What is the difference between meeting the NARA Universal ERM Requirements and being DoD 5015.2 certified?

Both the NARA Universal Electronic Records Management (ERM) Requirements and the DoD 5015.2 standard describe what an electronic records system should be able to do. They are often mentioned together, but they serve different purposes and carry different weight. Understanding the distinction helps organizations avoid treating them as interchangeable.

What each one is

NARA Universal ERM Requirements are a set of functional and non-functional expectations developed by the National Archives to describe, in technology-neutral terms, what is needed to manage electronic records well. They are written as requirements an agency or a system should meet, not as a pass/fail product test. The emphasis is on outcomes: capturing records, maintaining them with reliable metadata, supporting retention and disposition, and ensuring records remain authentic and usable over time.

DoD 5015.2 is a records management application design criteria standard. Historically it has been paired with a formal certification program, in which a product is tested against specific mandatory and optional criteria and either passes or does not. Certification therefore produces a concrete result: a named product, tested at a point in time, against a published criteria list.

The core difference

The simplest way to frame it:

• NARA Universal ERM Requirements describe capabilities to achieve — they are guidance an organization uses to evaluate and improve how it manages electronic records, regardless of the tools involved.
• DoD 5015.2 certification is a formal test result — an attestation that a specific application met defined design criteria when it was evaluated.

In other words, meeting the Universal ERM Requirements is about the records program and its outcomes; being 5015.2 certified is about a particular product passing a structured conformance test.

Why it matters

A certified product can be a useful starting point, but certification alone does not guarantee that an organization’s records are well managed — configuration, policies, retention schedules, and user practices all matter. Conversely, an organization can meet recordkeeping requirements without a certified application if its overall program satisfies the functional expectations. Treat the two as complementary lenses, not as substitutes for one another.

For related guidance, see the compliance standards topic hub.