GovKM Proposed Standards and Guidance

Connect Business Decisions to Supporting Information

Use understandable references to connect business matters, supporting documents and records across existing systems.

GovKM-proposed public draft. Published for public review. Not externally accredited or endorsed.

Document

EICARS implementation guidance — proposed public draft. Checklist coverage: R04.1, R04.2, R04.3, R04.4. Prepared November 9, 2026. These suggested approaches support the published GovKM-proposed EICARS v0.1 draft; they do not add requirements or grant external accreditation.

Purpose and use

Use understandable references to connect business matters, supporting documents and records across existing systems.

Use this guide within a declared organizational scope, with existing repositories and suitable organizational processes. AI is optional. Examples and suggested evidence are implementation aids; the published standard governs a conformance assessment. The Riverton case below is fictional, not an observed deployment or test result.

Responsible roles

Business file owners and designated reference maintainers, supported by security and records officials.

Assign responsibilities through the organization’s actual instruments. A suggested role in this guide does not itself confer decision authority.

R04.1 Define local relationship meanings

Suggested approach: Define the few reference meanings needed for the declared business use in familiar language. For example, distinguish “attachment to this report” from “background reading.” Document differences between participating applications. Reuse existing business vocabularies when suitable; no universal relationship taxonomy or graph database is required.

Riverton example: Riverton distinguishes the inspection attachment supporting a facilities finding from a planning note merely discussing the same building. Similar subject matter does not make one evidence for the other.

Evidence and completion check: Retain the approved local terms and examples. Have users from two offices explain the same reference and resolve any difference in meaning.

R04.2 Reference supporting evidence

Suggested approach: Provide references from a business matter or decision to the relevant supporting artifacts. Make the endpoints identifiable and explain why the referenced item matters. Use a case-file index, document links, repository associations or another suitable existing tool. Avoid unsupported links that imply approval or evidentiary support.

Riverton example: The opening briefing points to the facilities report, IT acceptance ticket and approved opening-date decision. It identifies the unsigned modification as a proposal, not evidence of authorized contract work.

Evidence and completion check: Follow a representative decision to its supporting source and version. Check that a reviewer can understand the reference without relying on the author’s memory.

R04.3 Assign link responsibility and protect access

Suggested approach: Assign responsibility for maintaining important references and preserve the source or business basis for them. Apply access controls to the reference and any exposed title, summary or metadata. A link must not reveal protected information to someone who lacks permission to know it exists.

Riverton example: The Riverton coordinator maintains the briefing’s source references. HR provides only an approved readiness statement within the user’s access; the briefing does not expose personnel-case titles.

Evidence and completion check: Retain ownership and access decisions. Demonstrate an authorized reference route and a prohibited route using safe material, including any sensitive descriptive information.

R04.4 Resolve broken or disputed references

Suggested approach: Provide a visible way to report a broken or disputed reference, assign a responsible owner and record the outcome. Classify whether the issue is a moved item, unavailable permission, missing evidence or disputed business meaning. Do not silently replace a missing source with a similar-looking file.

Riverton example: After a Riverton library move, an inspection reference fails. The coordinator checks the approved location mapping; an unrelated report with a similar title is not substituted.

Evidence and completion check: Use a deliberately broken reference in approved test material. Retain the report, investigation, correction or unresolved status, and a retest showing the intended source can be reached by the proper user.

Evidence and completion checks

Agree the population, expected results and acceptance conditions before assessing. Record the date, assessor, evidence reference, observed result and limitation. Use approved safe examples for access, malicious-content or lifecycle tests. Documented policy and observed operating behavior are both relevant; one does not automatically prove the other.

On smaller screens, scroll the table horizontally to view every column.

Item	Suggested evidence and demonstration
R04.1	Retain the approved local terms and examples. Have users from two offices explain the same reference and resolve any difference in meaning.
R04.2	Follow a representative decision to its supporting source and version. Check that a reviewer can understand the reference without relying on the author’s memory.
R04.3	Retain ownership and access decisions. Demonstrate an authorized reference route and a prohibited route using safe material, including any sensitive descriptive information.
R04.4	Use a deliberately broken reference in approved test material. Retain the report, investigation, correction or unresolved status, and a retest showing the intended source can be reached by the proper user.

Record a gap where the required outcome is not demonstrated. Assign an owner and review date, then verify any correction. Completion of this page alone does not demonstrate conformance with all ten domains, certify legal compliance, approve an AI deployment or authorize autonomous actions.

Common mistakes

Linking similar topics as though they prove a claim; exposing protected metadata; substituting similar files for missing evidence.

Continue the checklist

Use this page with the EICARS standard, the identity guide and the full Riverton scenario. No particular product, model or repository migration is required.

