9: IG for IT and Emerging Technologies

Introduction

Information Governance (IG) is where strategy meets the realities of fast‑moving technology. In 2026, IT leaders are simultaneously migrating to cloud‑native stacks, piloting blockchain for integrity, deploying generative AI (GenAI) to boost productivity, and preparing for quantum‑era cryptography changes—all while extending governance to edge/IoT workloads. The core IG mandate does not change: maximize information value, minimize risk, and prove compliance. What does change is how we apply policies, controls, training, and audits to new architectures, supply chains, and threat models. NIST’s frameworks—Zero Trust for access, AI RMF for AI risk, PQC standards for crypto migration—and the Cloud Security Alliance’s Cloud Controls Matrix (CCM) have matured into practical guardrails for these shifts. [csrc.nist.gov], [nist.gov], [nist.gov], [cloudsecur...liance.org]

This chapter gives you a hands‑on playbook. We begin with cloud governance fundamentals—shared responsibility, data sovereignty, multi‑cloud risk, and zero trust—then cover blockchain for integrity and auditability, GenAI governance (including prompt logging, bias mitigation, watermarking, and alignment with the EU AI Act), quantum threats and migration to post‑quantum cryptography (PQC), and edge/IoT governance grounded in NIST’s IoT baselines. We consolidate controls into actionable tables, offer brief case studies, and close with a forward look—so you can embed IG into each technology’s lifecycle without stalling innovation. [aws.amazon.com], [edpb.europa.eu], [nist.gov], [csrc.nist.gov]

Cloud Computing Governance

Cloud has moved from “elsewhere’s data center” to the default execution environment for analytics, integration, and application modernization [Gartner, 2025]. IG must cover who is accountable for what (shared responsibility), where data may reside and flow (sovereignty), how to manage multi‑cloud complexity, and how to implement zero‑trust controls consistently.

Blockchain for Information Integrity

Blockchain is not a cure‑all, but tamper‑evident ledgers can strengthen records integrity and audit trails when used judiciously. NIST’s Blockchain Technology Overview explains how hashes, digital signatures, and consensus anchor data to a ledger in a way that makes undetected tampering infeasible given assumed threat models. In IG, common patterns include: (1) hash‑anchoring critical records (store the record in a managed repository; store the hash on a chain for integrity proof), (2) immutable audit journal for sensitive events (e.g., ledgerized access logs), and (3) smart contracts to enforce policy rules (e.g., release conditions, retention triggers). [nist.gov]

Tamper‑proof records & audit trails. Instead of writing full documents on‑chain (privacy, size, and change‑management concerns), anchor a SHA‑256 hash of the record and store the artifact in your content platform; verification recomputes the hash and compares with the chain entry. This delivers immutability of evidence without leaking content. It also enables independent timestamping and third‑party verification. [nist.gov]

Smart contracts for compliance. Contracts can encode disposition conditions, approval workflows, or obligation triggers (e.g., lock a dataset until a retention period elapses). Governance must define upgrade and emergency stop procedures; otherwise, “code is law” can backfire if the policy landscape changes. IG should require a contract governance board, change logs, and audit of oracles feeding external facts. [nist.gov]

Generative AI Governance

GenAI amplifies productivity and creativity—and raises governance questions about acceptable use, prompt and output logging, bias and safety testing, IP and data leakage, and watermarking/traceability. NIST’s AI RMF 1.0 and the AI RMF Playbook provide a practical structure: Govern–Map–Measure–Manage, updated in 2024 with a Generative AI Profile to tailor controls to GenAI risks (e.g., jailbreaks, hallucinations, training data provenance). [nist.gov], [nist.gov]

EU AI Act alignment. The EU AI Act (Regulation 2024/1689) entered into force in 2024 and phases obligations through 2027. It bans certain uses, requires risk‑based controls for high‑risk systems, and imposes provider obligations for general‑purpose AI (GPAI) models, including technical documentation, evaluations, risk management, and transparency. Your IG program should inventory AI systems, classify them by risk, and ensure contracts and technical controls meet the applicable provisions and timeline. [eur-lex.europa.eu], [regulations.ai]

Operational guardrails.

• Prompt & output logging: Record prompts, model, version, and outputs; protect logs as records with retention aligned to risk and privacy obligations. Tie logs to model cards and risk assessments to support audits and investigations (NIST AI RMF “Measure/Manage”). [nvlpubs.nist.gov], [airc.nist.gov]
• Bias & safety testing: Establish pre‑deployment TEVV (testing, evaluation, verification, validation) for fairness, toxicity, and privacy leakage; maintain test artifacts as evidence (AI RMF Playbook). [nist.gov]
• Watermarking/traceability: Adopt industry watermarking/traceability mechanisms (e.g., C2PA‑style provenance) where feasible, with disclosure policies for synthetic media. Document limitations; watermarking is not a silver bullet but part of a chain‑of‑custody for content. (Map/Manage in AI RMF). [nist.gov]
• Acceptable use: Define allowed/blocked GenAI scenarios (e.g., no insertion of confidential or regulated data into public models without approved safeguards; escalation required for legal, medical, or HR decisions). Cross‑reference the EU AI Act’s transparency and high‑risk obligations when models affect individuals’ rights. [eur-lex.europa.eu]

Quantum Computing Threats and Preparation

Quantum computers threaten today’s public‑key cryptography (RSA, ECC). NIST finalized the first post‑quantum cryptography (PQC) standards in August 2024: FIPS 203 (ML‑KEM based on Kyber) for key establishment, FIPS 204 (ML‑DSA based on Dilithium) for signatures, and FIPS 205 (SLH‑DSA based on SPHINCS+) as a hash‑based alternative. Organizations should start crypto‑agility work now to mitigate “harvest now, decrypt later” risk. [nist.gov], [federalregister.gov]

Migration planning. Leading guidance (NIST announcements, PQC coalitions, IBM and MITRE roadmaps) recommends: (1) inventory cryptography (protocols, libraries, certs, devices), (2) prioritize systems by sensitivity and lifespan, (3) test PQC in pilot domains (TLS, code signing), (4) plan for hybrid modes where appropriate, and (5) establish crypto‑change governance (CAB for cryptography with versioned “Cryptography Bill of Materials,” CBOM). [ibm.com], [mitre.org]