GOVKM-PROPOSED PUBLIC DRAFT
Enterprise Information Continuity and AI Readiness Standard
Prepare enterprise information for governed, authorized reuse across people, existing systems, and optional AI. EICARS can be implemented without OrgAI.
EICARS · Version 0.1 · Draft prepared November 5, 2026
Enterprise AI readiness begins with the information environment
Organizations need to preserve what their information means, who governs it, when it applies, and how it relates to decisions and records. EICARS proposes ten verifiable requirement domains for that environment.
Existing repositories can retain their assigned authority. The framework supports government and enterprise environments using Microsoft 365, shared drives, mission applications, business systems, analytics platforms, and records repositories.
This is a GovKM proposal. It is not an ISO or NIST standard, a government endorsement, an external accreditation, or a guarantee of AI accuracy. Information-environment assessment, AI deployment approval, and autonomous action remain separate decisions.
Published for public review November 5, 2026 with Robert Noyes’s approval. This remains a GovKM-proposed draft.
EICARS v0.1 proposed standard
GovKM-proposed EICARS v0.1 public draft | Proposed only | Published for public review | Not externally recognized or accredited
Purpose and scope
This proposed standard defines minimum, verifiable information-environment requirements for authorized enterprise reuse across people, repositories and optional AI systems. It applies to a declared business scope containing structured and unstructured information. It supports public, private and nonprofit organizations; legal applicability is established for each adopting organization. It can be implemented without OrgAI and without any AI.
Existing source systems may retain their assigned authority. Conformance does not require centralizing content, purchasing GovKM products, implementing a graph, or adopting a model-specific corpus format. Physical records may be referenced and governed even where immediate digital retrieval is unavailable; those limitations must be declared.
Definitions
| Term | Meaning in this proposal |
|---|---|
| Artifact | A bounded information object, such as a document, message, dataset, transaction record or report; a governed collection may be an artifact when its boundaries are explicit. |
| Authoritative source | A source recognized by the responsible organization as governing specified information or decisions within an explicit scope and period. |
| Delegation | An evidenced grant of decision authority within defined limits; not inferred from access or seniority alone. |
| Information continuity | Preservation of the identity, evidence, authority, context, history and relationships needed for information to remain understandable and governable through change. |
| AI readiness | Demonstrated suitability of a bounded information environment for specified authorized AI uses, subject to a separate consuming-system assessment. |
| Provenance | Attributable information about origin, responsibility and changes relevant to interpreting an artifact. |
| Record | Information meeting the applicable legal or organizational records definition; federal record status is governed by the FRA, not this definition. |
| Temporal validity | The time and circumstances in which information applies; distinct from its upload or capture time. |
| Supersession | An authorized replacement of all or part of an earlier instrument within a stated scope; history remains governed by retention obligations. |
| Conformance evidence | Inspectable material supporting a requirement determination for a defined scope, date, method and assessor. |
| Active information | Information needed for current business, including older dependencies; activity is not a retention classification. |
| Reconstruction | An evidence-supported account of the relevant information state, with missing or disputed information identified; not a guarantee of complete historical recovery. |
Governing principles
Human organizational authority remains accountable. Evidence supports claims; storage and retrieval do not create authority. Sources retain their defined roles across federation. Current and historical applicability remain distinguishable. Security, privacy, accessibility and records controls govern reuse. Unknowns remain visible. Requirements describe outcomes and leave implementation choices to adopters.
Normative and informative references
The normative requirements for a proposed EICARS claim are the scope and conformance provisions and R01–R10 below. Applicable laws, regulations, binding policies and contracts retain their own legal force; EICARS does not incorporate every cited external document wholesale. The adopter shall maintain an applicability register identifying controlling instruments, versions, scope, responsible official and evidence.
External references S01–S25 are informative mappings in this public proposal unless an applicable instrument independently makes them binding. ISO catalogue abstracts were used for conceptual alignment, not clause-level certification. The standards traceability section and source catalogue below identify editions, relevance and limits. No ISO text is reproduced as a substitute for the licensed standards.
Common logical information architecture
The organization documents how each participating platform supplies or references artifact and version identity, business ownership, authority, provenance, relationship meaning, applicability time, access and lifecycle controls. These concepts can be held in source metadata, controlled registers or documented interfaces. This is a logical information contract, not a prescribed schema. An approved source register identifies which platform governs which matter; replicas and analytical views remain identifiable as such.
