This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 13

Book 13 — Governance, Drift & Evidence

Governance That Doesn’t Decay

Why compliance decays the day after the audit: one authoritative record, controlled and provenanced change, deterministic rules, continuous drift detection, system-produced evidence, adapters, and a tempo where routine remediation goes to a machine

Book 13 of the Federal Modernization Workbook: why point-in-time compliance decays, drift as the primary threat, one authoritative record and its six planes, change control and provenance, deterministic governance and the three-layer rule model, the drift engine, evidence over attestation, the adapter model, who governs, ticket to machine, reciprocity and ongoing authorization, governance at scale, and records, evidence and retention.

Status — baseline book

This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book replaces the workbook’s executive governance series, its architecture doctrine pages (single source of truth, the six planes, change control and provenance, the three-layer rule model, the drift engine, the evidence chain), the governance executive briefs, the modernization governance and ticket-to-machine whitepapers, and the continuous-monitoring project charter and plan. Every external claim was checked against a primary source and carries a note with its own check date. The earlier pages are kept in the repository’s archive/b13-governance/ folder, and their old addresses forward to the chapters that replaced them.

Download and present

b13-governance-bundle.docx: the whole book as one Word document, regenerated on every site deploy.

15-minute presentation (about 13 minutes narrated): the Why / What / Who / How deck is on the Presentations page.

Ticket-to-Machine reference (about 10 minutes narrated): Appendix B as a narrated walk-through of the coordination loop, the lanes, the tempo and the worked examples, on the Presentations page.

Technical deep dive (about 50 minutes live, 19 narrated): drift and the authoritative record, deterministic rules and the drift engine, evidence and adapters, and who governs, reciprocity and scale, in modules on the Presentations page.

Executive briefing (about 30 minutes live, 14 narrated): for the CIO, CISO, authorizing officials and program office: why compliance decays, one record and one change path, no new AD dependencies from G0, evidence that re-runs, the drift engine, exceptions and ongoing authorization, with each decision’s owner and timing, on the Presentations page.

A point-in-time assessment measures a moment. The estate starts drifting the next morning: a setting changes, an exception outlives its reason, a copy of the record starts being written to, and nothing fails loudly. NIST’s own guidance calls traditional reauthorization “static” and says ongoing authorization isn’t practical without substantial automation. Book 13 is about the governance that makes it practical. It starts from one authoritative record, a single source of truth whose every change is controlled and provenanced. Rules evaluate deterministically against that record, and a drift engine compares the actual state of every platform to it, continuously. Evidence is produced by the systems rather than attested by people, and adapters translate each platform into the same evidence. Routine remediation becomes a ticket to a machine, with people kept on the decisions that matter and the actuation ladder setting how far automation may go. Done that way, one body of continuously produced evidence supports each agency’s ongoing authorization, and reuse of authorizations across agencies becomes a matter of evidence rather than paperwork. That evidence, and the authoritative record itself, are also federal records: Chapter 13 separates the program’s meanings of “record” from the legal one and sets out the retention, hold and transfer rules that apply.

Why, what, who, how

	Question	Chapters
Why	Why does compliance decay the day after the audit, and why is drift the primary threat?	01, 02
What	One authoritative record, controlled change, deterministic rules, the drift engine, evidence over attestation, and the adapters that make it platform-neutral	03, 04, 05, 06, 07, 08
Who	Who keeps the record, approves rule changes, reviews drift and accepts exceptions	09
How	Run at machine tempo, support reciprocity and ongoing authorization, govern at scale, keep the evidence as federal records, and govern applications, secrets and configuration drift	10, 11, 12, 13, 14

Appendices: A — Requirements mapping · B — Ticket-to-machine reference

Reading paths

Executives (20 minutes): Chapters 01, 09 and 11, or the 15-minute presentation.
Governance leads and stewards: Chapters 03, 04, 06 and 09, then 12.
Engineers building the platform: Chapters 05, 06, 07 and 08, with Appendix B.
Identity and platform engineers closing assessment findings: Chapter 14, for the application governance record, secrets governance and configuration drift exports, then Chapter 12’s disposition register for skipped and unevaluated results.
ISSOs and authorizing officials: Chapters 01, 07, 09 and 11, with Appendix A.
Records officers: Chapter 13, which separates the authoritative record and audit evidence from a federal record and says which records rules apply to the evidence the kits produce, then Chapter 09.

