Govern digital services with a decision trail that survives audits, leadership changes, and technology change.

Build a current source hierarchy before building controls

Separate legal authority, executive policy, standards, agency policy, contractual requirements, and optional good practice. Those categories can overlap, but they do not have identical force or scope. Record the source, version or date, applicability decision, responsible interpreter, and next review trigger for every material requirement.

This is an orientation aid, not a universal applicability determination. State, local, tribal, territorial, national, sector-specific, grant, records, privacy, accessibility, acquisition, and security obligations must be mapped to the actual organization and service.

Use internal control as an operating discipline, not an annual document exercise

The 2026 Circular A-123 emphasizes a preventative, risk-informed approach and states that responsibility for internal control exists across organizational levels. The 2025 Green Book likewise emphasizes preventive controls and adds stronger attention to documented risk assessments, significant changes, fraud, improper payments, and information security. Together, those changes support a practical technology-governance principle: major system, vendor, process, identity, data, or service changes should trigger control reassessment rather than waiting for an annual calendar event.

For a digital service, define the control objective before documenting the control activity. A control objective might address authorized access, complete records, accurate benefit calculations, recoverable data, valid approvals, protected sensitive information, or reliable public disclosure. Then identify the activity, owner, frequency or trigger, evidence, failure condition, escalation path, and remediation process.

Do not force every technology control into one giant compliance spreadsheet. Maintain enough linkage that leadership can move from risk to control to evidence to finding to corrective action. Where different authorities use different terminology, preserve the mapping rather than pretending the language is identical.

Design governance around decision rights and escalation

Committees are useful only when they have defined decisions to make. Establish charters that state scope, authority, required participants, quorum where appropriate, evidence expectations, escalation conditions, and the record produced after a decision. Avoid creating separate boards that repeatedly review the same project without knowing which body is authoritative.

A material digital initiative often needs an executive or program sponsor, technology owner, security owner, privacy or legal reviewer when applicable, records owner, procurement or contracting participant, financial or risk participant, accessibility stakeholder, data owner, implementation lead, and operational service owner. The exact roles vary, but gaps should be deliberate rather than accidental.

The best governance packet is concise. Leaders should see the decision requested, why it matters now, current evidence, unresolved issues, options, operational impact, cost or resource implications where available, risk owner, recommendation, and conditions. Supporting technical material can remain linked beneath that summary.

Connect AI governance to the same operating system

OMB M-25-21 replaced the earlier M-24-10 federal AI governance framework. It requires agencies to retain or designate Chief AI Officers and establishes AI-governance responsibilities, including additional governance-board requirements for CFO Act agencies. It also defines safeguards for high-impact AI uses. Agencies should use the current memorandum rather than copied M-24-10 checklists.

Operationally, AI governance should connect inventory, intended purpose, owner, data boundary, model or system version, connected tools, evaluation evidence, human oversight, supplier evidence, incident path, monitoring, and change control. The governance decision should make clear which facts came from the vendor and which findings came from the agency.

For implementation mechanics, use the current AI Governance Implementation Guide, AI Model Evaluation Operations Guide, and AI Incident Response Guide.

Make procurement part of governance before the solicitation is locked

Technology governance loses leverage when security, accessibility, records, migration, exit, AI, data, and operational requirements arrive after vendor selection. M-25-22 reinforces cross-functional engagement for federal AI acquisition and emphasizes clear requirements, performance, and lifecycle risk. The same discipline is useful beyond AI: involve the roles that will own risk and operations while requirements and evaluation criteria can still change.

For each material purchase, preserve the operating problem, market research, mandatory gates, weighted preferences, evidence requests, evaluation record, exceptions, acceptance criteria, implementation dependencies, change controls, continuity requirements, and exit conditions. A vendor response should distinguish current product behavior from configuration, customization, roadmap, partner dependency, and unsupported assertion.

Federal acquisition policy is actively changing. Verify the current FAR text, agency supplements, class deviations, and solicitation-specific instructions at the decision date rather than embedding an old FAR citation into a reusable template and assuming it remains complete.

Carry supplier evidence from selection into operations

Supplier governance should not end with a security questionnaire. Record which supplier facts materially supported the decision, what was independently verified, what remains uncertain, which contract conditions mitigate risk, and which supplier changes reopen review.

For ICT due diligence, final NIST SP 1326 provides five useful lenses: foreign ownership, control, or influence; provenance; resilience; foundational cybersecurity practices; and supply-chain tiers. Zeph Tech's current NIST SP 1326 buyer analysis turns those lenses into evidence requests and review triggers.