For example, a personnel system may govern an employment transaction while a policy repository governs the applicable personnel policy. A Tableau view identifies its data source, transformation context and refresh time; it does not acquire authority to amend the underlying transaction. Cross-system references preserve the difference. Manual reconciliation is acceptable if timely, evidenced and suitable for the declared use.
Minimum proposed requirements
“Shall” identifies a requirement within this GovKM proposal. “Should” identifies a recommendation; “may” permits an option. These words do not create external legal obligations.
R01 Persistent artifact identity
The organization shall assign a persistent, unique identity within a declared namespace to each in-scope artifact and distinguish artifact identity from version identity and location. It shall preserve a resolvable reference or governed mapping through authorized rename, move or migration. Authorized disposition shall leave only the reference or disposition evidence permitted by the governing retention and privacy rules.
Verification: Artifact register and move/version mappings; demonstrate that a renamed artifact resolves to the intended version and that copies are distinguishable.
Interpretation: Unknown legacy identity shall be recorded as unresolved, without inventing historical equivalence.
R02 Organizational authority and delegation
The organization shall designate authoritative sources for each in-scope function and information type. It shall preserve approval and delegation evidence sufficient to establish issuer, recipient or role, decision scope, limits, effective period and revocation where relevant. A hierarchy or repository location alone shall not establish decision authority.
Verification: Approved source and responsibility registers; trace one policy and one delegated decision, including expiry or revocation.
Interpretation: Documented standing policies may govern classes of artifacts; a fresh human approval is not required for every retrieval.
R03 Provenance and change history
The organization shall retain attributable source and material-change evidence for the period needed to satisfy applicable business and legal obligations. It shall distinguish original content, authorized copies, transformations and derived material; record responsible actor or system, time and reason where available; and protect history against unauthorized alteration.
Verification: Version history, attributable approval/change records and transformation documentation; reconstruct a selected correction.
Interpretation: Do not fabricate absent history. Record uncertainty and the assessment date; hashes may support integrity but do not establish authority.
R04 Explicit information relationships
The organization shall document the relationship meanings needed for its declared use cases and preserve references between relevant artifacts, supporting evidence, decisions, business matters and records. Required relationships shall have identifiable endpoints, an interpretable meaning and supporting source or responsible owner. Broken or disputed references shall be visible and assigned for resolution.
Verification: Published local relationship vocabulary and representative links; follow a decision to supporting evidence and identify a deliberately broken link.
Interpretation: No specific graph database, AIL structure or GovKM ontology is required. Local terminology shall be mapped where meanings differ.
R05 Temporal validity and supersession
The organization shall distinguish when information was recorded from when it applies to a business purpose. It shall preserve effective periods, scope, approval state and supersession or withdrawal evidence where relevant. It shall permit authorized reviewers to distinguish current from historical applicability and shall route unresolved overlaps or conflicting instructions to the designated authority.
Verification: Effective-date and supersession records; inspect the governing source before and after a policy change, including a scoped exception.
Interpretation: An unknown effective date shall remain unknown. Later upload time or higher search rank shall not silently resolve a conflict.
R06 Records management and lifecycle governance
The organization shall identify applicable records obligations and assign accountable records officials. It shall maintain approved classification, retention, preservation, hold, transfer and disposition controls for in-scope information, including relevant metadata and derived evidence. It shall prevent unauthorized destruction, preserve required dependencies, and record authorized disposition. Inactivity alone shall not authorize deletion.
Verification: Applicable schedules and classification decisions; demonstrate hold enforcement and transfer or disposition authorization using safe test material.
Interpretation: Record status follows applicable law and policy, not merely a user label. Required preservation and mandatory deletion conflicts go to counsel and the records official.
R07 Cross-platform interoperability
The organization shall maintain documented mappings for the essential identities, meanings, relationships, dates, authority evidence, access conditions and lifecycle context exchanged between in-scope systems. It shall provide a documented, usable export or exchange route and verify representative exchanges or migrations for semantic and control preservation. Losses and unsupported fields shall be reported and remediated before dependent use is accepted.
