What is the difference between a standard like ISO 15489 and a regulation like 36 CFR 1236?

Standards and regulations both shape how records are managed, but they come from different places, carry different force, and serve different purposes. Understanding the distinction helps you decide what you must do versus what represents recognized good practice.

A standard describes good practice

A standard like ISO 15489 is developed by a standards body (in this case the International Organization for Standardization) through consensus among experts and practitioners. It describes principles and methods for managing records well—concepts such as authenticity, reliability, integrity, and usability, along with processes for capture, classification, retention, and disposition.

Key characteristics of a standard:

• Voluntary. Adopting it is generally a choice, not a legal obligation, unless a law or contract specifically requires it.
• Principle- and method-focused. It tells you how to do records management well, often without prescribing specific outcomes.
• Broadly applicable. It is written to work across industries, sectors, and countries.

A regulation imposes a legal obligation

A regulation such as 36 CFR Part 1236—part of the U.S. Code of Federal Regulations governing electronic records management for federal agencies—has the force of law. It is issued by a government authority under statutory power, and the entities it covers must comply.

Key characteristics of a regulation:

• Mandatory for the organizations within its scope (here, U.S. federal agencies).
• Specific and enforceable. It sets requirements that auditors or oversight bodies can hold you accountable for.
• Jurisdiction-bound. It applies only where the issuing authority has legal reach.

How they work together

The two are complementary rather than competing. Regulations tell you what you are legally required to achieve; standards offer a proven framework for how to get there. Organizations often implement a standard like ISO 15489 as the practical backbone of their program, then map their controls to the specific regulations that bind them—demonstrating compliance while following recognized best practice.

In short: a regulation is a rule you must follow; a standard is guidance you choose to follow. Mature records programs typically use both, letting standards operationalize the obligations that regulations create.

For more, explore the compliance and standards topic hub.