Microsoft InfoPath

General Information

Technologies must be operated and maintained in accordance with Federal and Department security and privacy policies and guidelines. More information on the proper use of the TRM can be found on the TRM Proper Use Tab/Section.

Website:	Go to site
Description:	Microsoft InfoPath is a software application for designing, distributing, filling and submitting electronic forms containing structured data. The product features a What You See Is What You Get (WYSIWYG) form designer in which the various controls (e.g. textbox, radio Button, checkbox) are bound to data, represented separately as a hierarchical tree view of folders and data fields. Microsoft initially released InfoPath as part of the Microsoft Office 2003 family, but Microsoft InfoPath is now offered as a standalone product. Please see the forecast notes and build documents on the References Tab for additional information. Microsoft has announced that InfoPath`s final version is 2013 and will end support in 2026 when Office 2016 ends support.
Technology/Standard Usage Requirements:	Users must ensure their use of this technology/standard is consistent with VA policies and standards, including, but not limited to, VA Handbooks 6102 and 6500; VA Directives 6004, 6513, and 6517; and National Institute of Standards and Technology (NIST) standards, including Federal Information Processing Standards (FIPS). Users must ensure sensitive data is properly protected in compliance with all VA regulations. Prior to use of this technology, users should check with their supervisor, Information Security Officer (ISO), Facility Chief Information Officer (CIO), or local Office of Information and Technology (OI&T) representative to ensure that all actions are consistent with current VA policies and procedures prior to implementation.
Section 508 Information:	This technology has been assessed by the Section 508 Office and found non-conformant. The Implementer of this technology has the responsibility to ensure the version deployed is 508-compliant. Section 508 compliance may be reviewed by the Section 508 Office and appropriate remedial action required if necessary. For additional information or assistance regarding Section 508, please contact the Section 508 Office at Section508@va.gov. Please see reference tab for more information concerning product versions.
Decision:	View Decisions

Decision Source:	TRM Mgmt Group
Decision Process:	One-VA TRM v23.2
Decision Date:	02/22/2023 at 19:05:53 UTC
Aliases:	MS InfoPath
Introduced By:	SCCM
Vendor Name:	Microsoft

Vendor Release Information

The Vendor Release table provides the known releases for the TRM Technology, obtained from the vendor (or from the release source).

Version	Release Date	Vendor End of Life Date	Vendor Desupport Date
Win Office 12.0/2007	01/27/2007	10/10/2017	10/10/2017
Win Office 14.0/2010	07/15/2010	10/13/2020	10/13/2020
Win Office 15.0/2013	10/02/2012	01/31/2014	04/11/2023
InfoPath 2013	09/01/2015	07/13/2021	07/14/2026

Current Decision Matrix (10/28/2020)

Users must ensure their use of this technology/standard is consistent with VA policies and standards, including, but not limited to, VA Handbooks 6102 and 6500; VA Directives 6004, 6513, and 6517; and National Institute of Standards and Technology (NIST) standards, including Federal Information Processing Standards (FIPS). Users must ensure sensitive data is properly protected in compliance with all VA regulations. Prior to use of this technology, users should check with their supervisor, Information Security Officer (ISO), Facility Chief Information Officer (CIO), or local Office of Information and Technology (OI&T) representative to ensure that all actions are consistent with current VA policies and procedures prior to implementation.

The VA Decision Matrix displays the current and future VA IT position regarding different releases of a TRM entry. These decisions are based upon the best information available as of the most current date. The consumer of this information has the responsibility to consult the organizations responsible for the desktop, testing, and/or production environments to ensure that the target version of the technology will be supported. Any major.minor version that is not listed in the VA Decision Matrix is considered unapproved for use.

Legend:

White	Approved: The technology/standard has been approved for use.
Yellow	Approved w/Constraints: The technology/standard can be used within the specified constraints located below the decision matrix in the footnote[1] and on the General tab.
Gray	Unapproved: This technology or standard can be used only if a POA&M review is conducted and signed by the Authorizing Official Designated Representative (AODR) as designated by the Authorizing Official (AO) or designee and based upon a recommendation from the POA&M Compliance Enforcement, has been granted to the project team or organization that wishes to use the technology.
Orange	Divest: VA has decided to divest itself on the use of the technology/standard. As a result, all projects currently utilizing the technology/standard must plan to eliminate their use of the technology/standard. Additional information on when the entry is projected to become unapproved may be found on the Decision tab for the specific entry.
Black	Prohibited: The technology/standard is not (currently) permitted to be used under any circumstances.
Blue	Planning/Evaluation Constraint:The period of time this technology is currently being evaluated, reviewed, and tested in controlled environments. Use of this technology is strictly controlled and not available for use within the general population. If a customer would like to use this technology, please work with your local or Regional OI&T office and contact the appropriate evaluation office displayed in the notes below the decision matrix. The Local or Regional OI&T office should submit an inquiry to the TRM if they require further assistance or if the evaluating office is not listed in the notes below.