Implementation overview

Suggested operating approach: assign the responsible roles, confirm applicability, implement suitable controls in the existing environment, examine operating evidence and track unresolved gaps. Tailor the methods to scale and risk. Maintain current services during preparation and preserve records, access and legal obligations throughout.

Standards traceability and references

Government Authority and References

U.S. federal reference review: November 9, 2026. These are GovKM mappings of relevance, not government endorsement or a legal compliance determination. Statutes and regulations are mandatory only within their scope; federal policy applies to covered agencies and uses; technical guidance and voluntary resources require the stated selection, adoption or contractual basis. Private and nonfederal organizations must identify their own governing requirements.

The eCFR is authoritative but unofficial. Retrieved Title 36 pages displayed currency through November 5, 2026. Source retrieval does not establish exhaustive legal currency or clause-level implementation compliance. Check current agency supplements, deviations, court orders, schedules, contracts and later amendments. Add the organization’s actual instruments and the qualified official’s applicability determination.

R04.1 — Define local relationship meanings

36 CFR 1222.22, 1222.24, 1222.26 and 1222.28 — Documentation and recordkeeping
Issuing body: National Archives and Records Administration. Pinpoint: 1222.26(a)(3)–(4), 1222.28. Relevance: Related series.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1236.10 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.10(f)–(g). Relevance: Context and structure.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
NARA Universal ERM Requirements Version 3
Issuing body: National Archives and Records Administration. Pinpoint: Metadata section. Relevance: ERM reference.
Classification: Official requirements aid — tailor to underlying authority. Applicability: Federal ERM programs and acquisitions; voluntarily useful elsewhere.
44 U.S.C. 3511 — Data inventory and Federal data catalogue
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: 3511(a)(2)(A)(i). Relevance: Data definitions.
Classification: Statute — mandatory when applicable. Applicability: Covered Federal data assets; statutory practicability, disclosure and national security qualifications apply.

GovKM recommendation boundary: A controlled local vocabulary is a recommended implementation choice. These sources do not prescribe a particular technical data structure.

R04.2 — Reference supporting evidence

36 CFR 1236.10 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.10(f). Relevance: Related-record context.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
FAR 4.803 — Contract-file examples
Issuing body: Federal Acquisition Regulatory Council. Pinpoint: 4.803(a)(39). Relevance: Contract-file references.
Classification: Regulatory examples — conditional on transaction. Applicability: Relevant Federal acquisition files. Verify current agency implementation and deviations.
36 CFR 1222.22, 1222.24, 1222.26 and 1222.28 — Documentation and recordkeeping
Issuing body: National Archives and Records Administration. Pinpoint: 1222.22(e). Relevance: Decision documentation.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.

GovKM recommendation boundary: The cited sources support the underlying governance outcome. This checklist’s packaging, evidence register and assessment format are GovKM recommendations unless separately adopted.

R04.3 — Assign link responsibility and protect access

36 CFR 1222.22, 1222.24, 1222.26 and 1222.28 — Documentation and recordkeeping
Issuing body: National Archives and Records Administration. Pinpoint: 1222.26(a)(2). Relevance: Custody responsibility.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: AC-3, AC-6. Relevance: Authorized access.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.
32 CFR Part 2002 — Controlled Unclassified Information
Issuing body: National Archives and Records Administration. Pinpoint: 2002.14, 2002.16. Relevance: CUI safeguarding.
Classification: Regulation — mandatory when applicable. Applicability: Executive Branch CUI; nonfederal duties require applicable law, agreement or contract.

GovKM recommendation boundary: A per-link owner or supporting-source field is recommended where necessary for the declared use, not universally mandated by the references.

R04.4 — Resolve broken or disputed references

36 CFR 1236.10 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.10(d). Relevance: Usability.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: section IV(C), (E). Relevance: Deficiency correction.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.
FAR 4.802 — Contract files
Issuing body: Federal Acquisition Regulatory Council. Pinpoint: 4.802(d). Relevance: File locatability.
Classification: Regulation — mandatory when applicable. Applicability: Covered Federal contract files; agency supplements and deviations apply.

GovKM recommendation boundary: The broken-link register and safe demonstration are recommended controls. No particular link-maintenance mechanism is required.

This section gives relevant official references for each covered checklist item and is not an exhaustive list of every possible obligation. The actual agency, program, records, data, system and contract determine additional duties. The EICARS organization of these tasks, suggested registers and completion checks remain GovKM recommendations unless independently required or adopted.

Version history

November 9, 2026 — Publication authorized by GovKM. Guidance based on checklist and government authority reference package checked November 5, 2026. References must be periodically revalidated.

November 9, 2026 — Expanded implementation guidance, version 0.1. Replaced the shorter implementation text with the reviewed Riverton examples, task-specific approaches, evidence checks and official authority mappings, with Robert Noyes’s approval. Existing URLs and checklist anchors are preserved. No EICARS requirement or GovKM doctrine is amended.