GovKM Proposed Standards and Guidance

Prepare and Cut Over Enterprise Information

Use ten high-level stages to prepare active information while maintaining operations and preserving historical obligations.

GovKM-proposed public draft. Published for public review. Not externally accredited or endorsed.

View the EICARS framework resource

Document

Return to the EICARS guidance index

EICARS implementation guidance — proposed public draft. Checklist coverage: T01, T02, T03, T04, T05, T06, T07, T08, T09, T10. Prepared November 9, 2026. These suggested approaches support the published GovKM-proposed EICARS v0.1 draft; they do not add requirements or grant external accreditation.

Purpose and use

Use ten high-level stages to prepare active information while maintaining operations and preserving historical obligations.

Use this guide within a declared organizational scope, with existing repositories and suitable organizational processes. AI is optional. Examples and suggested evidence are implementation aids; the published standard governs a conformance assessment. The Riverton case below is fictional, not an observed deployment or test result.

Responsible roles

Executive sponsor and transition lead with business, workforce, records, architecture, security, privacy and IT participation.

Assign responsibilities through the organization’s actual instruments. A suggested role in this guide does not itself confer decision authority.

T01 Discover enterprise information

Suggested approach: Define a manageable inventory and discover its sources, custodians, interfaces, formats and dependencies. Record blind spots and preserve current operations. Select discovery methods approved for the systems and data involved; this guidance does not authorize unrestricted crawling.

Riverton example: Riverton inventories active project records and the historical approvals needed for the opening question while staff continue their existing work.

Evidence and completion check: Retain the approved discovery scope, inventory and unresolved sources. Reconcile selected business files against the discovered population.

T02 Model authority and governance

Suggested approach: Approve source responsibilities, delegation limits, approval paths and conflict escalation using actual organizational instruments. Involve business owners and the relevant governance functions before platform changes. Coordination assignments do not replace legally established authority.

Riverton example: Riverton records the separate responsibilities of the opening director, contracting official and records official before configuring shared views.

Evidence and completion check: Retain approved assignments and instruments. Demonstrate a valid approval and an escalation outside the coordinator’s authority.

T03 Design common information architecture

Suggested approach: Agree a common logical architecture describing the information and context required for the declared uses. Map that description to existing repositories and vocabularies. Choose only the fields and structures justified by business, records and access needs. This is not a prescribed technical schema.

Riverton example: Riverton defines the project sources and date meanings needed for a readiness briefing while procurement and HR systems remain authoritative for their respective information.

Evidence and completion check: Keep the approved architecture and representative mappings. Have two offices interpret the same exchanged information consistently.

T04 Prepare existing platforms

Suggested approach: Assess participating platforms for relevant versioning, references, access, retention and exchange capabilities. Identify configuration or capability gaps and test proposed changes safely. Use approved change procedures and avoid expanding access for convenience.

Riverton example: Riverton checks that the project view can reference the intended inspection revision and enforce user permissions before adding an AI connector.

Evidence and completion check: Retain the capability assessment, approved changes and safe demonstrations. Record unsupported controls and any dependent uses that must wait.

T05 Classify artifacts and govern records

Suggested approach: Classify information by business role, sensitivity and records obligations. Establish actual retention, hold, preservation and transfer requirements with the responsible officials. Include necessary supporting context and historical dependencies rather than assessing only the visible main file.

Riverton example: Riverton separates the official procurement file, working schedules and restricted HR material. They need not share one lifecycle or access rule.

Evidence and completion check: Keep classification decisions, schedule items and hold controls. Demonstrate correct handling of representative categories using safe test material.

T06 Prepare the workforce

Suggested approach: Communicate repeatedly about the reasons for change, responsibilities, practice opportunities and dates. Train staff by role, provide accessible instructions and designate support. Let employees practice within a governed trial environment while ordinary services continue. Machine usability should guide the enterprise structure, supported by workable human contribution processes.

Riverton example: Riverton staff practice submitting and finding project evidence without relying on personal folders. Support staff collect problems and update the guidance before cutover.