Release/Version Information:

VA decisions for specific versions may include a ‘.x’ wildcard, which denotes a decision that pertains to a range of multiple versions.

For example, a technology approved with a decision for 7.x would cover any version of 7.(Anything) - 7.(Anything). However, a 7.4.x decision would cover any version of 7.4.(Anything), but would not cover any version of 7.5.x or 7.6.x on the TRM.

VA decisions for specific versions may include ‘+’ symbols; which denotes that the decision for the version specified also includes versions greater than what is specified but is not to exceed or affect previous decimal places.

For example, a technology approved with a decision for 12.6.4+ would cover any version that is greater than 12.6.4, but would not exceed the .6 decimal ie: 12.6.401 is ok, 12.6.5 is ok, 12.6.9 is ok, however 12.7.0 or 13.0 is not.

<Past

CY2016

CY2017

CY2018

Future>

Release

Q1

Q2

Q3

Q4

Q1

Q2

Q3

Q4

Q1

Q2

Q3

Q4

Win Office 12.0/2007

Divest
[3, 4, 6]

Unapproved

Win Office 14.0/2010

Approved w/Constraints
[3, 4, 6]

Approved w/Constraints
[3, 4, 7]

Approved w/Constraints
[3, 4, 8]

Approved w/Constraints
[4, 8, 9]

Divest
[4, 8, 9]

Win Office 15.0/2013

Approved w/Constraints
[1, 3, 4, 6]

Unapproved

InfoPath 2013

Unapproved

Approved w/Constraints
[1, 3, 4, 6]

Approved w/Constraints
[1, 3, 4, 7]

Approved w/Constraints
[3, 4, 8]

Approved w/Constraints
[4, 8, 9]

Decision Constraints


[1]	This Technology is currently being evaluated, reviewed, and tested in controlled environments. Use of this technology is strictly controlled and not available for use within the general population.

[2]	Configuration and deployment standards for Microsoft Office images which are defined and maintained by the Client Services organization within VA Enterprise Systems Engineering must be followed and adhered to unless an appropriate waiver is granted. Windows Office 15.0/2013 is under evaluation and currently not approved for production except as part of an official Enterprise System Engineering (ESE) production pilot or production test of this version as approved by ESE Desktop Technologies team for Windows (email: VA IT Engineering CS Desktop Technologies Team) or an AERB waiver while under evaluation. As of this writing, no deployment date for Windows Office 15.0/2013 has been determined.

[3]	Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500.

[4]	Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISO can provide assistance in reviewing the NIST vulnerabilities.

[5]	Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities.

[6]	Configuration and deployment standards for Microsoft Office images which are defined and maintained by the Client Services organization within VA Enterprise Systems Engineering must be followed and adhered to unless an appropriate waiver is granted. Windows Office 15.0/2013 are under evaluation and are currently not approved for production except as part of an official Enterprise System Engineering (ESE) production pilot or production test of this version as approved by ESE Desktop Technologies team for Windows (email: VA IT Engineering CS Desktop Technologies Team) or an AERB waiver while under evaluation. As of this writing, no deployment date for Windows Office 15.0/2013 has been determined.

[7]	Configuration and deployment standards for Microsoft Office images which are defined and maintained by the Client Services organization within VA Enterprise Systems Engineering must be followed and adhered to unless an appropriate waiver is granted. See the reference section of this entry for more information. InfoPath ProPlus 2013 is under evaluation for use with Office 2016 and currently not approved for production except as part of an official Enterprise System Engineering (ESE) production pilot or production test of this version as approved by ESE Desktop Technologies team for Windows (email: VA IT Engineering CS Desktop Technologies Team) or an AERB waiver while under evaluation. As of this writing, no deployment date for Office 365 ProPlus (Office 2016) has been determined.

[8]	Configuration and deployment standards for Microsoft Office images which are defined and maintained by the Client Services organization within VA Enterprise Systems Engineering must be followed and adhered to unless an appropriate waiver is granted. See the reference section of this entry for more information.

[9]	Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500.

Note:

The VA will not being deploying or approving the use of Office 2013 or its components (Microsoft InfoPath, Microsoft Excel, Microsoft OneNote, Microsoft Outlook, Microsoft PowerPoint, Microsoft Publisher and Microsoft Word) as Enterprise System Engineering (ESE ) is deploying Microsoft Office 365 ProPlus (Office 2016). Microsoft has discontinued support for InfoPath and InfoPath will not be a part of the Office 2016 suite. However, Microsoft is offering InfoPath 2013 as a stand alone download for use on Office 2016. The download and use of InfoPath 2013 software with Office 2016 requires an active Office 365 ProPlus subscription. InfoPath 2013 will be packaged and installed with the upgrade to Office 2016.

