GovKM Proposed Standards and Guidance
Govern Records Through Retention, Holds and Disposition
Preserve required records, enforce holds and support authorized lifecycle decisions across active, historical and offline holdings.
GovKM-proposed public draft. Published for public review. Not externally accredited or endorsed.
View the EICARS framework resourceDocument
Return to the EICARS guidance index
EICARS implementation guidance — proposed public draft. Checklist coverage: R06.1, R06.2, R06.3, R06.4. Prepared November 9, 2026. These suggested approaches support the published GovKM-proposed EICARS v0.1 draft; they do not add requirements or grant external accreditation.
Purpose and use
Preserve required records, enforce holds and support authorized lifecycle decisions across active, historical and offline holdings.
Use this guide within a declared organizational scope, with existing repositories and suitable organizational processes. AI is optional. Examples and suggested evidence are implementation aids; the published standard governs a conformance assessment. The Riverton case below is fictional, not an observed deployment or test result.
Responsible roles
Accountable records officials and custodians, with business owners, counsel and security or privacy staff as applicable.
Assign responsibilities through the organization’s actual instruments. A suggested role in this guide does not itself confer decision authority.
R06.1 Determine record status and schedules
Suggested approach: Have accountable records officials and business owners determine record status, classification and applicable schedules under law and agency policy. Identify the actual schedule item and triggering event. Distinguish an employee’s useful label from an authorized determination. Sensitive content and records status are different questions and may require different controls.
Riverton example: The Riverton coordinator calls a file a “record,” but the records official determines the applicable schedule and the role of the official project file, copies and working material.
Evidence and completion check: Keep the classification rationale, schedule reference and responsible determination. Inspect several different information types rather than assuming one retention rule covers the entire project.
R06.2 Implement lifecycle and hold controls
Suggested approach: Implement approved retention, preservation, hold, transfer and disposition arrangements using suitable existing records capabilities. Include necessary metadata, attachments and dependencies. Coordinate conflicting preservation and deletion duties with records officials and counsel. Retaining all material forever is not a substitute for lawful lifecycle governance.
Riverton example: A hold affects part of the Riverton procurement file. The applicable records and supporting attachments remain protected while unrelated material follows its own approved lifecycle.
Evidence and completion check: Inspect the applicable schedule and hold instructions. Demonstrate the required lifecycle behavior using safe test material and retain authorization, scope and results.
R06.3 Prevent unauthorized destruction
Suggested approach: Prevent destruction without valid authority and check for applicable holds or other restrictions before disposition. Use controlled workflows, permissions or equivalent safeguards suited to the environment. Retain evidence of authorized transfer or disposal as required, while avoiding unnecessary retention of protected content. Respond to suspected unauthorized loss through the applicable reporting process.
Riverton example: The active-information cutover does not authorize staff to delete old Riverton approvals. The records official verifies disposition authority and holds before any permitted action.
Evidence and completion check: Show that a safe test hold prevents scheduled disposition. For a permitted lifecycle action, inspect the authority, approvals and completion evidence; do not test destruction on required production records.
R06.4 Govern historical and offline holdings
Suggested approach: Keep inactive, archived, physical and offline holdings assigned to accountable custodians. Document preservation conditions, location, access arrangements and known dependencies. Prioritize historical assessment according to risk and business need. Where preservation and mandatory deletion obligations appear to conflict, seek a qualified determination rather than choosing one automatically.
Riverton example: Riverton’s older paper inspection files remain in approved custody after the active cutover. Staff know how to request them and which unresolved questions they may help answer.
Evidence and completion check: Inspect an offline or historical holding and its custody record. Demonstrate an authorized retrieval or documented limitation without claiming the unassessed archive is fully verified.
Evidence and completion checks
Agree the population, expected results and acceptance conditions before assessing. Record the date, assessor, evidence reference, observed result and limitation. Use approved safe examples for access, malicious-content or lifecycle tests. Documented policy and observed operating behavior are both relevant; one does not automatically prove the other.
On smaller screens, scroll the table horizontally to view every column.
| Item | Suggested evidence and demonstration |
|---|---|
| R06.1 | Keep the classification rationale, schedule reference and responsible determination. Inspect several different information types rather than assuming one retention rule covers the entire project. |
| R06.2 | Inspect the applicable schedule and hold instructions. Demonstrate the required lifecycle behavior using safe test material and retain authorization, scope and results. |
| R06.3 | Show that a safe test hold prevents scheduled disposition. For a permitted lifecycle action, inspect the authority, approvals and completion evidence; do not test destruction on required production records. |
| R06.4 | Inspect an offline or historical holding and its custody record. Demonstrate an authorized retrieval or documented limitation without claiming the unassessed archive is fully verified. |
Record a gap where the required outcome is not demonstrated. Assign an owner and review date, then verify any correction. Completion of this page alone does not demonstrate conformance with all ten domains, certify legal compliance, approve an AI deployment or authorize autonomous actions.
Common mistakes
Deleting inactive information at cutover; treating all copies alike; retaining everything indefinitely without authority.
Continue the checklist
Use this page with the EICARS standard, the identity guide and the full Riverton scenario. No particular product, model or repository migration is required.
Implementation overview
Suggested operating approach: assign the responsible roles, confirm applicability, implement suitable controls in the existing environment, examine operating evidence and track unresolved gaps. Tailor the methods to scale and risk. Maintain current services during preparation and preserve records, access and legal obligations throughout.
Standards traceability and references
Version history
November 9, 2026 — Publication authorized by GovKM. Guidance based on checklist and government authority reference package checked November 5, 2026. References must be periodically revalidated.
November 9, 2026 — Expanded implementation guidance, version 0.1. Replaced the shorter implementation text with the reviewed Riverton examples, task-specific approaches, evidence checks and official authority mappings, with Robert Noyes’s approval. Existing URLs and checklist anchors are preserved. No EICARS requirement or GovKM doctrine is amended.