Is DoD 5015.2 required by law?

It depends who you are — and the federal picture changed in 2022. Within the Department of Defense, 5015.2 governs records management applications, so DoD components require 5015.2-tested systems. For the rest of the federal government, it was for years the de facto baseline — but it no longer carries NARA’s endorsement.

The 2022 change

In NARA Bulletin 2022-01 (April 19, 2022), the National Archives revoked its endorsement of DoD 5015.02-STD, citing the standard’s pending revision and the launch of the Federal Electronic Records Modernization Initiative (FERMI). For federal agencies, the current reference is now NARA’s own Universal Electronic Records Management Requirements — a technology-neutral set of requirements, procured through a dedicated GSA Special Item Number.

Where it still applies

• Within the DoD, 5015.2 still governs records management applications.
• Elsewhere in government, agencies that once required 5015.2 now look to NARA’s Universal ERM Requirements. Many products remain “5015.2-certified,” and that certification is still a recognized, useful credential — but it is no longer NARA’s endorsed federal baseline.

So while a private company was never compelled by law to buy a 5015.2-certified system, the federal demand that shaped the market has shifted toward NARA’s modernized requirements.

How it became a de facto standard

Two forces made it ubiquitous: the DoD is an enormous software buyer, so vendors built to its specification; and NARA’s long-standing recognition led agencies beyond Defense to require it too. Products are formally tested and certified against the standard by the Joint Interoperability Test Command (JITC).

How to think about it

For federal and defense buyers, 5015.2 certification is often a hard requirement — a procurement filter. For everyone else, it’s a useful quality signal: certification means the software has been independently tested for the recordkeeping fundamentals (declaration, classification, retention, disposition, access control, and audit trails). It’s a floor, not a ceiling — and it complements the principles-based ISO 15489 standard rather than replacing it.