GovKM Proposed Standards and Guidance

Keep Information Governance Working as Things Change

Assign control ownership, reassess material changes and verify corrective actions while retaining authorized human decisions.

GovKM-proposed public draft. Published for public review. Not externally accredited or endorsed.

View the EICARS framework resource

Document

Return to the EICARS guidance index

EICARS implementation guidance — proposed public draft. Checklist coverage: R10.1, R10.2, R10.3, R10.4. Prepared November 9, 2026. These suggested approaches support the published GovKM-proposed EICARS v0.1 draft; they do not add requirements or grant external accreditation.

Purpose and use

Assign control ownership, reassess material changes and verify corrective actions while retaining authorized human decisions.

Use this guide within a declared organizational scope, with existing repositories and suitable organizational processes. AI is optional. Examples and suggested evidence are implementation aids; the published standard governs a conformance assessment. The Riverton case below is fictional, not an observed deployment or test result.

Responsible roles

Accountable control owners and approving officials, coordinated through existing governance.

Assign responsibilities through the organization’s actual instruments. A suggested role in this guide does not itself confer decision authority.

R10.1 Assign continuous control ownership

Suggested approach: Assign a responsible owner for each control and approve review coverage, frequency and monitoring responsibilities appropriate to risk. Use existing operating and records reviews where suitable. Define who receives exceptions and who can approve corrective action. “Continuous” governance means controls remain managed during change; it does not require uninterrupted automated inspection.

Riverton example: Riverton assigns owners for source references, records treatment, access and briefing content. Each knows when to review and how to report an unresolved issue.

Evidence and completion check: Retain the charter, responsibility assignments and review schedule. Inspect completed reviews and follow up on missed or unsupported checks.

R10.2 Reassess after material changes

Suggested approach: Identify events that require reassessment, such as policy changes, changed delegation, repository moves, revised access or integration changes. Determine affected controls and uses rather than repeating an entire assessment automatically. Review source responsibilities when offices reorganize. Keep the basis for the assessment decision.

Riverton example: Riverton changes the IT ticket integration. The owner rechecks acceptance status, source references and access enforcement for the briefing before relying on the revised path.

Evidence and completion check: Inspect one material change and the resulting impact review. Retain the targeted reassessment, findings and the responsible acceptance or use limitation.

R10.3 Track evidence and corrective action

Suggested approach: Maintain a usable record linking each assessed requirement to evidence and determination. Track gaps with responsible owners, due dates, corrective actions and retest results. Close an issue only after the authorized reviewer verifies the result. Keep earlier failed evidence and stated limitations according to retention requirements.

Riverton example: A broken Riverton inspection reference receives an owner and correction date. Replacing the link is not closure until a reviewer checks the intended source and authorized access.

Evidence and completion check: Inspect one corrective action from finding through retest and verified closure. Keep accepted risks distinguishable from requirements that have actually been demonstrated.

R10.4 Retain authorized human decisions

Suggested approach: Keep policy approval and consequential decisions with the officials authorized to make them. AI can help prepare proposals or identify possible issues, but its output remains advice until approved through the applicable process. Clearly distinguish permission to retrieve information from permission to change records, communicate commitments or execute actions.

Riverton example: The Riverton assistant can summarize outstanding conditions. It cannot approve the opening, execute a contract modification or change the official date merely because it can edit a project record.

Evidence and completion check: Retain the decision and delegation evidence. Walk through a machine-generated proposal and confirm that the appropriate official’s approval precedes any authorized consequential action.

Evidence and completion checks

Agree the population, expected results and acceptance conditions before assessing. Record the date, assessor, evidence reference, observed result and limitation. Use approved safe examples for access, malicious-content or lifecycle tests. Documented policy and observed operating behavior are both relevant; one does not automatically prove the other.

On smaller screens, scroll the table horizontally to view every column.

Item	Suggested evidence and demonstration
R10.1	Retain the charter, responsibility assignments and review schedule. Inspect completed reviews and follow up on missed or unsupported checks.
R10.2	Inspect one material change and the resulting impact review. Retain the targeted reassessment, findings and the responsible acceptance or use limitation.
R10.3	Inspect one corrective action from finding through retest and verified closure. Keep accepted risks distinguishable from requirements that have actually been demonstrated.
R10.4	Retain the decision and delegation evidence. Walk through a machine-generated proposal and confirm that the appropriate official’s approval precedes any authorized consequential action.

Record a gap where the required outcome is not demonstrated. Assign an owner and review date, then verify any correction. Completion of this page alone does not demonstrate conformance with all ten domains, certify legal compliance, approve an AI deployment or authorize autonomous actions.

