therefore, the Archer SmartSuite Framework will
no longer run on prior versions of the .NET Framework.

Enable Cookies
Security within Archer starts with user authentication. Every user who accesses the Archer Framework is given a unique
username and private password. Once a user has been authenticated, the system accordingly secures access and
permission for all records in the application by assigning a 32-digit token. In version 4.5 of the Archer SmartSuite
Framework, this token is now stored in a cookie, which increases security by ensuring that the session token is hidden
and cannot be copied. Because the session token is stored in a cookie, Archer users must have cookies enabled within
their browser to utilize the Archer Framework.

Rebuild All Indexes

After upgrading to version 4.5, you must rebuild your search index(es). For instructions, please see the Rebuild All
Indexes topic in the Control Panel Guide, which is available for download from the Archer Community.

Enhancements
Version 4.5 of the Archer SmartSuite Framework includes the following enhancements.

Security Enhancements
Archer has implemented the following two enhancements to improve the overall security of the Archer Framework.

Support for Extended Security Settings in the Web.config

In response to Microsoft’s best-practice recommendations, Archer has modified two of the default web.config settings.
Archer has updated these settings as optional, so clients can implement them manually if desired. The settings include
the customErrors element, which provides information about custom error messages for an ASP.NET application, and the
httpCookies element, which configures properties for cookies used by a web application.

These settings contain the following values:

<customErrors mode="On" defaultRedirect="/error.aspx" />

<httpCookies requireSSL="true" />

Note: If you set the httpCookies value, you must use HTTPS to log in.

www.archer.com | 13200 Metcalf, Suite 300, Overland Park, KS 66213 | 888-539-EGRC

1
© 2009 Archer Technologies LLC. All Rights Reserved.
 Release Notes
Microsoft recommends these settings for enhanced security, and Archer supports this general security practice.

New Algorithm and Method for Generating Session Tokens

Archer has improved the method and algorithm for generating session tokens. This update enhances security for users of
the Archer SmartSuite Framework.

Other Enhancements
Improvement of Calculation Engine Performance
Archer has enhanced the efficiency of recalculations by queuing applications only when a dependent field changes value.
When a dependent record is saved or recalculated, but there are no data changes for fields referenced in cross-
application calculations, the related applications will no longer be queued for recalculation.

For example, within the Business Continuity Management solution, the Last Plan Test Date field in the Disaster Recovery
Plans application is a calculation based on the Test Completion Date field in the BC/DR Tests application. If a user edits
the related record in the BC/DR Tests application, but does not change the data in the Test Completion Date field, the
Disaster Recovery Plans application will not recalculate as it would have prior to v4.5.

This new approach provides significant performance enhancements by eliminating unnecessary calculations.

File Names Included in the Record’s Keyword Index for Attachment and Image Fields
Archer has extended the keyword index for records to include the names of the files associated to the record within an
Attachment or Image field. Once a full index rebuild has been completed, users’ keyword searches will return records with
files whose file names contain the search term. For example, suppose your organization has licensed the Enterprise
Management solution, and you completed a record in the Devices application, including a document in the Attachments
field named Specifications.doc. If a user performed a keyword search in the Devices application for the word
“specifications”, the record that contains the Specifications.doc file would be returned, as shown below.

This addition enhances the Archer system’s search capability by providing more accurate search results. In previous
versions of the Archer Framework, file names were not included within keyword search results.

www.archer.com | 13200 Metcalf, Suite 300, Overland Park, KS 66213 | 888-539-EGRC

2
© 2009 Archer Technologies LLC. All Rights Reserved.
 Release Notes

Note: If you are using impersonation, you must reconfigure the impersonation credentials for the queue
service after upgrading to verson 4.5.

Improved Data Feed Manager Performance

Archer has updated the code for the Data Feed Manager, increasing the DFM’s performance. The number of records in
the data source does not affect the time it takes to insert the records into an application, nor does the number of records
affect the performance of a data feed that runs against that application. Previously, the system looked up every record in
the database as the data was processing. Now, the data is stored in a hash table, so the system looks up the data once in
the database before processing it and then refers to the hash table as it is processing. This method allows records to be
looked up quicker since the database is queried only once.

Issue Resolutions
The following issues were resolved in version 4.5 of the Archer SmartSuite Framework.

Questionnaire Issues
Answers with Decimal Values Were Not Saved
If the numeric value for an answer to a new question in the Question Library contained a decimal, the answer was not
saved when the user clicked Save or Apply. In version 4.5, an answer value with a decimal is accepted.

Progress Status Percent Complete Field for a Questionnaire Displayed Inaccurate Percentiles
The Progress Status Percent Complete field for a questionnaire was not accurately reflecting the rounded percentage of
questions that had been answered. In v4.5, this field displays the correct rounded percentage for the number of questions
completed in a questionnaire.

