Product Compliance with the Federal Desktop Core Configuration (FDCC)

As a vendor of desktop software products to the U.S. Federal Government, SAS has evaluated SAS' applicable* desktop software products on the SAS 9.1.3 SP4 platform for use with the Windows operating system ("Desktop Software") for conformance to the FDCC security configurations developed and issued by the National Institute and Standards and Technology (NIST) titled FDCC 2008 Q2 XP and Vista VHDs (made available by NIST at http://nvd.nist.gov/fdcc/download_fdcc.cfm) (the "FDCC Guidelines"), which FDCC Guidelines were issued by NIST as a result of the U.S. Office of Management and Budget Memorandum M-07-18 dated June 1, 2007 on the subject of Ensuring New Acquisitions Include Common Security Configurations.

Based on testing with a Security Content Automation Protocol (SCAP) validated product, SAS verified that our Desktop Software operates in substantial conformance with SAS' current user documentation for such Desktop Software on desktop machines running Windows XP or Windows Vista (in protected mode on Vista) operating systems (each a "Standardized FDCC Desktop"), and runs on the Standardized FDCC Desktop substantially in accordance with the FDCC Guidelines; provided, that the Standardized FDCC Desktop has been properly configured to implement the FDCC Guidelines. Our product-by-product testing verified:

• Customers' normal end users will not require elevated system administration privileges to run Desktop Software on a Standardized FDCC Desktop, where normal end users are indicated in SAS' current user documentation for such Desktop Software.
• Standard installation, operation, maintenance, update, and/or patching of such Desktop Software in accordance with SAS' current user documentation for such Desktop Software will not materially alter the Standard FDCC Desktop settings from the FDCC Guidelines.

SAS is currently conducting FDCC validation testing of our applicable desktop software products (using the NIST security configuration titled Major Version 1.0 of FDCC, made available by NIST at http://nvd.nist.gov/fdcc/download_fdcc.cfm) on the SAS 9.2 platform; we expect such testing to show that such products are FDCC compliant.

For additional information please contact FDCC.SAS@SAS.COM.

*See Attachment A hereto for a list of SAS desktop software products that were not evaluated under FDCC Guidelines.

NOTICE: This information is provided by SAS Institute Inc. for information purposes only and may be changed by SAS at any time without notice. SAS makes no representations of warranties concerning this information. SAS' only warranty or other obligations to Customer with respect to a SAS product shall be as set forth in any applicable licensing documents. SAS and all other SAS Institute Inc. product and service names are registered trademarks or registered trademarks of SAS Institute Inc. in the USA and other countries. ® indicates USA registration. Other brand and product names are registered trademarks or trademarks of their respective companies.

16JUL2008

SAS opted not to test the following desktop software products on the SAS 9.1.3 SP4 platform either because the product is legacy software not offered for the SAS 9.2 platform, the product transparently provides functionality available to the desktop user or the product is not used on Federal desktops.

• AppDev Studio
• Data Surveyor for Oracle Applications
• Data Surveyor for PeopleSoft
• Design Time Controls
• Drug Development
• Enterprise Reporter (Businessview)
• SAS/ACCESS Interface to BAAN
• SAS/ACCESS Interface to NCR's Teradata D
• SAS/ACCESS Interface to ODBC
• SAS/ACCESS Interface to Oracle Rdb
• SAS/ACCESS Interface to SAP BW
• SAS/ACCESS Interface to System 2000
• SAS/ACCESS software to ADABAS
• SAS/ACCESS software to DATACOM/DB
• SAS/ACCESS software to DB2
• SAS/ACCESS software to IDMS/R
• SAS/ACCESS software to IMS-DL/I
• SAS/ACCESS software to INFORMIX
• SAS/ACCESS software to INGRES
• SAS/ACCESS software to ORACLE
• SAS/ACCESS software to PC File Formats
• SAS/ACCESS software to R3
• SAS/ACCESS software to SYBASE
• SAS/ACCESS to OLE DB
• SAS/ACCESS to OLE DB
• SAS/CALC
• Web OLAP Viewer for .Net