Cloud evidence also changes over time. The current FedRAMP 20x buyer briefing explains why reusable certification evidence still needs to be connected to the agency's own use, boundary, integrations, risk decision, evidence-access path, and post-award oversight.

Govern the whole digital service, not only the system of record

A public service is usually a chain: identity, website, forms, SaaS, APIs, payment or scheduling components, documents, notifications, staff workflows, records, analytics, vendors, and support. Governance should identify the owner and evidence for the complete user journey, including the handoffs between components.

Accessibility belongs in this operating model. For applicable U.S. federal acquisition, Section 508 requirements should be defined and evaluated during procurement. State, local, and HHS-funded entities may also face separate accessibility obligations. Use the current accessibility procurement checklist and government web-accessibility timeline as operational aids, while confirming actual legal applicability with the responsible authority.

Records, retention, legal hold, public disclosure, privacy, and data minimization should likewise be designed into workflows rather than left to an end-of-project policy review. Record which system is authoritative, how history is preserved, how exports work, what deletion means, and how a future migration will reconstruct relationships and audit context.

Use UK and EU frameworks as scoped authorities or comparators—not as generic U.S. requirements

The UK Orange Book, updated July 29, 2026, provides a current risk-management and assurance framework for UK central government. The UK procurement environment also changed materially: organizations subject to the UK regime should use current Procurement Act 2023 guidance rather than treating the former Public Contracts Regulations framework as the default current regime.

In the EU, the Interoperable Europe Act requires interoperability assessment before certain new or substantially modified binding requirements affecting trans-European digital public services. Article 3's assessment provisions apply from January 12, 2025. The practical governance lesson is broader: when policy or architecture can create cross-organizational data-exchange barriers, assess interoperability before the requirement hardens into implementation.

These international frameworks should be mapped only where they actually apply or where an organization intentionally adopts them as a comparator. A global framework matrix should have a jurisdiction and applicability rationale so a useful reference does not silently become a false legal requirement.

Build an assurance map instead of repeatedly asking everyone for evidence

Map each material risk or control objective to the evidence source and assurance provider already available. First-line operational evidence, security monitoring, compliance reviews, quality testing, independent audit, Inspector General work, vendor assessment, external certification, user complaints, and service metrics can all contribute different forms of assurance.

The governance function should know where assurance is strong, duplicated, stale, or missing. A dashboard that counts closed audit items but cannot show whether the underlying service risk changed is weaker than a smaller record that links findings to current controls, evidence, owners, and residual risk.

Corrective actions need closure evidence and a trigger for validating effectiveness after implementation. Closing a ticket because a policy was updated is insufficient if the original finding concerned actual system behavior.

Measure whether governance changes decisions and outcomes

Avoid dashboards made only of activity counts. Meetings held, policies published, questionnaires completed, or employees trained may be useful leading indicators, but they do not prove the service is controlled or the governance decision was sound.

A practical 90-day governance reset

1. Days 0–30

   Reconcile authority and inventory. Replace superseded source references; identify material systems, suppliers, AI uses, critical services, current owners, unresolved findings, and major decisions without a current record.

2. Days 31–60

   Fix decision rights and evidence. Update governance charters, define mandatory gates, connect risks to controls and evidence, assign aging exceptions, and select a small set of service and control indicators leadership will actually use.

3. Days 61–90

   Exercise the model. Run one real technology decision, one supplier review, one material-change review, and one corrective-action closure through the new process. Record where evidence or authority was missing and change the workflow before scaling it.

Questions for the next executive governance review

• What exact decision is being requested, and who is accountable for it after approval?
• Which current authorities and policies apply, and when were those sources last verified?
• What material evidence supports the recommendation, and what remains supplier assertion or unresolved uncertainty?
• Which requirement is a mandatory gate rather than a weighted preference?
• What change in system, supplier, data, law, threat, scope, or user population forces this decision to be reopened?
• How will we know the implemented control works rather than merely exists?
• What accessibility, records, privacy, cybersecurity, continuity, and exit consequences exist across the complete service journey?
• If the program fails or the vendor exits, what evidence and operational capability remain with the organization?

Primary sources used for this 2026 revision

• OMB Circular A-123 — Revised March 10, 2026
• GAO-25-107721 — 2025 Green Book
• OMB M-25-21 — Federal AI use and governance
• OMB M-25-22 — Federal AI acquisition
• HM Treasury Orange Book — current July 2026 edition
• UK Cabinet Office Procurement Act 2023 guidance
• Regulation (EU) 2024/903 — Interoperable Europe Act

This guide is an operational implementation aid, not legal advice. Verify current jurisdiction, agency policy, funding conditions, contract terms, and controlling authority before making consequential decisions.