DoD 5015.2 File Plan: How Does It Map to Purview Records Management?

By Michael Branson

Quick answer. As of September 2026, a DoD 5015.2-style file plan maps onto Microsoft Purview Records Management one component at a time: each record category or series becomes a retention label carrying Purview’s Category and Sub category file plan descriptors, cutoff instructions and event triggers become event-based retention, a vital-records designation maps to the regulatory-record setting, decided category by category, and transfer to final disposition becomes a disposition review plus a custom end-of-retention action, because none of the Microsoft pages cited here describes a built-in transfer to an outside archive. Microsoft’s current documentation on Purview Records Management, including its Regulatory requirements for data lifecycle management and records management page, makes no DoD 5015.2 claim of any kind; the DoD 5015.2 certification Microsoft announced, on May 29, 2007, covered Office SharePoint Server 2007, a server product of that year, and Microsoft’s records team had written in November 2006 that it was “pursuing Chapter 2 certification only.” A federal or defense records program therefore builds its own crosswalk between the two file plans, and asks any vendor, Microsoft included, for a current certificate and its date rather than accepting the word certified on its own.

The request usually lands on the IT Director’s desk as a spreadsheet. A records officer or a contracting officer hands over the program’s existing file plan, written years ago in the DoD 5015.2 pattern with record series, cutoff instructions, vital-records flags and transfer instructions, and asks where each column goes in Microsoft 365. Somewhere in the same conversation someone asks whether Microsoft 365 is DoD 5015.2 certified, because that question has circulated since the on-premises SharePoint era. This guide answers both: where each piece of the old file plan lands in Purview’s file plan, and what Microsoft’s own current documentation says, and does not say, about DoD 5015.2. It does not decide whether any program meets a particular requirement; that determination belongs to the program, its records officer and its assessor.

Where the file plan lives once you know Purview can hold a record

If the crosswalk meeting keeps drifting back to whether a Purview record counts as a record, park that question; it has its own answer. Microsoft’s Learn about records management page says “You use retention labels to mark items as a record, or a regulatory record.”, and whether that declaration holds up, and what it costs to license, is covered in SharePoint Online vs a Dedicated DMS: How to Decide. The work this guide covers starts after that decision: putting the program’s existing file plan into Purview’s own file plan, in the Microsoft Purview portal under Records Management.

Mapping a DoD 5015.2-style file plan onto Purview’s file plan

If the old file plan is treated as a list of folders, the mapping goes wrong from the first row. In Purview it becomes a list of retention labels, and the old plan’s columns become label settings and file plan descriptors. Microsoft’s Get started with records management page puts the file plan at the start of the work: “Create your file plan for retention and deletion settings and actions, and when items should be marked as records by importing an existing plan if you have one, or create new retention labels”.

Microsoft’s Use file plan to create and manage retention labels page (last updated February 27, 2026) describes what the file plan adds to a plain retention label: “File plan lets you include more information as part of your retention labels. These file plan descriptors provide more options to improve the manageability and organization of the content you need to label.” The same page lists four descriptors that come with out-of-box values, Business function/department, Category, Authority type and Provision/citation, alongside Reference ID and Sub category, and says “You can bulk-create retention labels by importing the relevant information from a spreadsheet.” That import is how an existing file plan usually arrives in Purview: one row per record category, one label per row.

The crosswalk, component by component:

Cutoffs and event triggers take the most design time. Microsoft’s records management overview lists “Start different retention periods when an event occurs with event-based retention.”, and the file plan page says of event types: “Although there are some built-in event types, such as Employee activity and Product lifetime, you can also create your own event types.” A cutoff tied to an event, such as a contract closing, maps directly to an event type. A cutoff tied to the calendar has no event behind it, so the crosswalk has to record how the records team will trigger it.

Vital records map to the regulatory-record setting only after a decision per category. The file plan page describes that setting as one that “marks the content as a regulatory record, which is more restrictive than a record.” What those restrictions are, and why they matter, is the declaration question covered on the page linked above; the crosswalk records which categories carry the setting and why.

Final disposition is where the old file plan and Purview differ most. The file plan page gives three disposition types, “No action”, “Auto-delete” and “Review required”, and Microsoft’s overview lists “Review and validate disposition with disposition reviews and proof of records deletion.” None of the four current Microsoft Purview pages cited here describes a built-in transfer of records to an outside archive. The Get started page lists “Do custom actions or integrate with other solutions at the end of the retention period” as a supported scenario, so a transfer instruction maps to a disposition review followed by a custom action. The overview’s “Export information about all disposed items with the export option.” gives the records officer a list of what was disposed; it is a record of disposition, not a transfer.

One limit matters for the import itself. The file plan page says: “Although you can configure the settings for a single disposition review stage when you import retention labels with a template, you can’t specify additional review stages.” A category that needs more than one reviewer stage is finished in the portal after the import.

What Microsoft’s current documentation says about DoD 5015.2

When an assessor asks whether Purview is DoD 5015.2 certified, the defensible answer starts with what Microsoft has actually written. Four current Microsoft Learn pages cover Purview Records Management: Learn about records management, Get started with records management, Use file plan to create and manage retention labels and Regulatory requirements for data lifecycle management and records management. Read on September 24, 2026, none of the four mentions DoD 5015.2, the Department of Defense or the National Archives and Records Administration, and none uses the word certified.