Verification: Mapping specification, representative export/import and reconciliation results; inspect identities, dates, permissions and links after exchange.
Interpretation: Documented open formats are preferred. No single API, file type, model-specific chunking scheme or wholesale repository migration is required.
R08 Security and authorized access
The organization shall enforce applicable authorization, privacy and security controls across sources, catalogues, metadata, links, search indexes, caches and derived representations. It shall verify access grant, revocation and boundary behavior, protect integrity and availability, and preserve access/audit evidence consistent with applicable retention and minimization rules.
Verification: Approved access model; positive and negative access checks including revocation and derived-index behavior; audit evidence.
Interpretation: Metadata itself may be sensitive. A connector service account does not expand a user’s authority; inaccessible evidence shall not be exposed through reconstruction.
R09 Evidence backed retrieval and reconstruction
The organization shall provide an authorized means, manual or automated, to retrieve the evidence needed for its declared tasks and reconstruct the relevant information state at a stated time. The result shall identify sources and versions, applicable authority and context, material transformations, gaps and disputes. Unsupported conclusions shall remain distinguishable from verified evidence.
Verification: A reviewer reconstructs a selected decision and current policy from source evidence; expected results are approved by the business owner before assessment.
Interpretation: This is a requirement on the information environment. AI answer fidelity, citation accuracy and safe abstention require a separate consuming-system evaluation.
R10 Continuous governance and verification
The organization shall assign control owners, approve its assessment scope and review frequency, monitor material information or authority changes, preserve assessment evidence and track corrective actions. It shall reassess affected requirements after relevant organizational, policy, repository, access or integration changes. Human officials shall approve governance policy and consequential decisions within their authority.
Verification: Governance charter, review calendar, change-trigger records, evidence register and remediation closure; inspect one reassessment after change.
Interpretation: Continuous means an operating review and response process; it does not require uninterrupted automated inference or imply zero undetected defects.
Continuous authority policy
The organization shall approve a continuous authority policy implementing R02, R05, R06 and R10. It shall identify governing sources by function and scope; distinguish approval, publication, effective date, review date and revocation; preserve delegation limits and organizational responsibility; and define who resolves conflicts. Organizational hierarchy can help locate a responsible official but shall not override a statute, contract, reserved power or an explicit delegation limit.
A standing approved policy and its documented scope may govern routine work for its effective period without requiring a new authority declaration for each artifact. The organization shall record exceptions and partial supersession where they affect applicability. A change of officeholder shall trigger review where relevant; it shall not automatically invalidate every policy issued by the predecessor. Conflicts remain visible until a competent official decides them. Proposed AI interpretations and proposed governance policies shall remain proposals until approved by authorized officials.
The policy shall preserve approval and conflict-resolution evidence for the required lifecycle, provide human escalation and oversight, and govern historical reconstruction separately from current use. It shall not require automated authority inference or disclose any product-specific method. Retention and disposition of authority evidence follow applicable legal obligations, including holds and privacy limits.
Conformance model
A claim shall name EICARS v0.1 as a proposed GovKM draft, define the organizational unit, business processes, use cases, systems, population boundaries, assessment date and exclusions, and identify the accountable approving official. It shall state the assessment method, evidence locations, assessor and review date. An adopter shall assess all ten requirements; exclusions cannot remove a necessary dependency merely to obtain a favorable result.
Each requirement receives one determination: demonstrated, not demonstrated, not assessed, or not applicable with an approved rationale. Only conditional instances within a requirement may be not applicable; the ten governance domains remain in scope. “Demonstrated” requires design evidence plus operating evidence. A policy document alone is insufficient where the requirement concerns system behavior. Exceptions, missing evidence and accepted risks shall remain explicit; risk acceptance does not turn a failed requirement into a pass.
A scoped declaration of conformance to the proposed draft requires all applicable requirements to be demonstrated and the applicability register and evidence package approved. Otherwise report a readiness assessment with gaps. Do not use a percentage score to conceal failures. Record both the population evaluated and any sampling; a sample result supports only the assurance justified by the sampling design. No organization is assessed or declared conformant by this drafting package.
Recommended claim form: “Our [defined environment] was assessed on [date] against GovKM-proposed EICARS v0.1 for [uses]. The evidence and limitations are [reference]. This declaration concerns the information environment and does not certify an AI system, legal compliance, or external accreditation.”