Recalculations Were Queuing Unnecessary Evaluations for Findings Generation

When a questionnaire was recalculated – whether it was a full application recalculation or a related record update for a
cross-application recalculation – findings generation was evaluated for each questionnaire record that was
updated. However, since recalculations cannot affect findings, the process always resulted in no new findings.

In client environments where cross-application calculations are heavily leveraged, this process can result in the Plug-In
Command Invoker Service being inundated with findings generations, which can cause performance issues. This issue
has been resolved in v4.5 so the questionnaire record is queued for findings generation only when the record is updated
by a means other than a recalculation.

Ampersand (&) Issues

Notifications Did Not Send If the Cross-Reference Field Contained an Ampersand
The system was not sending Notifications and Generate Email events if a Cross-Reference field was included in the
content of the email, and the key field of the referenced application contained an ampersand (&). This issue has been
resolved in v4.5, so an ampersand in a Cross-Reference field does not affect notifications.

Importing Data into a Values List Field Did Not Work If a Value Contained an Ampersand
If a Values List field contained an ampersand (&), a data import into the Values List field did not function properly. Version
4.5 escapes the ampersand character so the XML is valid, and the data import will work correctly.

Search Issues
Content Review Rights Were Applied to Non-Enrolled Records in Search Results
If Content Review was disabled, advanced search returned records the user did not have access to for a user who had
rights to any stage within Content Review. When a user had Create access to pages in the Content Review application,
search returned records in all applications the user had access to, even if the records were not enrolled in Content
Review. This issue has been addressed in v4.5. Only records to which the user has access are returned in search results.

www.archer.com | 13200 Metcalf, Suite 300, Overland Park, KS 66213 | 888-539-EGRC

3
© 2009 Archer Technologies LLC. All Rights Reserved.
 Release Notes

IDMatching and Matching Filters in API Calls Did Not Return the Proper Results
The IDMatching and Matching filters were returning all records regardless of the filter criteria of API calls. This issue has
been resolved in v4.5 so these filters function correctly.

The Incorrect Report Was Referenced for an Imported Application

After a user imported an application from a file that included reports, the system referenced the incorrect report. This issue
caused an error message to be displayed when the user attempted to run the imported report, and the user could not
access the report. Version 4.5 corrects this issue so the new search results page number will replace the old one when an
application is imported, thereby returning the requested report and allowing the user access.

Other Issues
Default Solution Did Not Display in the Quick Search Dropdown When the Navigation Menu Was
Hidden
If an administrator configured a workspace to hide the Navigation Menu, the Quick Search dropdown in the top frame of
the user interface did not contain the default selection. However, if the Navigation Menu was set to Expanded, the correct
default solution was populated. This issue has been addressed in v4.5 so the Quick Search dropdown displays the first
solution in the Navigation Menu as expected.

Parent Records Were Not Locked When in Edit Mode for Sub-Forms, Search, Cross-Reference and
Related Records Fields
Two users were able to access the same record in Edit mode if one of the users drilled into a referenced record through a
Sub-Form, Cross-Reference or Related Records field. When one user edited and saved a record and then left the parent
record through a Sub-Form or Cross-Reference field, another user could edit the parent record. Then when the first user
closed the referenced record and returned to the parent record and edited and saved it, the second user’s changes were
lost.

Also, when a user navigated to a specific page in search results, that page was not locking. When a user navigated
through search results and edited and saved a record, the system allowed a second user to edit the record. However, the
system displayed an error message when the second user attempted to save the record and would not allow the user to
save the record (even though it was no longer locked).

These issues have been resolved so only one user at a time can edit records.

About Archer Technologies

Archer Technologies delivers enterprise governance, risk and compliance (GRC) solutions. With more than six million
licensed users and a client list that includes one in four of the Fortune 100, Archer enables highly regulated companies to
manage enterprise risks, demonstrate compliance, automate business processes, and gain visibility into corporate risk
and security controls.

Archer’s out-of-the-box solutions, including Policy, Risk, Compliance, Incident, Vendor, Threat, Business Continuity, Audit
and Enterprise Management, are built on the flexible Archer SmartSuite Framework™, allowing clients to tailor the
solutions according to their unique requirements. Whether deployed on-premise or via Archer’s SaaS model, the
Framework has become a go-to GRC platform for many global organizations.

Archer is the only vendor that delivers the Archer E-GRC Ecosystem™ comprised of out-of-the-box solutions, a flexible
Framework, a robust user community, and an application and partner exchange, which provides clients the tools they
need to build a best-in-class enterprise GRC program. For more information, visit www.archer.com or call 1-888-539-
EGRC.

www.archer.com | 13200 Metcalf, Suite 300, Overland Park, KS 66213 | 888-539-EGRC

4
© 2009 Archer Technologies LLC. All Rights Reserved.