Where this book sits in the workbook

This is Book 13 of the Federal Modernization Workbook. The principles it puts into operation are in Book 00, Chapter 04; the transformation engine and its actuation ladder in Book 01, Chapter 11; the evidence contract and the security-operations side of continuous monitoring in Book 12; and the FedRAMP 2026 rules and the authorization boundary in Book 10. The Federal Compliance Governance Substrate Integration Overview remains in the repository for control-level depth.

New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.

Chapters

Title	Description
Chapter 01 — Why Compliance Decays the Day After the Audit	Why federal IT governance fails for structural reasons rather than lack of effort: four failure modes, the compliance paradox of point-in-time assessment against an estate that changes daily, what NIST SP 800-37, SP 800-137, FISMA and OMB Circular A-130 already say about ongoing authorization, and the deterministic-evidence response.
Chapter 02 — Drift Is the Primary Threat	Why drift, the silent divergence between the authoritative record and the running estate, is the main way controls fail between assessments: where it comes from, why it raises no alarm, what NIST SP 800-53 CM-2, CM-3, CM-6 and CA-7 ask for, the program’s five drift classes, and what treating drift as evidence changes for operations and the authorizing official.
Chapter 03 — One Authoritative Record: Single Source of Truth and the Six Planes	What the program’s authoritative record is and where it lives, how runtime systems consume it without copying it, the provenance chain that ties every derived artifact back to it, the six control planes and what each is authoritative for, and how the record relates to the HR, identity and attribute sources the other books define.
Chapter 04 — Change Control and Provenance	The five-clause path every move, add, change, deletion and reset travels; where work comes from; pull-request-based change to the authoritative record; separate identities for governance and execution; provenance for every state change and the rule that no closure counts without its proof; and how the path lines up with CM-3, CM-5, AU-10 and SA-10.
Chapter 05 — Deterministic Governance: The Three-Layer Rule Model	Why governance rules have to evaluate deterministically, the three layers the program keeps them in (authoritative rules, policy mappings and runtime enforcement), how each layer is written as code and reviewed, how the layers line up with drift classes and with security controls, and the honest limits of determinism.
Chapter 06 — The Drift Engine	The program’s one drift model: what the drift engine compares, its five drift classes and how the drift checks in Books 00 to 03 and Book 05 map onto them, how severity is computed, the cadence of detection, what the engine remediates and what it never does, the remediation contract every finding leaves, and an honest account of what is built today.
Chapter 07 — Evidence Over Attestation	Why evidence the systems produce is a stronger basis for an authorization than a person’s signed statement; what NIST and FedRAMP already say about automated assessment; the evidence chain from source to package; the provenance envelope; what hashes, hash chains and signatures each prove; and what an assessor can verify without trusting the operator.
Chapter 08 — The Adapter Model	What an adapter is (a translator from one platform’s native state into the program’s common record and evidence), the two kinds and five missions, the contract every adapter declares, why read-only comes first, how adapters are versioned, tested and retired, and how the model keeps the program platform-neutral.
Chapter 09 — Who Governs	Who keeps the authoritative record and who decides what it says, who approves changes to the rules, who reviews drift and accepts exceptions, the governance board and its cadence, the authorizing official’s role, and records management for the record itself, with a responsibility matrix consistent with Book 00 Chapter 07, Book 01 Chapter 09 and Book 12 Chapter 10.
Chapter 10 — Operational Tempo: Ticket to Machine, Not Ticket to Human	The tempo at which detection, remediation and escalation run; why routine remediation should be a ticket that authorizes a machine rather than one that sends a person to a console; which operation classes qualify; how approval gates and the actuation ladder keep humans on the decisions that matter; the declared-exception fallback; and how the service desk fits.
Chapter 11 — Reciprocity, Indicators and One Authorization	What reciprocity and reuse of authorizations mean under NIST SP 800-37, OMB Circular A-130, OMB M-24-15 and FedRAMP’s Consolidated Rules for 2026; how a shared service can carry one authorization package that many agencies reuse; what the 2026 Key Security Indicators are and whom they bind; how one body of continuously produced evidence supports ongoing authorization; and which parts of the program’s reciprocity model are its own design.
Chapter 12 — Governance at Scale and the Continuous-Monitoring Program	How the program runs governance across many systems, teams, programs and authorization boundaries without per-program exceptions: what it keeps small and what it lets grow, boundaries as governed objects, the continuous-monitoring program run as a chartered project with phases and a cadence, coverage classification and the gap closure register, how gaps close, and the honest limits of what any governance platform covers.
Chapter 13 — Records, Evidence and Retention	Four things the workbook calls a record (the authoritative technical record, audit evidence, a federal record and operational data) and how they differ; when audit evidence and logs are federal records and which General Records Schedule items commonly apply; disposition authority; legal holds and records freezes, including how to suspend an evidence purge or rotation; transfer at decommissioning; who owns what; how immutable storage interacts with disposition; and a likely records category for each kit’s evidence output.
Chapter 14 — Applications, Secrets and Configuration Drift	The governance record every application and service principal carries (business owner, technical owner, data classification, permissions justification, credential type, last activity, review date and retirement disposition), and the rule that no high-impact workload is ownerless; secrets governance, with the default prohibition on long-lived client secrets, approved exception criteria, vaulting, expiry limits, rotation windows, the managed-identity preference and source-code scanning; and continuous exports and drift rules for Conditional Access, PIM, authentication methods, Intune, application permissions, Purview, Exchange protection and network access, with the baseline diff and the remediation workflow. Each with the five control states, a How section, change safety, government-cloud availability and the federal requirements it supports.
Appendix A — Requirements Mapping: Controls, Mandates and Books	A compliance-enabling map, not a compliance claim: the NIST SP 800-53 Rev. 5 controls Book 13 relies on (configuration management, assessment and authorization, continuous monitoring, non-repudiation and provenance, plus the remediation and access controls behind the ticket-to-machine lanes), with their NIST and FedRAMP baselines and the FedRAMP 2026 indicators that cite them; then the RMF tasks, SP 800-137, OMB Circular A-130, OMB M-24-15, the FedRAMP Consolidated Rules for 2026 and the CISA directives, each mapped to the Book 13 chapter that carries it and to the other workbook books; then the requirements that are cited but don’t say what is claimed.
Appendix B — Ticket-to-Machine Reference	The reference tables and worked examples behind Chapter 10: the coordination loop and the five-clause request chain, which operation classes go to a machine, which stay with a human, which are handled by protocol and which become declared exceptions, the approval each class needs and the evidence each produces, the severity tempo, four illustrative worked examples, and the failure modes a reference implementation review found.