Verification principles
Before evaluation, business and control owners shall approve expected results, risk-based population coverage, sample selection, acceptance criteria and material-failure rules. Preserve requirement-to-evidence-to-determination links, including assessor, time and unresolved findings. Use examination, interview and demonstration as appropriate; include normal operations, exception handling and prohibited outcomes. Prefer safe test material for destructive or access-control scenarios.
| Check | Required observation |
|---|---|
| Policy before and after an effective date | Relevant versions and applicability are recoverable; upload date does not decide authority. |
| Delegation expires or is revoked | Limits and relevant decisions can be inspected; unresolved authority goes to an official. |
| Artifact moves or is exported | Identity, required relationships and lifecycle/access context survive or losses block affected acceptance. |
| Access is revoked | Unauthorized content and protected metadata cannot be obtained through a tested source, index or derived path. |
| A record is on hold | The applicable disposition action is prevented and the hold evidence remains inspectable. |
| Source or approval is missing | The result exposes the gap; an unsupported conclusion is not presented as established. |
| Business responsibility changes | Ownership and governing-source assignments are reviewed and affected evidence remains traceable. |
Information-environment measurements should report identity coverage, verified required-link resolution, approved-source coverage, lifecycle-control coverage, access-test results and unresolved issues, with numerators, denominators and scope. These are public control observations, not an OrgAI continuity score. The organization sets defensible local thresholds before testing; thresholds shall not waive a mandatory requirement.
Separate AI consumption assessment
For each proposed AI deployment, evaluate connector coverage, parsing and OCR quality, source/version citation fidelity, temporal and scoped retrieval, permission enforcement, misleading or malicious source handling, model limitations and human escalation. Compare results with expected business outcomes. Approval to use an AI system and authority to execute actions remain separate from an EICARS information-environment determination.
Limitations and exclusions
EICARS does not guarantee truth, AI accuracy, complete reconstruction or discovery of all hidden artifacts. It does not prescribe an AI model, embedding approach, training method, scoring algorithm, internal AIL schema or proprietary GovKM procedure. It is not a retention schedule, security authorization, privacy determination, accessibility certification, procurement approval or substitute for applicable professional review. It makes no patent, licensing or interoperability certification commitment.
Version and approval status
Version 0.1, published for public review November 5, 2026 under GOVKM-EICARS-20261105-001 with Robert Noyes’s approval. This is a GovKM-proposed public draft and does not amend canonical GovKM doctrine. A later version shall identify changes, rationale, approval status and impact on prior assessments; prior versions and evidence remain governed by their retention obligations.
Enterprise transformation overview
This public overview explains a ten-stage transition to a governed enterprise information environment. It describes outcomes and decision points; it is not GovKM’s proprietary implementation playbook. Organizations can perform every stage with their own staff and tools, without OrgAI.
Preparation and workforce communications can run concurrently while current services continue. The stages are reviewable work areas, not an irreversible sequence: discovery and classification may need to repeat when dependencies emerge. Preservation and legal holds operate throughout, including during practice, cutover and historical assessment.
1 Enterprise information discovery
Inventory business functions, repositories, interfaces, formats, owners, access boundaries and dependencies. Include shared drives, collaboration, mission systems and off-line holdings.
Completion evidence: A bounded inventory and gaps register approved by business and information owners.
Transition condition: Keep current operations running; discovery does not authorize unrestricted crawling.
2 Authority and governance modeling
Identify authoritative sources, officials, delegation limits, policy scope, conflict routes and records responsibilities.
Completion evidence: An approved responsibility and authority register with known conflicts visible.
Transition condition: Existing statutory and organizational authority governs; AI proposals carry no independent authority.
3 Common information architecture design
Agree on identity, terminology, business groupings, minimum context, relationships, dates, access and lifecycle expectations. Map local platform concepts.
Completion evidence: A logical architecture and documented cross-system mappings.
Transition condition: Avoid prescribing a universal folder hierarchy or model-specific storage format.
4 Existing platform preparation
Configure or document how current platforms support required controls, references, exchange routes and authorized retrieval.
Completion evidence: Platform capability and gap assessments, safe demonstrations and a remediation plan.
Transition condition: Do not grant broad access merely to simplify integration; preserve operating services.