Common mistakes

Calling an uploaded policy an operating control; closing issues without retesting; letting an AI proposal become policy automatically.

Continue the checklist

Use this page with the EICARS standard, the identity guide and the full Riverton scenario. No particular product, model or repository migration is required.

Implementation overview

Suggested operating approach: assign the responsible roles, confirm applicability, implement suitable controls in the existing environment, examine operating evidence and track unresolved gaps. Tailor the methods to scale and risk. Maintain current services during preparation and preserve records, access and legal obligations throughout.

Standards traceability and references

Government Authority and References

U.S. federal reference review: November 9, 2026. These are GovKM mappings of relevance, not government endorsement or a legal compliance determination. Statutes and regulations are mandatory only within their scope; federal policy applies to covered agencies and uses; technical guidance and voluntary resources require the stated selection, adoption or contractual basis. Private and nonfederal organizations must identify their own governing requirements.

The eCFR is authoritative but unofficial. Retrieved Title 36 pages displayed currency through November 5, 2026. Source retrieval does not establish exhaustive legal currency or clause-level implementation compliance. Check current agency supplements, deviations, court orders, schedules, contracts and later amendments. Add the organization’s actual instruments and the qualified official’s applicability determination.

R10.1 — Assign continuous control ownership

36 CFR 1220.32 and 1220.34 — Records program responsibilities
Issuing body: National Archives and Records Administration. Pinpoint: 1220.34(a), (d), (j). Relevance: Roles and evaluation.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: sections II, III(E), IV. Relevance: Control governance.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: CA-7. Relevance: Monitoring.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.

GovKM recommendation boundary: The cited sources support the underlying governance outcome. This checklist’s packaging, evidence register and assessment format are GovKM recommendations unless separately adopted.

R10.2 — Reassess after material changes

36 CFR 1236.12 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.12. Relevance: System lifecycle.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: CM-3, CA-7. Relevance: Change and monitoring.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.
OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: sections III(B), IV. Relevance: Changed risks.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.
OMB M-25-21 — Federal AI use
Issuing body: Office of Management and Budget. Pinpoint: 4(b). Relevance: Covered AI monitoring.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Covered agency AI uses; high-impact provisions and national security/intelligence exceptions have distinct scopes.

R10.3 — Track evidence and corrective action

OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: section IV(A), (C), (E). Relevance: Assessment and correction.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: CA-2, CA-5, CA-7. Relevance: Assessment and remediation.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.
NIST SP 800-53A Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: assessment results. Relevance: Evidence methods.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Security/privacy control assessment; broader application is an adaptation.

GovKM recommendation boundary: The EICARS requirement-to-evidence record format is proposed; government sources do not establish an EICARS conformance scheme.

R10.4 — Retain authorized human decisions

OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: section II. Relevance: Management accountability.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.
NIST SP 800-37 Revision 2 — Risk Management Framework
Issuing body: National Institute of Standards and Technology. Pinpoint: Authorize step. Relevance: Security authorization.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Security/privacy risk management under applicable Federal policy or voluntary adoption.
OMB M-25-21 — Federal AI use
Issuing body: Office of Management and Budget. Pinpoint: sections 3–4. Relevance: Applicable AI governance.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Covered agency AI uses; high-impact provisions and national security/intelligence exceptions have distinct scopes.
FAR 1.602-1 and 1.603-4 — Contracting authority
Issuing body: Federal Acquisition Regulatory Council. Pinpoint: 1.602-1. Relevance: Contracting authority.
Classification: Regulation — mandatory when applicable. Applicability: Covered Federal contracting, with applicable agency supplements and deviations.

GovKM recommendation boundary: No general prohibition on all automated actions is implied. Identify the actual legal delegation and separately authorize consequential uses.

Federal AI-use, high-impact AI, AI-acquisition and covered LLM procurement requirements have distinct scopes and exceptions. Information preparation does not substitute for any applicable AI-use risk acceptance, information-system authorization, procurement or legal decision.

This section gives relevant official references for each covered checklist item and is not an exhaustive list of every possible obligation. The actual agency, program, records, data, system and contract determine additional duties. The EICARS organization of these tasks, suggested registers and completion checks remain GovKM recommendations unless independently required or adopted.

Version history

November 9, 2026 — Publication authorized by GovKM. Guidance based on checklist and government authority reference package checked November 5, 2026. References must be periodically revalidated.

November 9, 2026 — Expanded implementation guidance, version 0.1. Replaced the shorter implementation text with the reviewed Riverton examples, task-specific approaches, evidence checks and official authority mappings, with Robert Noyes’s approval. Existing URLs and checklist anchors are preserved. No EICARS requirement or GovKM doctrine is amended.