Evidence and completion check: Retain communications, training coverage, practice findings and support arrangements. Have representative staff complete a realistic task and identify remaining barriers.

T07 Cut over active information

Suggested approach: Approve cutover conditions, reconcile active content and necessary supporting history, and obtain business acceptance. Preserve required records and holds wherever they remain. Define service support, fallback conditions and accountable custody of deferred holdings. Prioritization of active work is not a deletion instruction.

Riverton example: Riverton brings active opening information into the prepared arrangements but retains earlier date approvals and procurement history needed to interpret it. Deferred paper holdings remain assigned and accessible.

Evidence and completion check: Retain the approved cutover population, reconciliation, dependency checks, access checks, preservation decisions and acceptance. Exercise a safe fallback scenario before relying on it.

T08 Assess and remediate governance gaps

Suggested approach: Assess the prepared environment against R01–R10 within the declared scope. Record gaps, responsible owners and corrective actions. Verify corrections with evidence before marking them complete. Do not replace missing demonstrations with an overall readiness percentage.

Riverton example: Riverton finds that inspection identity works but a receiving view omits approval evidence. The interoperability finding remains open until corrected and retested.

Evidence and completion check: Keep domain findings and retest evidence. Show how unresolved material failures limit the assessment outcome or intended use.

T09 Verify suitability for named AI uses

Suggested approach: Determine whether the information environment supports each named AI use, then separately evaluate the proposed model, connector and configuration. Preserve permission and records boundaries during evaluation. Information readiness alone does not authorize deployment or autonomous action.

Riverton example: Riverton first verifies the supporting records, then tests whether its chosen assistant distinguishes the approved December target from the earlier schedule and recognizes pending acceptance.

Evidence and completion check: Retain the environment determination and separate use-specific AI results, limitations and approvals. If no AI is planned, record that decision rather than buying a model to complete the checklist.

T10 Operate and assess historical holdings

Suggested approach: Operate the assigned controls, review changes and maintain corrective action. Plan historical assessment according to risk, preservation obligations and business need. Keep custodians, access routes and dependencies known while archives await detailed review. Reassess affected uses as historical evidence becomes available.

Riverton example: Riverton continues access and records reviews after opening. Older inspection files receive a separate assessment without an unsupported claim that the entire archive is ready.

Evidence and completion check: Keep operating reviews, change assessments, archive priorities and custody evidence. Inspect a deferred holding and demonstrate an authorized request path or record its limitation.

Evidence and completion checks

Agree the population, expected results and acceptance conditions before assessing. Record the date, assessor, evidence reference, observed result and limitation. Use approved safe examples for access, malicious-content or lifecycle tests. Documented policy and observed operating behavior are both relevant; one does not automatically prove the other.

On smaller screens, scroll the table horizontally to view every column.

Item	Suggested evidence and demonstration
T01	Retain the approved discovery scope, inventory and unresolved sources. Reconcile selected business files against the discovered population.
T02	Retain approved assignments and instruments. Demonstrate a valid approval and an escalation outside the coordinator’s authority.
T03	Keep the approved architecture and representative mappings. Have two offices interpret the same exchanged information consistently.
T04	Retain the capability assessment, approved changes and safe demonstrations. Record unsupported controls and any dependent uses that must wait.
T05	Keep classification decisions, schedule items and hold controls. Demonstrate correct handling of representative categories using safe test material.
T06	Retain communications, training coverage, practice findings and support arrangements. Have representative staff complete a realistic task and identify remaining barriers.
T07	Retain the approved cutover population, reconciliation, dependency checks, access checks, preservation decisions and acceptance. Exercise a safe fallback scenario before relying on it.
T08	Keep domain findings and retest evidence. Show how unresolved material failures limit the assessment outcome or intended use.
T09	Retain the environment determination and separate use-specific AI results, limitations and approvals. If no AI is planned, record that decision rather than buying a model to complete the checklist.
T10	Keep operating reviews, change assessments, archive priorities and custody evidence. Inspect a deferred holding and demonstrate an authorized request path or record its limitation.

