Can a commercial off-the-shelf system meet the NARA Universal ERM Requirements without being DoD 5015.2 certified?

Short answer: yes. A commercial off-the-shelf (COTS) system can meet the NARA Universal Electronic Records Management (ERM) Requirements without ever holding a DoD 5015.2 certification. The two are related but separate frameworks, and one is not a prerequisite for the other.

Two different frameworks

The NARA Universal ERM Requirements describe outcomes a system should support across the records lifecycle - capture, maintenance and use, disposition, and transfer - so that electronic records remain reliable, usable, and properly managed regardless of the technology that produces them. They are deliberately technology-neutral and apply broadly across federal agencies.

DoD 5015.2 is a formal product certification standard, historically administered through a testing and registration program. A vendor submits a product, it is tested against a defined checklist, and it earns a certificate. It is a specific compliance path, not the only one.

Meeting the universal requirements is about demonstrating capability and good practice. A DoD certificate is one way to provide evidence of certain features, but it is not the measure NARA uses to judge whether the universal requirements are satisfied.

How a non-certified system can comply

A system can demonstrate compliance through other means:

• Mapping functionality to the requirements. Show, requirement by requirement, how the system captures records, applies retention and disposition, preserves metadata, restricts and audits access, and supports transfer in approved formats.
• Documented configuration and policy. Compliance is rarely the software alone. It depends on how the system is configured and the agency’s records policies, schedules, and procedures wrapped around it.
• Alignment with recognized standards. Conformance to international standards such as ISO 16175 for records in digital environments can provide independent, credible evidence of sound design.

What to keep in mind

Without a certification, the burden of proof shifts to the agency and the system owner to document and validate compliance. That is entirely workable, but it should be planned for - through testing, evidence gathering, and clear records governance.

A DoD 5015.2 certificate can simplify procurement and assurance where it is required by policy or contract, but it is not the only legitimate route to meeting NARA’s expectations.

For broader context on the rules that shape electronic recordkeeping, see the compliance standards hub.