5 Artifact classification and records governance
Classify information by business purpose, sensitivity, record obligations and lifecycle. Resolve uncertain schedules and holds with the appropriate officials.
Completion evidence: Approved classification decisions and enforceable preservation, transfer and disposition controls.
Transition condition: Classification proposals do not authorize destruction; include metadata and derived evidence where required.
6 Workforce change management
Explain the change repeatedly, assign responsibilities, train staff, offer supported practice and communicate cutover criteria and dates.
Completion evidence: A communications plan, role-based guidance, practice results and support ownership.
Transition condition: Practice uses authorized information; old and new processes coexist under documented rules.
7 Active information cutover
Prioritize active work and the historical dependencies necessary to understand it. Reconcile identities, versions, approvals, links, access and records controls.
Completion evidence: Approved cutover reconciliation, unresolved-item list, fallback plan and business acceptance.
Transition condition: Keep required records, holds, provenance and history protected. Do not abandon off-line or inactive obligations.
8 Continuity assessment and remediation
Evaluate R01–R10 for the declared scope using source evidence; investigate gaps, assign owners and retest corrections.
Completion evidence: Evidence-linked determinations and a visible corrective-action register.
Transition condition: Manual assessment is sufficient where appropriate. OrgAI is optional and does not define the public test.
9 AI readiness verification
Assess suitability for named use cases, then test each consuming AI integration separately for access, retrieval, interpretation and escalation.
Completion evidence: A scoped environment determination plus separate, use-specific AI deployment evidence when AI is proposed.
Transition condition: A no-AI organization can complete the governance assessment. No model is approved simply because the corpus is prepared.
10 Continuous operations and historical archive assessment
Operate reviews and change-triggered reassessment; extend assessment to older holdings by risk and business need while maintaining preservation.
Completion evidence: Review evidence, resolved changes, archive assessment priorities and controlled retention actions.
Transition condition: Archive assessment can reveal dependencies earlier; defer analysis only where obligations and operational needs permit.
A practical federal example
A fictional program keeps active casework in its mission application, approved policy in a controlled library, and earlier decisions in a records repository. Preparation identifies which source governs each question and establishes references between the systems. Staff practice the revised process before moving active working material. The cutover includes the older policy and exception evidence needed for open cases, without moving every historical file into the collaboration library.
The records officer verifies preservation and schedules; security and privacy officials verify access; business officials accept the active process; and the CIO or designated architecture authority accepts cross-platform mappings. A later AI pilot uses a bounded subset and has separate performance and authorization tests. A model-independent environment assessment remains useful if that pilot is delayed or a different model is selected.
Responsibilities and readiness to cut over
The executive sponsor approves scope and resources. Business owners determine operational needs. Knowledge managers and enterprise architects coordinate shared meaning and structure. Records officers, counsel, privacy, security and accessibility specialists validate their respective obligations. Platform owners implement and evidence controls. Workforce representatives test usability. Authorized officials accept residual risk within their powers; no participant can waive a law or hold through project acceptance.
Proceed with cutover only when essential active dependencies, access, required preservation, operational support and fallback conditions are evidenced. A time target cannot substitute for acceptance. Keep deferred holdings under an accountable preservation and access plan, with archive assessment driven by legal requirements, risk and expected business value.
Standards traceability and authoritative references
This matrix maps proposed EICARS outcomes to authoritative reference topics. It is a research crosswalk, not an equivalence determination, compliance opinion or reproduction of licensed standards. Research cutoff: November 5, 2026. ISO mappings rely on official catalogue/abstract descriptions; no paid standards text was obtained and no clause-level ISO conformance is asserted.
Applicability key
M means mandatory where the identified law or rule directly applies. C means conditional on agency, system, data, contract, adopted policy or use-case scope. V means voluntary unless another applicable instrument incorporates it. P means proposed EICARS extension; all R01–R10 requirements are P in this package and become adoption commitments only through an authorized organizational decision. A source can be M for one entity and irrelevant to another. Establish applicable provisions before making a compliance claim.
