# GOV-09 Decommissioning procedure

Domain: GOV Governance & Accountability · HI-AAF v1.3 · Public review · https://humanintel.net/standard/gov/gov-09

Each agent has a documented decommissioning procedure covering data destruction, in-flight transaction handling, credential revocation, log retention, and removal from the agent registry.

Decommissioning an agent, including data disposal, follows a documented process and is logged. The procedure covers data destruction and retention per policy, in-flight transaction handling, affected-user notification, credential and authorization revocation, log retention post-retirement, and removal from the agent registry. Decommissioning evidence is retained for audit.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for GOV-09: Decommissioning procedure is documented; at least one agent has been decommissioned following the procedure or the procedure has been tested in a drill; evidence of data disposal and credential revocation is retained.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Decommissioning procedure is documented.
- At least one agent has been decommissioned following the procedure or the procedure has been tested in a drill.
- Evidence of data disposal and credential revocation is retained.

## Framework mappings

- NIST AI RMF: GOVERN 1.5
- ISO/IEC 42001: A.3.4
- SOC 2 (TSC): CC6.5
- EU AI Act: Art. 17(1)(j)
- Singapore: MAIGF Internal Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, GOV-09 Decommissioning procedure. Public review edition, July 2026. https://humanintel.net/standard/gov/gov-09