GovKM Proposed Standards and Guidance

Apply the Right Information for the Right Time

Distinguish upload dates from effective periods and support review of replacements, exceptions and historical decisions.

GovKM-proposed public draft. Published for public review. Not externally accredited or endorsed.

View the EICARS framework resource

Document

Return to the EICARS guidance index

EICARS implementation guidance — proposed public draft. Checklist coverage: R05.1, R05.2, R05.3, R05.4. Prepared November 9, 2026. These suggested approaches support the published GovKM-proposed EICARS v0.1 draft; they do not add requirements or grant external accreditation.

Purpose and use

Distinguish upload dates from effective periods and support review of replacements, exceptions and historical decisions.

Use this guide within a declared organizational scope, with existing repositories and suitable organizational processes. AI is optional. Examples and suggested evidence are implementation aids; the published standard governs a conformance assessment. The Riverton case below is fictional, not an observed deployment or test result.

Responsible roles

Policy and business owners, with authorized dispute-resolution officials.

Assign responsibilities through the organization’s actual instruments. A suggested role in this guide does not itself confer decision authority.

R05.1 Distinguish creation and effective dates

Suggested approach: Separate document creation, capture and upload dates from dates governing the business situation. Use existing metadata or a controlled note to state when an instruction applies and the source supporting that statement. Keep time zones and date precision clear when they affect the decision. An upload timestamp is not an effective date.

Riverton example: The November schedule is uploaded after the director approved a December target. Its later upload does not make November the governing opening date.

Evidence and completion check: Show the relevant source and date meanings. Have a reviewer distinguish when the item entered the system from the period for which it applies; record unknown dates explicitly.

R05.2 Preserve supersession and exceptions

Suggested approach: Preserve supported evidence of replacement, withdrawal, exceptions and effective periods. Explain whether a change replaces the whole instruction or only part of its scope. Keep earlier applicable versions available according to retention and access requirements. Avoid using a generic “obsolete” label where an older instruction still governs a historical transaction.

Riverton example: Riverton’s December target replaces the planned opening date. It does not cancel the facilities inspection or authorize the pending contract modification.

Evidence and completion check: Inspect the approved change and a scoped exception. Confirm that staff can identify what changed, when it applies and which parts of the earlier material remain relevant.

R05.3 Support historical applicability review

Suggested approach: Support review of both current and earlier business periods. Identify the policy or instruction applicable to the event being examined and distinguish later knowledge from what was then available. Leave unknown dates, missing versions and overlapping instructions visible instead of forcing a definitive answer.

Riverton example: A reviewer asks why Riverton planned staffing for November. Staff retrieve the earlier planning record and later approved date change, explaining which evidence supports each period.

Evidence and completion check: Retain a dated historical review with source versions and limitations. Have another authorized reviewer reproduce the supported account and identify unresolved timing questions.

R05.4 Escalate conflicting instructions

Suggested approach: Route conflicting instructions to the designated authority with the competing sources and relevant dates. Do not use search ranking, recent modification time or seniority alone to settle the issue. Review material officeholder or delegation changes against the actual governing instruments; policies do not necessarily expire when their author leaves.

Riverton example: Two Riverton instructions give different target dates. The coordinator seeks a supported determination from the responsible official rather than letting the assistant choose the most recently uploaded document.

Evidence and completion check: Keep the conflict referral and official determination, or the unresolved status. Demonstrate that the briefing makes the limitation clear until it is resolved.

Evidence and completion checks

Agree the population, expected results and acceptance conditions before assessing. Record the date, assessor, evidence reference, observed result and limitation. Use approved safe examples for access, malicious-content or lifecycle tests. Documented policy and observed operating behavior are both relevant; one does not automatically prove the other.

On smaller screens, scroll the table horizontally to view every column.

Item	Suggested evidence and demonstration
R05.1	Show the relevant source and date meanings. Have a reviewer distinguish when the item entered the system from the period for which it applies; record unknown dates explicitly.
R05.2	Inspect the approved change and a scoped exception. Confirm that staff can identify what changed, when it applies and which parts of the earlier material remain relevant.
R05.3	Retain a dated historical review with source versions and limitations. Have another authorized reviewer reproduce the supported account and identify unresolved timing questions.
R05.4	Keep the conflict referral and official determination, or the unresolved status. Demonstrate that the briefing makes the limitation clear until it is resolved.

Record a gap where the required outcome is not demonstrated. Assign an owner and review date, then verify any correction. Completion of this page alone does not demonstrate conformance with all ten domains, certify legal compliance, approve an AI deployment or authorize autonomous actions.

Common mistakes

Using the latest upload as the governing instruction; erasing historical applicability; assuming a leadership change invalidates all earlier policy.