Requirements traceability matrix
| EICARS | Authoritative references | Applicability | Alignment and proposed gap coverage | Verification and limits |
|---|---|---|---|---|
| R01 | S01, S02; S15 §§1236.10(d), 1236.14(b)(3) | V; C federal records | Records identification, usability and metadata linkage support the outcome. EICARS proposes an explicit persistent cross-system identity and version distinction for the declared environment. | Identity and version register; resolve a move/export; do not claim ISO clause compliance. |
| R02 | S01, S03, S05; S18; S19 governance provisions | V; C covered agencies/AI | Responsibilities and governance support authority management. EICARS proposes observable source assignments and scoped delegation evidence without inferring authority from hierarchy. | Approved sources and delegation evidence; local legal powers need separate validation. |
| R03 | S01, S02, S13; S15 §1236.10(b),(c) | V; C federal electronic records | PROV models provenance; federal controls address authenticity/integrity. EICARS proposes traceable source and transformation history across participating systems. | Attributable history and correction reconstruction; provenance is not proof a claim is true. |
| R04 | S02, S13; S15 §1236.10(f),(g) | V; C federal electronic records | Metadata/provenance and federal context/structure controls are relevant. EICARS proposes local relationship meanings and monitored required references across platforms. | Relationship vocabulary, supporting evidence and link checks; no new GovKM ontology adopted. |
| R05 | S01, S02, S13; S15 §1236.10(f) | V; C records context | Context and provenance support temporal interpretation. EICARS explicitly distinguishes capture time, applicability and scoped supersession; no claim that these references supply a complete authority resolver. | Before/after policy evidence and conflict escalation; authority requires local determination. |
| R06 | S01, S03; S14; S16; S17 | V; M/C within federal statutory scope | Records duties and disposition rules govern applicable federal information. EICARS extends lifecycle coverage to the declared enterprise environment and keeps inactive information governed. | Schedules, holds, classification decisions and authorized disposition; not all artifacts are permanent records. |
| R07 | S02, S13, S24; S15 §§1236.12(d), 1236.14; S20 §1 | V; C federal records/catalogues/acquisition | Interchange and metadata preservation support portability. EICARS proposes verified preservation of essential meaning and controls in cross-platform exchange. | Documented mapping and exchange reconciliation; DCAT-US is a catalogue profile, not a universal records schema. |
| R08 | S04, S12; S18, S22, S23, S25 | V; C systems, privacy, ICT and CUI scope | Security controls, privacy obligations and access rules constrain source and derived access. EICARS makes those boundaries explicit across metadata, indexes and reconstructed views. | Grant/revoke and unauthorized-path checks; separate privacy, security and accessibility determinations required. |
| R09 | S01, S13; S15 §1236.10(d)-(g); S11, S19 | V; C records and covered AI | Usability, provenance and risk management support evidence-backed review. EICARS requires an inspectable information state and explicit gaps independent of model output. | Approved expected cases, source/version citations and reconstruction evidence; separately test consuming AI. |
| R10 | S03, S04, S05, S07-S11; S12 CA-7; S15 §1236.26 | V; C selected controls and federal systems | Management systems, risk reviews and records inventory reviews support ongoing governance. EICARS proposes reassessment triggers and evidence-linked corrective action across the federation. | Owner, frequency, triggers, findings and verified closure; no inherited external certification. |
Standards research findings
There is no verified universal corpus structure optimized for all AI models. The supported conclusion is a common logical governance profile, with separate adapters and consuming-system validation. ISO 15489 and 23081 address records and metadata; 30301 addresses a records management system; 27001 security management; 42001 AI management; 5259 analytics/ML data quality. These scopes overlap but are not interchangeable.
ISO 30301:2019 remains published with a 2024 amendment while a replacement is in proof stage. ISO/TR 23081-4:2026 and ISO/IEC TR 5259-6:2026 are published technical reports. ISO committee catalogues show ongoing AI/records work, including draft 25280 projects; these are watch items and are not incorporated as published requirements. NIST SP 800-53 Rev 5 has Release 5.2.0 updates; use the selected control set and applicable assessment procedures, not a generic statement of NIST compliance.
W3C PROV-DM and PROV-O are Recommendations; PROV-Overview is a Note. EICARS permits a PROV mapping without mandating RDF or claiming that provenance settles authority. Federal records regulations remain binding within their scope even where they refer to an older ISO edition; a newer voluntary standard does not silently amend a regulation.
