GovKM Proposed Standards and Guidance
Support Readiness Claims with Assessment Evidence
Plan a scoped assessment, retain operating evidence and report failures and limitations without overstating conformance.
GovKM-proposed public draft. Published for public review. Not externally accredited or endorsed.
View the EICARS framework resourceDocument
Return to the EICARS guidance index
EICARS implementation guidance — proposed public draft. Checklist coverage: V01, V02, V03, V04. Prepared November 9, 2026. These suggested approaches support the published GovKM-proposed EICARS v0.1 draft; they do not add requirements or grant external accreditation.
Purpose and use
Plan a scoped assessment, retain operating evidence and report failures and limitations without overstating conformance.
Use this guide within a declared organizational scope, with existing repositories and suitable organizational processes. AI is optional. Examples and suggested evidence are implementation aids; the published standard governs a conformance assessment. The Riverton case below is fictional, not an observed deployment or test result.
Responsible roles
Assessment lead, domain owners and the accountable approving official; independent review where required.
Assign responsibilities through the organization’s actual instruments. A suggested role in this guide does not itself confer decision authority.
V01 Approve the assessment plan
Suggested approach: Approve the assessment population, expected results, evidence methods, sampling rationale, acceptance criteria and material-failure rules before evaluation. Include all ten requirement domains while documenting conditional instances that do not apply. Risk-based sampling must not be described as exhaustive verification.
Riverton example: Riverton’s plan includes a current briefing, a historical date question, an access denial and an unresolved evidence case. It states which offices, records and routes are tested.
Evidence and completion check: Keep the signed plan and declared coverage. Have a reviewer explain why the sample is appropriate and what conclusions cannot be extended to untested populations.
V02 Examine interview and demonstrate
Suggested approach: Use examination, interviews and safe demonstrations in combination as appropriate. Include ordinary operations, exceptions and prohibited outcomes. Confirm that documented policies correspond to observed behavior. Destructive, adversarial and access checks require approved material and scope; this guide does not authorize production disruption.
Riverton example: Riverton reviews its access policy, interviews the owner and tests an unauthorized synthetic user. The policy alone cannot demonstrate that the search index actually enforces the restriction.
Evidence and completion check: Retain the method, approved test material, expected behavior and observed result. Record conflicting evidence rather than selecting only the most favorable observation.
V03 Record evidence and limitations
Suggested approach: Record the assessor, date, source locations, tested population, sample selection and limitations. Use inspectable evidence sufficient for another authorized reviewer to understand the determination. When reporting counts, name the denominator and unit, such as tested references or selected access paths; avoid an unsupported enterprise readiness score.
Riverton example: Riverton reports that 18 of 20 selected references resolved, names the two failures and limits the result to that sample. It does not claim 90 percent conformance across all requirements.
Evidence and completion check: Retain the assessment record and usable evidence references. Ask another reviewer to reproduce a selected observation and identify where the stated scope ends.
V04 Keep failures and accepted risks visible
Suggested approach: Keep not-demonstrated requirements, unassessed items, missing evidence, approved conditional non-applicability and accepted risks visible. A risk acceptance decision does not turn a failed requirement into a pass. Report a readiness assessment with gaps unless the published draft’s scoped conformance conditions are actually satisfied.
Riverton example: Riverton’s approving official accepts temporary operational risk while an export defect remains open. The assessment still reports that requirement as not demonstrated and limits dependent use.
Evidence and completion check: Retain the determination, rationale, official decisions and corrective actions. A conformance statement must name the proposed draft, scope, date, methods, evidence and limitations, without suggesting external accreditation or AI certification.
Evidence and completion checks
Agree the population, expected results and acceptance conditions before assessing. Record the date, assessor, evidence reference, observed result and limitation. Use approved safe examples for access, malicious-content or lifecycle tests. Documented policy and observed operating behavior are both relevant; one does not automatically prove the other.
On smaller screens, scroll the table horizontally to view every column.
| Item | Suggested evidence and demonstration |
|---|---|
| V01 | Keep the signed plan and declared coverage. Have a reviewer explain why the sample is appropriate and what conclusions cannot be extended to untested populations. |
| V02 | Retain the method, approved test material, expected behavior and observed result. Record conflicting evidence rather than selecting only the most favorable observation. |
| V03 | Retain the assessment record and usable evidence references. Ask another reviewer to reproduce a selected observation and identify where the stated scope ends. |
| V04 | Retain the determination, rationale, official decisions and corrective actions. A conformance statement must name the proposed draft, scope, date, methods, evidence and limitations, without suggesting external accreditation or AI certification. |
Record a gap where the required outcome is not demonstrated. Assign an owner and review date, then verify any correction. Completion of this page alone does not demonstrate conformance with all ten domains, certify legal compliance, approve an AI deployment or authorize autonomous actions.
Common mistakes
Extrapolating a small sample without limits; replacing failures with an average score; calling risk acceptance a pass.
Continue the checklist
Use this page with the EICARS standard, the identity guide and the full Riverton scenario. No particular product, model or repository migration is required.
Implementation overview
Suggested operating approach: assign the responsible roles, confirm applicability, implement suitable controls in the existing environment, examine operating evidence and track unresolved gaps. Tailor the methods to scale and risk. Maintain current services during preparation and preserve records, access and legal obligations throughout.
Standards traceability and references
Version history
November 9, 2026 — Publication authorized by GovKM. Guidance based on checklist and government authority reference package checked November 5, 2026. References must be periodically revalidated.
November 9, 2026 — Expanded implementation guidance, version 0.1. Replaced the shorter implementation text with the reviewed Riverton examples, task-specific approaches, evidence checks and official authority mappings, with Robert Noyes’s approval. Existing URLs and checklist anchors are preserved. No EICARS requirement or GovKM doctrine is amended.