How do you conduct a gap analysis of your current records program against the NARA Universal ERM Requirements?

A gap analysis compares what your records program does today against an external benchmark—here, the NARA Universal Electronic Records Management (ERM) Requirements—so you can see where you meet expectations, where you fall short, and what to fix first. The Universal ERM Requirements describe the management capabilities an electronic records system should support across the records lifecycle, independent of any particular technology or vendor.

Establish the Baseline

Start by treating each requirement as a measurable criterion. Read through the requirement set and organize the items by lifecycle function—capture, maintenance and use, disposition, transfer, and the metadata that supports them. For each item, write a plain-language statement of what “compliant” looks like. This becomes your assessment checklist.

Inventory Your Current State

Gather evidence about how your program actually operates today, not how policy says it should. Useful inputs include:

• Records management policies, directives, and your records schedule
• System documentation for repositories, email, and collaboration platforms
• Workflows for classification, retention, holds, and disposition
• Interviews with records officers, IT, and business unit staff

Document where the records live, how they are captured, who manages disposition, and what metadata is retained.

Score Each Requirement

For every requirement, rate your current state—for example: Met, Partially Met, Not Met, or Not Applicable. Capture supporting evidence and the responsible system or role. Partial findings are often the most valuable, because they reveal capabilities that exist but are inconsistently applied or undocumented.

Analyze and Prioritize the Gaps

Group the “Not Met” and “Partially Met” items by theme and by risk. Weigh each gap against potential consequences such as loss of permanent records, inability to execute legal holds, or failed disposition. Prioritize gaps that carry the highest compliance or operational risk and those that block other improvements.

Build a Remediation Roadmap

Translate prioritized gaps into a phased plan with owners, target dates, and success measures. Distinguish quick policy or configuration fixes from longer system or process changes. Re-run the assessment periodically so the analysis stays current as requirements and systems evolve.

For related guidance and benchmarks, see the compliance standards hub.