NARA AC 11.2026 is directly relevant to AI materials but is limited to FRA records issues. OMB M-25-21 and M-25-22 replace M-24-10 and M-24-18 respectively; the older memoranda are not used as current baselines. M-26-04 introduces an additional covered-LLM policy consideration. EICARS cannot satisfy AI model or acquisition obligations solely through information preparation.
Additional federal applicability boundaries
Assess FISMA, applicable FIPS requirements and agency system authorization; Privacy Act, agency privacy policy and any required privacy impact assessment; CUI rules and incorporated contract safeguards; Section 508 scoping; federal data inventory and interoperability policy; and mission-specific or sector rules. National security systems, classified data, defense and intelligence uses require their own governing instruments and cannot be cleared by this general public framework. Contracting officers and counsel determine which clauses bind a contractor; a NIST publication or OMB memorandum is not automatically a direct contractor obligation.
This v0.1 crosswalk is not an exhaustive regulatory inventory or recursive closure of every cited authority. Statutory and regulatory application, agency overlays, contractual flow-downs, legal holds, and later amendments require organization-specific review. FOIA responsiveness, exemptions and disclosure decisions remain with authorized officials; an evidence relationship does not authorize public release. Accessibility of content and controls requires verification, not merely a machine-readable metadata format.
Authoritative source catalogue
S01 ISO 15489-1:2016
https://www.iso.org/standard/62542.html
Published; confirmed 2021. Records concepts and principles across formats. Voluntary unless incorporated by applicable policy or contract. Public catalogue and abstract reviewed; no licensed clause audit.
S02 ISO 23081 series
https://www.iso.org/committee/48856/x/catalogue/
Part 1:2017 confirmed 2023; Part 2:2021 published, under review; TR Part 3:2011 self-assessment; TR Part 4:2026 metadata element sets published June 2026. Voluntary references; reports are not certification requirements.
S03 ISO 30301:2019 with Amd 1:2024
https://www.iso.org/standard/74292.html
Published records management system requirements. Catalogue says replacement ISO/PRF 30301 is forthcoming; do not treat the proof-stage revision as published. Recheck edition before release. Catalogue-level review only.
S04 ISO/IEC 27001:2022 with Amd 1:2024
https://www.iso.org/standard/27001
Published information security management system requirements; voluntary unless adopted or imposed. EICARS does not establish ISO certification.
S05 ISO/IEC 42001:2023
https://www.iso.org/standard/42001
Published AI management system requirements. Relevant when providing or using AI, rather than a prerequisite for a no-AI information environment. Public abstract reviewed.
S06 ISO/IEC 5259-1:2024
https://www.iso.org/standard/81088.html
Published overview, terminology and examples for analytics and ML data quality. Voluntary; not a universal retrieval corpus format.
S07 ISO/IEC 5259-2:2024
https://www.iso.org/standard/81860.html
Published data quality measures. Potential basis for local measurement selection; no EICARS equivalence or numerical thresholds attributed to ISO.
S08 ISO/IEC 5259-3:2024
https://www.iso.org/standard/81092.html
Published data quality management requirements and guidelines. Conceptual relevance; licensed clause review not performed.
S09 ISO/IEC 5259-4:2024
https://www.iso.org/standard/81093.html
Published data quality process framework for analytics and ML. Does not by itself establish enterprise authority or records compliance.
S10 ISO/IEC 5259-5:2025 and TR 5259-6:2026
https://www.iso.org/committee/6794475/x/catalogue/
Part 5 published data quality governance framework; Part 6 published technical report on visualization. Use the 2025 identifier for Part 5; some bundle marketing text is inconsistent. Technical report is informative.
S11 NIST AI RMF 1.0 and NIST AI 600-1
https://www.nist.gov/itl/ai-risk-management-framework
AI RMF 1.0 released January 2023; Generative AI Profile July 2024. Voluntary, unless incorporated by another applicable instrument. RMF revision activity is noted; draft work is not substituted for the released framework.
S12 NIST SP 800-53 Rev 5 Release 5.2.0
https://csrc.nist.gov/News/2025/nist-releases-revision-to-sp-800-53-controls
August 27, 2025 release; SP 800-53A assessment updates and 800-53B baseline context also matter. Controls require selection and tailoring under the applicable federal regime; not every catalogue control is mandatory everywhere.