Record a gap where the required outcome is not demonstrated. Assign an owner and review date, then verify any correction. Completion of this page alone does not demonstrate conformance with all ten domains, certify legal compliance, approve an AI deployment or authorize autonomous actions.

Common mistakes

Stopping current services for discovery; treating cutover as deletion authority; deferring archives without accountable custody.

Continue the checklist

Use this page with the EICARS standard, the identity guide and the full Riverton scenario. No particular product, model or repository migration is required.

Implementation overview

Suggested operating approach: assign the responsible roles, confirm applicability, implement suitable controls in the existing environment, examine operating evidence and track unresolved gaps. Tailor the methods to scale and risk. Maintain current services during preparation and preserve records, access and legal obligations throughout.

Standards traceability and references

Government Authority and References

U.S. federal reference review: November 9, 2026. These are GovKM mappings of relevance, not government endorsement or a legal compliance determination. Statutes and regulations are mandatory only within their scope; federal policy applies to covered agencies and uses; technical guidance and voluntary resources require the stated selection, adoption or contractual basis. Private and nonfederal organizations must identify their own governing requirements.

The eCFR is authoritative but unofficial. Retrieved Title 36 pages displayed currency through November 5, 2026. Source retrieval does not establish exhaustive legal currency or clause-level implementation compliance. Check current agency supplements, deviations, court orders, schedules, contracts and later amendments. Add the organization’s actual instruments and the qualified official’s applicability determination.

T01 — Discover enterprise information

NARA inventory, scheduling and disposition guide
Issuing body: National Archives and Records Administration. Pinpoint: Knowing Your Records. Relevance: Inventory guidance.
Classification: Official guidance. Applicability: Federal records inventory and scheduling work.
44 U.S.C. 3506 — Information resources management responsibilities
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: (b)(4). Relevance: Information inventory.
Classification: Statute — mandatory when applicable. Applicability: Agencies covered by the Paperwork Reduction Act definitions and relevant subsections.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: CM-8. Relevance: System inventory.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.
44 U.S.C. 3511 — Data inventory and Federal data catalogue
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: 3511(a). Relevance: Federal data inventory.
Classification: Statute — mandatory when applicable. Applicability: Covered Federal data assets; statutory practicability, disclosure and national security qualifications apply.

GovKM recommendation boundary: The cited sources support the underlying governance outcome. This checklist’s packaging, evidence register and assessment format are GovKM recommendations unless separately adopted.

T02 — Model authority and governance

36 CFR 1220.32 and 1220.34 — Records program responsibilities
Issuing body: National Archives and Records Administration. Pinpoint: 1220.34(a), (c), (d). Relevance: Records responsibilities.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1222.22, 1222.24, 1222.26 and 1222.28 — Documentation and recordkeeping
Issuing body: National Archives and Records Administration. Pinpoint: 1222.26(a)(2). Relevance: Record office.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: section II. Relevance: Control responsibility.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.

T03 — Design common information architecture

36 CFR 1236.12 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.12(a), (d). Relevance: Design and interchange.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1222.22, 1222.24, 1222.26 and 1222.28 — Documentation and recordkeeping
Issuing body: National Archives and Records Administration. Pinpoint: 1222.26–1222.28. Relevance: Recordkeeping requirements.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
NARA Universal ERM Requirements Version 3
Issuing body: National Archives and Records Administration. Pinpoint: Metadata section. Relevance: ERM guidance.
Classification: Official requirements aid — tailor to underlying authority. Applicability: Federal ERM programs and acquisitions; voluntarily useful elsewhere.

GovKM recommendation boundary: Common logical arrangements and vocabulary are recommended. No cited source requires a single repository or unified technical schema.