Version and revision history

Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.

Versions of this book, newest first
Version	Edition	Date	Changes
2.0	2026.11.5	2026-11-08	Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 13: fix confirmed crosswalk errors (plane inputs, POA&M rule, exception approver, evidence-plane pointers, retention owner) (#380); External Partner Person: light edits to existing pages, held findings, links (E0 to E9) (#419); Book 13: fix inconsistency findings (terms, severities, escalation, record class, evidence bundle) (#422); Decisions fix pass for Books 13 to 19: Book 18 gates and roles, Db2 spelling, Book 15 approvers, Book 16 criteria, Book 17 roles, Book 13 drift mapping (#456); Claim language: supports, not satisfies (rule, check, first sweep) (#474); Consistency read C2: full read of Book 11 Ch07/08, Book 12 Ch12, Book 13 Ch05/06/App B (#485); and 3 more (all changes)
1.5	2026.11.4	2026-11-05	Approve ten pages on Mike’s word, and drop two names from the briefs (#360); Sweep stale wording, and link sources on every deck (#361)
1.4	2026.11.3	2026-11-05	Book decks: narration names the book or the original source, and 68 videos re-exported (#344)
1.3	2026.11.2	2026-11-02	Book 13, Chapter 13: records, evidence and retention (#316); Privacy for workforce identity: Book 03 Chapter 14, and privacy sections in six books (#317)
1.2	2026.11.1	2026-11-01	Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282)
1.1	2026.11	2026-11-01	Move the decks and narration audio out of git, onto edition 2026.10 (#260); Retire Research: move each page to a home by type (guides, training, reference, evaluations, explainers) (#269)
1.0	2026.10	2026-10-31	First edition (17 merged changes since the book began)