S13 W3C PROV-DM and PROV-O
https://www.w3.org/TR/prov-dm/
Both W3C Recommendations, April 30, 2013. Provenance exchange concepts; https://www.w3.org/TR/prov-o/ provides ontology serialization. PROV-Overview is a Working Group Note, not itself a Recommendation. Optional EICARS interchange mapping.
S14 44 USC 3101 and 3301
Federal agency documentation duty and records definition. Related definition: https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3301&num=0&edition=prelim . Mandatory within statutory scope; not a blanket private-sector retention law.
S15 36 CFR Part 1236
https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236
Electronic federal records controls, especially 1236.10, .12, .14, .24 and .26. Current eCFR retrieved, title current through November 2, 2026. Requirements depend on record/system scope; digitization-specific subparts are not applied to every born-digital artifact.
S16 NARA records regulations and disposition
https://www.archives.gov/about/regulations/regulations.html
36 CFR Parts 1220, 1222, 1224-1227, 1230, 1235 and 1236 provide the federal records context. Current Part 1226 reviewed at https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 . Agency schedules, holds, and transfer instructions require local determination.
S17 NARA AC 11.2026 and AI materials guidance
https://www.archives.gov/records-mgmt/memos/ac-11-2026
August 21, 2026 guidance applying the FRA to AI inputs, outputs, data, audit trails, software and other materials. Explains record determination and schedule-based disposition; does not establish broader AI governance, privacy, security or e-discovery policy. Guidance PDF: https://www.archives.gov/files/records-mgmt/policy/nara-fra-ai-guidance.pdf .
S18 OMB Circular A-130
https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf
2016 Managing Information as a Strategic Resource; federal information governance, lifecycle, privacy and security context. Apply its scope and any later controlling agency instruments; not a private-enterprise mandate.
S19 OMB M-25-21
April 3, 2025 federal AI use policy; replaces M-24-10. Scope, exclusions, high-impact AI practices and agency-specific implementation require assessment. An EICARS result cannot substitute for the required AI use evaluation.
S20 OMB M-25-22
April 3, 2025 acquisition policy; replaces M-24-18. Portability and interoperability relevant. Covered agencies, acquisition dates/options, AI definition, exclusions including national security systems and Intelligence Community limits must be checked; contractor obligations depend on applicable terms.
S21 OMB M-26-04
December 11, 2025 policy on unbiased AI principles. Assess covered LLM procurement/use and agency implementation; information architecture alone cannot establish model conformity. Current OMB memorandum index checked November 5, 2026.
S22 Privacy Act and DOJ interpretation
https://www.justice.gov/opcl/overview-privacy-act-1974-2020-edition
5 USC 552a applies by statutory agency/system/record scope; DOJ overview is explanatory guidance, not the statute. Review disclosure, relevant-and-necessary collection, safeguards and applicable contractor provisions with privacy officials.
S23 Revised Section 508 Standards
https://www.access-board.gov/ict/
Federal ICT accessibility requirements under 29 USC 794d and 36 CFR Part 1194; revised standards incorporate WCAG 2.0 Level A/AA with scoping and exceptions. Do not describe WCAG 2.2 as the incorporated federal baseline.
S24 DCAT-US Schema v3.0
https://resources.data.gov/resources/dcat-us3/
Official federal dataset/API/data-service catalogue profile, published May 1, 2026; corroborated at https://www.councils.gov/news-events/news/dcat-us-schema-30-is-published/ . Applicability follows OMB M-25-05 and agency implementation. Does not replace records metadata for every document.
S25 32 CFR Part 2002 CUI
https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2002
Current eCFR retrieved, title through November 3, 2026. Apply to CUI within regulatory and agreement scope; consult agency CUI registry, system authorization and contract terms. No universal government security certification follows from EICARS.
Version history and participation
Version 0.1 — November 5, 2026. Initial GovKM-proposed draft published for public review with Robert Noyes’s approval. This proposal does not amend canonical GovKM doctrine.
The public requirements describe governance outcomes. GovKM's proprietary transformation methods and the OrgAI continuity substrate remain separately governed. No GovKM product is required to implement EICARS.
Discuss the proposal, submit a clarification, or explore an enterprise information readiness assessment.