Industry Vocabulary Reference

Government & Public Sector

Government and public-sector fields cover service delivery, procurement, records, security controls, and AI-use inventories. Use them to document a specific agency workflow.

Back to industry coverage library

This page shows selected examples and categories. Download the JSON for the complete vocabulary, including every field, permitted value, and policy pattern in this catalog.

How to use this reference

1. Start with the core file if you need the cross-industry governance baseline.
2. Choose an industry file for its workflow fields and permitted values.
3. Match the OTel attributes to the policy paths your rules use, then verify the recorded fields in a test session.

Catalog context

Connect each agency workflow to its purpose, affected service, decision owner, and review outcome.

Risk note: OMB M-25-21 replaced M-24-10. Its high-impact AI category depends on the use case, with scope and exceptions defined in the memorandum.

Vocabulary file

• Download filename: 09_vertical_government_public_sector.json
• Kind: vertical

OTel namespaces

Referenced standards

These references explain the catalog's context. A listed standard does not establish that a configured application meets its requirements.

• NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations (2020)
• NIST SP 800-53B, Control Baselines for Information Systems (2020)
• NIST SP 800-37 Rev 2, Risk Management Framework (RMF) for Information Systems (2018)
• NIST SP 800-171 Rev 3, Protecting CUI in Nonfederal Systems (2024)
• NIST AI RMF 1.0, AI Risk Management Framework (2023)
• NIST AI 600-1, Generative AI Profile (2024)
• FedRAMP Rev 5, Federal Risk and Authorization Management Program (GSA/OMB, 2023)
• FedRAMP Consolidated Rules for 2026, Cloud-service assessment and agency use
• FIPS 140-3, Security Requirements for Cryptographic Modules (2019)
• FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
• FIPS 200, Minimum Security Requirements for Federal Information and Information Systems
• OMB M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
• OMB M-23-22, Delivering a Digital-First Public Experience (September 2023)
• OMB M-22-09, Moving the US Government Toward Zero Trust Cybersecurity Principles
• OMB M-21-31, Improving the Federal Government's Investigative and Remediation Capabilities (log retention)
• EO 14028, Improving the Nation's Cybersecurity (May 2021)
• CISA JCDC AI Cybersecurity Collaboration Playbook (2024)
• FAR Part 12/39, Federal Acquisition Regulation for IT and AI procurement
• DFARS 252.204-7012, Safeguarding Covered Defense Information
• EU AI Act (2024/1689) Annex III point 5, Essential private and public services and benefits
• EU AI Act (2024/1689) Annex III para 6, High-risk AI in law enforcement
• EU AI Act (2024/1689) Annex III para 7, High-risk AI in migration, asylum, border control
• EU GDPR Article 22, Automated individual decision-making including profiling
• EU NIS2 Directive (2022/2555), Essential and important entities in public administration
• Council of Europe Framework Convention on AI (CETS 225), Opened for signature September 2024
• G7 Hiroshima AI Process, Guiding principles for advanced AI systems (2023)
• OECD Principles on AI (2019, updated 2024)
• UN General Assembly Resolution A/RES/78/311, International AI Governance (March 2024)

Source references

• https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final 
• https://www.fedramp.gov/ 
• https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf 
• https://www.fedramp.gov/2026/scope/ 
• https://www.fbi.gov/file-repository/cjis 
• https://csrc.nist.gov/publications/detail/ai/100-1/final 
• https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689 

Subdomains

Implementation examples

• FedRAMP & Cloud Security Authorisation: Fed RAMPAuthorization Status. An agency rule stops a connected data transfer when the destination lacks the required authorization record. Reviewers inspect the service boundary and recorded conditions. (Fedramp: Assess whether the cloud service and its use fall within FedRAMP scope. Reuse the applicable assessment package for the agency's authorization process.)
• FedRAMP & Cloud Security Authorisation: FIPSSecurity Level. A configured rule stops an action when the reported module level falls below the system's requirement. Reviewers check the certificate and configuration before changing the record. (Fips 140 3: FIPS 140-3 defines four security levels for cryptographic modules. Select the required level from the system's applicable security requirements.)
• NIST SP 800-53 Control Compliance Monitoring: NISTSPControl Family. AI continuous monitoring agent generates automated evidence for each NIST SP 800-53 control it can assess. Evidence records are tagged with control family and specific control ID (e.g. AC-2, AU-6) for ingestion into eMASS or equivalent agency GRC platform.
• NIST SP 800-53 Control Compliance Monitoring: Continuous Monitoring Frequency. FedRAMP ConMon requires monthly vulnerability scanning, annual penetration testing, and continuous log monitoring. AI compliance agents schedule and execute control assessments at the required frequency and generate evidence with timestamp and frequency classification for the FedRAMP PMO.

Control ideas

These patterns describe possible controls, not active rules. Confirm applicability, implement the control, and test its effect on the application.

Enforce before the action

Pass the request and your business action to this function. The core SDK checks policy before the action runs and again before its result is released. A deny or review decision means the action never runs.

import { Veriproof } from '@veriproof/sdk-core';
import type { GovernedResult, IndustryFact, JsonValue } from '@veriproof/sdk-core';

const veriproof = Veriproof.fromEnv();

export async function runProtectedAction<TInput extends JsonValue, TValue>(
  request: TInput,
  action: (input: TInput, signal: AbortSignal) => Promise<TValue>,
): Promise<GovernedResult<TValue, TInput>> {
  // Catalog values for this vertical. Replace them with facts from the current workflow.
  const industry: IndustryFact[] = [
    { attribute: "government.fedramp.authorization_status", policyInput: "government_fedramp_authorization_status", value: "in_process" },
    { attribute: "government.fisma.impact_level", policyInput: "government_fisma_impact_level", value: "low" },
    { attribute: "government.rmf.lifecycle_phase", policyInput: "government_rmf_lifecycle_phase", value: "prepare" },
  ];

  // Policy runs before action() and again before the result is released.
  // A deny or review decision means action() never runs.
  return veriproof.govern(
    "government.public.sector.evaluate",
    request,
    ({ input, signal }) => action(input, signal),
    { industry },
  );
}

• Replace the sample values with facts from the current workflow. Rules read them under input.snapshot.industry.
• Test both permitted and blocked actions. Confirm that a blocked action never reaches your business function.
• Only completed, completed_with_warning, and transformed results carry a released value.

For review decisions, follow the Human Review guide to configure continuation. Observe remains available when you need to record activity without enforcing a decision.

Set up the Government & Public Sector example. See the API reference for TypeScript, Python, or .NET.

Selected vocabulary categories

This page uses the vocabulary JSON distributed with the documentation. Check its version when comparing it with an installed SDK.

Download the vocabulary JSON for offline review or automated comparisons.

Use the SDK reference for configuration and supported APIs. Keep vocabulary selection separate from the compliance team's assessment of applicable requirements.