Separate editable drafts from retained archives
Encryption can protect selected stored copies, but the working spreadsheet may exist in autosave, email, downloads and collaboration platforms. Define where editing occurs and when a frozen archive is created.
The team edits in an approved institutional workspace, exports a milestone copy after internal approval, encrypts the retained package and removes temporary local exports according to policy.
Run the control in five steps
- 01Choose the approved working location and named owners.
- 02Limit local exports and define the authoritative workbook.
- 03Freeze milestone versions at documented approvals.
- 04Encrypt retained copies using an approved method.
- 05Verify closure and search for plaintext residue.
Preserve the decision trail
Keep working location, owners, milestone, source hash, archive location, encryption method, residue check and approval.
Stop and investigate when
- The encrypted copy is edited as if it were the live model.
- Autosave and download locations are ignored.
- The only copy is encrypted without tested recovery.
State what this does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Sponsor rules, institutional approval, submission systems, provider permissions and recovery remain separate.
Grant budget security questions
Does encryption control the live collaboration workspace?
No. Provider permissions and institutional access remain separate.
Should every keystroke become an archive?
No. Define meaningful milestones and retain according to policy.
Sources for this decision
Links support specific controls and do not imply endorsement.