References

The following reference(s) are associated with this entry:
Type	Name	Source	Description

Technology Components

Note: This list may not be complete. No component, listed or unlisted, may be used outside of the technology in which it is released. The usage decision for a component is found in the Decision and Decision Constraints.
Name	Description
Microsoft InfoPath Designer	The Microsoft InfoPath Designer component is used to create and publish an InfoPath form template (.xsn). The component creates forms that include pre-built layout sections, out-of-the-box rules, improved rules management, and varied styles. In addition, InfoPath Designer includes a number of different form templates, so users do not need to define all parts of the form from scratch.
Microsoft InfoPath Filler	With Microsoft InfoPath Filler, people who are filling out forms have a simple and easy-to-use User Interface (UI) and can choose to save a draft, save a local copy, or save as a PDF and have a local record of the form. All the unnecessary functionality for designing forms has been removed for people who just want to open and fill out a form.
Microsoft InfoPath Forms Services	Microsoft InfoPath Forms Services supports improved parity between InfoPath Filler forms and InfoPath browser forms in SharePoint Server ensuring greater consistency for users who are filling out forms.

VA Categories View the VA Categorization Framework

Domain Area	Category	Customer Guidance	Category Locked By ELT Date
Collaboration and Electronic Workplace Productivity Software	Standard Office Suite

Operating Systems Supported by the Technology

Windows Client - Approved w/Constraints
Windows Server - Approved w/Constraints

Technologies/Standards Relationships

Runtime Dependencies:

Microsoft .NET Framework

Comparable Technologies:

Companion Technologies/Supported Standards:

General Analysis

Adoption Benefits

This is a well-documented technology, and is widely used within the enterprise.
The technology aligns with the Baseline for Microsoft 365 for Enterprise x64.
The technology enables users to design and fill out various electronic forms, such as expense reports, time cards, surveys, and insurance forms. The forms can be used on their own, or users can design them to work with existing databases or Web services. Forms can be published to and accessed from a common location on a company network, such as a shared folder, a Web server, or a library located on a Microsoft SharePoint Server. If a form template is browser-enabled, users who do not have InfoPath installed on their computer can fill out the form in a Web browser or on a mobile device instead.
Users can connect InfoPath forms with other data sources and line-of-business systems such as Microsoft SQL Server, Oracle, and SAP using SharePoint Server 2010 Business Connectivity Services, Web services, and Simple Object Access Protocol (SOAP) and representational state transfer (REST) Web services. The Microsoft InfoPath solutions can also be portable using SharePoint Foundation solutions file (.wsp) and SharePoint site template (.stp) formats, so users can move the application from site to site and server to server. In addition, InfoPath stores Uniform Resource Locators (URLs), as relative (instead of absolute) to enable portability.
This technology is Federal Information Processing (FIPS) 140-2 compliant.

Adoption Risks

There has been no recent development activity on this technology.
There are known Common Vulnerabilities and Exposures (CVEs) associated with this technology. Please see NVD - Results (nist.gov) for more details.
Microsoft InfoPath is not included in the Microsoft Office 2016 suite.
The potential exists to store Personally Identifiable Information (PII), Protected Health Information (PHI) and/or VA Sensitive data and proper security standards must be followed in these cases.
There are other approved solutions that provide similar functionality available on the TRM. The use of several similar solutions may increase organization requirements for support and maintenance.

Architectural Benefits

The technology can be hosted on or integrate with other VA approved technologies.

Architectural Risks

The technology is not portable as it supports only Windows platforms.

Inside VA

Budget and Performance

Inside the Media Room

National Observances

Special Events

VA Technical Reference Model v 24.7

General Information

Vendor Release Information

Current Decision Matrix (10/28/2020)

Decision Constraints

References

Technology Components

VA Categories View the VA Categorization Framework

Operating Systems Supported by the Technology

Technologies/Standards Relationships

Runtime Dependencies:

Comparable Technologies:

Companion Technologies/Supported Standards:

General Analysis

Adoption Benefits

Adoption Risks

Architectural Benefits

Architectural Risks

CONNECT

VA HOME

QUICK LIST

RESOURCES

ADMINISTRATION

VA Technical Reference Model v 24.7

General Information

Vendor Release Information

Current Decision Matrix (10/28/2020)

Decision Constraints

References

Technology Components

VA Categories View the VA Categorization Framework

Operating Systems Supported by the Technology

Technologies/Standards Relationships

Runtime Dependencies:

Comparable Technologies:

Companion Technologies/Supported Standards:

General Analysis

Adoption Benefits

Adoption Risks

Architectural Benefits

Architectural Risks

EMAIL UPDATES