T04 — Prepare existing platforms

36 CFR 1236.12 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.12. Relevance: System preparation.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
FIPS 200 — Minimum security requirements
Issuing body: National Institute of Standards and Technology. Pinpoint: control selection. Relevance: Security minimums.
Classification: Federal standard — mandatory within scope. Applicability: Covered Federal information and non-national-security information systems.
Section 508 Revised ICT Standards
Issuing body: U.S. Access Board. Pinpoint: E201–E206 as applicable. Relevance: ICT accessibility.
Classification: Regulation — mandatory when applicable. Applicability: Federal ICT within 29 U.S.C. 794d and 36 CFR Part 1194; apply E202 exceptions and E205 scoping.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: CM-6, AC-6. Relevance: Configuration and least privilege.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.
NIST SP 800-171 Revision 3 — Nonfederal CUI protection
Issuing body: National Institute of Standards and Technology. Pinpoint: applicable contract-selected requirements. Relevance: Nonfederal CUI.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Nonfederal systems handling CUI under applicable agreements or contracts. The incorporated edition governs; a newer NIST publication does not automatically amend a contract.

T05 — Classify artifacts and govern records

44 U.S.C. 3301 — Federal record definition
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: 3301. Relevance: Record status.
Classification: Statute — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
NARA General Records Schedules
Issuing body: National Archives and Records Administration. Pinpoint: applicable schedule item. Relevance: Disposition.
Classification: Approved disposition authorities — apply only to covered series. Applicability: Covered common Federal administrative records; agency-specific authorities and deviations may apply.
32 CFR Part 2002 — Controlled Unclassified Information
Issuing body: National Archives and Records Administration. Pinpoint: 2002.10–2002.14. Relevance: CUI categories.
Classification: Regulation — mandatory when applicable. Applicability: Executive Branch CUI; nonfederal duties require applicable law, agreement or contract.
FIPS 199 — Security categorization
Issuing body: National Institute of Standards and Technology. Pinpoint: categorization standard. Relevance: Security impact.
Classification: Federal standard — mandatory within scope. Applicability: Covered Federal information and non-national-security information systems.
36 CFR 1236 Subparts D and E — Federal records digitization
Issuing body: National Archives and Records Administration. Pinpoint: 1236.30–1236.56, as applicable. Relevance: Scoped digitization.
Classification: Regulation — mandatory when applicable. Applicability: Digitization of temporary or permanent Federal records, according to the applicable subpart.

GovKM recommendation boundary: Record status, sensitivity, CUI marking and security impact are distinct determinations and must not be collapsed into one label.

T06 — Prepare the workforce

36 CFR 1220.32 and 1220.34 — Records program responsibilities
Issuing body: National Archives and Records Administration. Pinpoint: 1220.34(f). Relevance: Records instruction.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
NARA Bulletin 2017-01 — Records management training
Issuing body: National Archives and Records Administration. Pinpoint: training requirements and promising practices. Relevance: Role-specific learning.
Classification: Agency bulletin — training requirements within stated scope. Applicability: Agency personnel creating, receiving, accessing or using Federal records, including covered contractors.
44 U.S.C. 3506 — Information resources management responsibilities
Issuing body: U.S. Congress; Office of the Law Revision Counsel. Pinpoint: (b)(5). Relevance: Information management training.
Classification: Statute — mandatory when applicable. Applicability: Agencies covered by the Paperwork Reduction Act definitions and relevant subsections.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: AT-2, AT-3. Relevance: Security awareness.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.

GovKM recommendation boundary: A practice period, communications cadence and support model are implementation recommendations; required training details remain source-specific.

T07 — Cut over active information

36 CFR 1236.14 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.14. Relevance: Migration preservation.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR Part 1223 — Vital records
Issuing body: National Archives and Records Administration. Pinpoint: 1223.14. Relevance: Vital records availability.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1226.10–1226.20 — Applying disposition authorities
Issuing body: National Archives and Records Administration. Pinpoint: 1226.10–1226.18. Relevance: Retention limits.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
NIST SP 800-53 Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: CP-2, CP-10. Relevance: Contingency arrangements.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Selected controls, baselines, tailoring and applicable policy or contracts determine obligations. Not every catalog control is universally mandatory.

GovKM recommendation boundary: An active-information-first cutover and rehearsal period are optional implementation choices. They do not authorize abandoning archives or required dependencies.

