How to make our organization compliant using Windows Server 2008?

In order to make our documents and files compliant with our state, we are being told that they need to be easily retrievable and not subject to alteration. We are using Windows Server 2008, and basically what I think we need is the ability of users to be able to write files to the server, but be unable to modify them once they are written. They also need the ability to be read when necessary. Is it possible to enact this policy on our servers without affecting the ability of applications running on them from doing their job properly? We have Microsoft Dynamics CRM running and do not want to mess something up with that. I am a novice in this area, please help...