Continue the checklist

Use this page with the EICARS standard, the identity guide and the full Riverton scenario. No particular product, model or repository migration is required.

Implementation overview

Suggested operating approach: assign the responsible roles, confirm applicability, implement suitable controls in the existing environment, examine operating evidence and track unresolved gaps. Tailor the methods to scale and risk. Maintain current services during preparation and preserve records, access and legal obligations throughout.

Standards traceability and references

Government Authority and References

U.S. federal reference review: November 9, 2026. These are GovKM mappings of relevance, not government endorsement or a legal compliance determination. Statutes and regulations are mandatory only within their scope; federal policy applies to covered agencies and uses; technical guidance and voluntary resources require the stated selection, adoption or contractual basis. Private and nonfederal organizations must identify their own governing requirements.

The eCFR is authoritative but unofficial. Retrieved Title 36 pages displayed currency through November 5, 2026. Source retrieval does not establish exhaustive legal currency or clause-level implementation compliance. Check current agency supplements, deviations, court orders, schedules, contracts and later amendments. Add the organization’s actual instruments and the qualified official’s applicability determination.

R05.1 — Distinguish creation and effective dates

NARA Bulletin 2015-04 — Transfer metadata
Issuing body: National Archives and Records Administration. Pinpoint: minimum metadata; temporal coverage. Relevance: Dated record description.
Classification: Agency bulletin — requirements within stated transfer scope. Applicability: Transfers of permanent electronic records to NARA.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: AU-8. Relevance: Audit time stamps.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.
FAR 4.803 — Contract-file examples
Issuing body: Federal Acquisition Regulatory Council. Pinpoint: 4.803(a)(41). Relevance: Dated responsibility.
Classification: Regulatory examples — conditional on transaction. Applicability: Relevant Federal acquisition files. Verify current agency implementation and deviations.

GovKM recommendation boundary: An event time is not necessarily a business effective date. These sources do not universally mandate a dual-time information model.

R05.2 — Preserve supersession and exceptions

44 U.S.C. 3101 — Agency documentation duties
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: 3101. Relevance: Policy documentation.
Classification: Statute — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1222.22, 1222.24, 1222.26 and 1222.28 — Documentation and recordkeeping
Issuing body: National Archives and Records Administration. Pinpoint: 1222.22(e). Relevance: Decisions and policies.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
FAR 4.803 — Contract-file examples
Issuing body: Federal Acquisition Regulatory Council. Pinpoint: 4.803(a)(26), (34). Relevance: Modifications and deviations.
Classification: Regulatory examples — conditional on transaction. Applicability: Relevant Federal acquisition files. Verify current agency implementation and deviations.

GovKM recommendation boundary: Enterprise-wide validity and supersession fields are recommended controls. Applicable law and the actual issuing instrument govern each policy’s effect.

R05.3 — Support historical applicability review

44 U.S.C. 3101 — Agency documentation duties
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: 3101. Relevance: Adequate documentation.
Classification: Statute — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1236.10 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.10(d), (f). Relevance: Usability and context.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
FAR 4.803 — Contract-file examples
Issuing body: Federal Acquisition Regulatory Council. Pinpoint: 4.803(a)(26), (41). Relevance: Dated contract history.
Classification: Regulatory examples — conditional on transaction. Applicability: Relevant Federal acquisition files. Verify current agency implementation and deviations.

GovKM recommendation boundary: The exact historical-review test is proposed by EICARS; no cited authority guarantees full reconstruction of missing information.

R05.4 — Escalate conflicting instructions

FAR 1.602-1 and 1.603-4 — Contracting authority
Issuing body: Federal Acquisition Regulatory Council. Pinpoint: 1.602-1(a), 1.603-4. Relevance: Contracting limits and termination.
Classification: Regulation — mandatory when applicable. Applicability: Covered Federal contracting, with applicable agency supplements and deviations.
OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: section II. Relevance: Responsible control officials.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.

GovKM recommendation boundary: No general rule here determines all policy succession. Officeholder replacement does not itself establish whether a particular policy remains effective; officials must consult its governing authority.

This section gives relevant official references for each covered checklist item and is not an exhaustive list of every possible obligation. The actual agency, program, records, data, system and contract determine additional duties. The EICARS organization of these tasks, suggested registers and completion checks remain GovKM recommendations unless independently required or adopted.

Version history

November 9, 2026 — Publication authorized by GovKM. Guidance based on checklist and government authority reference package checked November 5, 2026. References must be periodically revalidated.

November 9, 2026 — Expanded implementation guidance, version 0.1. Replaced the shorter implementation text with the reviewed Riverton examples, task-specific approaches, evidence checks and official authority mappings, with Robert Noyes’s approval. Existing URLs and checklist anchors are preserved. No EICARS requirement or GovKM doctrine is amended.