Section navigation
ARCS-PUB: Publish Boundary
Minimum Profile
The ARCS-PUB family addresses the point at which records stop being internal to the governed environment and enter wider circulation. The controls in this family govern export, publication, third-party delivery, API exposure, and similar release conditions. These controls are grouped together because publication creates a distinct governance condition. A record may leave the original environment while remaining accessible, copied, indexed, or redistributed. Governance at that boundary must therefore be declared explicitly rather than assumed to end at release.
The formal definition and scope of this family are maintained in the Standard.
| Control | Description |
|---|---|
| PUB-01 | The operator SHALL define publish boundary: the point at which a record leaves the governed environment. |
| PUB-02 | The operator SHALL classify exported outputs: distinguish deliberative records from exported outputs; retention rules may differ. |
| PUB-03 | Post-publish retention: the operator SHALL document retention rules for exported copies. |
| PUB-04 | Preservation at publish boundary: the operator SHALL define preservation behavior for exported records. |
| PUB-05 | API propagation: the operator SHALL govern records transmitted through APIs to external systems. |
| PUB-06 | Publish boundary disclosure: the operator SHALL document publish events and recipients for audit purposes. |