T08 — Assess and remediate governance gaps

36 CFR 1220.32 and 1220.34 — Records program responsibilities
Issuing body: National Archives and Records Administration. Pinpoint: 1220.34(j). Relevance: Records evaluation.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: section IV. Relevance: Control assessment.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.
NIST SP 800-53A Revision 5 with Release 5.2.0
Issuing body: National Institute of Standards and Technology. Pinpoint: assessment procedures. Relevance: Evaluation methods.
Classification: Government technical guidance — conditional on selection or adoption. Applicability: Security/privacy control assessment; broader application is an adaptation.

GovKM recommendation boundary: The ten-domain EICARS review is a proposed assessment framework, not a government-required test program.

T09 — Verify suitability for named AI uses

NIST AI RMF 1.0
Issuing body: National Institute of Standards and Technology. Pinpoint: Map and Measure. Relevance: Voluntary AI evaluation.
Classification: Voluntary government framework. Applicability: Organizations evaluating AI; a policy or contract can incorporate selected practices.
NIST AI 600-1 — Generative AI Profile
Issuing body: National Institute of Standards and Technology. Pinpoint: relevant suggested actions. Relevance: Generative AI risks.
Classification: Voluntary government guidance. Applicability: Generative AI risk management.
OMB M-25-21 — Federal AI use
Issuing body: Office of Management and Budget. Pinpoint: 4(b), section 5. Relevance: Covered high-impact AI.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Covered agency AI uses; high-impact provisions and national security/intelligence exceptions have distinct scopes.
OMB M-25-22 — Federal AI acquisition
Issuing body: Office of Management and Budget. Pinpoint: section 4. Relevance: Covered acquisition.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Covered Federal AI acquisition; obligations flow to vendors through applicable procurement instruments.

GovKM recommendation boundary: Information preparation alone does not authorize an AI deployment or certify model accuracy.

T10 — Operate and assess historical holdings

36 CFR 1220.32 and 1220.34 — Records program responsibilities
Issuing body: National Archives and Records Administration. Pinpoint: 1220.34(j). Relevance: Program evaluation.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1236.14 — Electronic records controls
Issuing body: National Archives and Records Administration. Pinpoint: 1236.14(c). Relevance: Offline preservation.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
36 CFR 1226.10–1226.20 — Applying disposition authorities
Issuing body: National Archives and Records Administration. Pinpoint: 1226.10–1226.18. Relevance: Disposition constraints.
Classification: Regulation — mandatory when applicable. Applicability: Federal agency records within the source’s statutory and regulatory scope. Not a general obligation on private organizations.
OMB Circular A-123 revised March 10 2026
Issuing body: Office of Management and Budget. Pinpoint: section III(E), IV. Relevance: Control monitoring.
Classification: Federal policy — mandatory provisions within stated scope. Applicability: Executive agencies as defined in its Applicability section.

A newer NIST SP 800-171 edition does not automatically amend a contract. The applicable acquisition instrument and incorporated edition govern the nonfederal system’s obligations.

Federal AI-use, high-impact AI, AI-acquisition and covered LLM procurement requirements have distinct scopes and exceptions. Information preparation does not substitute for any applicable AI-use risk acceptance, information-system authorization, procurement or legal decision.

This section gives relevant official references for each covered checklist item and is not an exhaustive list of every possible obligation. The actual agency, program, records, data, system and contract determine additional duties. The EICARS organization of these tasks, suggested registers and completion checks remain GovKM recommendations unless independently required or adopted.

Version history

November 9, 2026 — Publication authorized by GovKM. Guidance based on checklist and government authority reference package checked November 5, 2026. References must be periodically revalidated.

November 9, 2026 — Expanded implementation guidance, version 0.1. Replaced the shorter implementation text with the reviewed Riverton examples, task-specific approaches, evidence checks and official authority mappings, with Robert Noyes’s approval. Existing URLs and checklist anchors are preserved. No EICARS requirement or GovKM doctrine is amended.