The fourth page is the telling one, because it is where Microsoft names regulations one by one. It says: “Use the resources on this page to help you meet specific regulatory requirements for data lifecycle management and records management in Microsoft 365.” The regulations Microsoft Learn then names there are the New Zealand Public Records Act 2005, SEC 17a-4(f), FINRA 4511(c) and CFTC 1.31(c)-(d), and DoD 5015.2 is not among them.

That is silence, not a denial. Microsoft Learn does not say Purview fails DoD 5015.2, and it does not say Purview meets it. What follows for the IT Director is narrower and more useful: no current Microsoft Learn page supports telling an assessor that Purview Records Management holds a DoD 5015.2 certification, so the program’s answer rests on its own crosswalk and its own records officer’s determination.

The 2007 certification, and why it does not answer today’s question

When a search summary or an older vendor sheet blurs two products into one, the history needs its product, its date and its scope stated every time. Microsoft’s press release Microsoft Office SharePoint Server 2007 Receives U.S. Department of Defense 5015.2 Certification is dated May 29, 2007. It describes the standard this way: “Endorsed by the National Archives and Records Administration, the 5015.2 standard on which the DoD certification is based serves as the benchmark for government and corporate organizations that manage records and documents.” The same release says Microsoft met the criteria by integrating Exchange Server 2007 and extending SharePoint Server 2007 with a records management add-on pack.

An earlier post on Microsoft’s archived Records Management team blog, DoD 5015.2 Certification for Office SharePoint Server 2007 (last updated November 8, 2006), explains the program as it stood then: “DoD 5015.2 is a records management certification managed by the Joint Interoperability Test Command of the United States Department of Defense.” It separates the two parts of the standard: “there are two different types of DoD 5015.2 certifications: Chapter 2 and Chapter 4. Chapter 2 contains the mandatory criteria that are required by all records management applications used by United States government agencies. Chapter 4 is specific just to applications that process classified records.” And it states the scope Microsoft sought: “Chapter 2 is the more widely used part of the DoD 5015.2 standard and Microsoft is pursuing Chapter 2 certification only.” The May 2007 release does not name a chapter.

None of that describes Microsoft Purview Records Management in Microsoft 365. It describes Office SharePoint Server 2007, a server product with its own add-on pack, as Microsoft announced it in 2007, with the chapter Microsoft’s team said in 2006 it was pursuing. No current Microsoft source read for this guide carries that certification forward to the cloud service, and none says it was withdrawn; the current pages simply do not mention it.

How to test any certification claim

If a proposal, a summary or a vendor sheet says a records platform is DoD 5015.2 certified, treat the sentence as a claim to be checked, not a fact to be repeated. A certification belongs to a named product and version, issued by a named authority, on a date, for a stated scope, and it is either current or it is not. Ask for all five, in writing, before the word goes into a plan or an assessor response:

• Ask which product and version the certification names, and whether that is the product the program actually runs.
• Ask which chapter or scope it covers; the Microsoft Records Management team’s 2006 post on learn.microsoft.com separates Chapter 2 from Chapter 4 for exactly this reason.
• Ask for the issuing authority and the certificate itself, not a description of it.
• Ask for the date issued and whether it is still current.
• Ask what the program still has to configure for the certified behavior to apply, because a certified product configured differently is not the configuration that was tested.

The same test applies to Microsoft. Its current Purview documentation on Microsoft Learn makes no such claim, so there is no certificate to ask for, and the program’s evidence is its own file-plan crosswalk.

When this guide is the wrong starting point

Some questions arrive with the words records management in them when the decision behind them is a different one.

• If the program is governed by DoD Instruction 5015.02 or a successor policy, read that document directly; this guide does not state its requirements.
• If the question is whether Purview declares real records at all, whether a regulatory record can be changed, or which platform to buy, that is the declaration and platform decision covered by the comparison page linked earlier in this guide.
• If the question is responding to a public-records or FOIA request, that is a search-and-review decision, not a file-plan structure, and this guide does not cover it.
• If a contract or an agency directive names a specific certification requirement, the contracting officer’s own text governs, not this guide.

What to ask of whoever helps

When outside help builds the crosswalk, or your own team does, the same questions separate a plan an assessor can follow from a slide.

• Ask for a written statement of what Microsoft’s current documentation says and does not say about DoD 5015.2, with each source and the date it was read.
• Ask for the crosswalk itself, record category by record category, mapped to the program’s own file plan rather than to a generic template.
• Ask how each calendar cutoff will be triggered, and who triggers it.
• Ask which categories carry the regulatory-record setting, and the reason written beside each one.
• Ask where transferred records go at final disposition, and what action moves them.
• Refuse any claim that a product or a partner makes the program certified; the determination stays with the program and its assessor.
• Ask who does the work, and expect senior people rather than a handoff to a junior bench.
• Ask for a plain statement that the records program, its disposition reviews and its file plan stay your team’s to run when the project ends.

How i3solutions answers

When a federal or defense records program takes this on, it needs a project with an end date: the file-plan crosswalk, the retention labels and descriptors, the event types and the disposition design, with embedded specialists where the internal team needs more hands for a period. i3solutions has been a Microsoft Partner with 30 years of enterprise technology delivery experience and has delivered 1,500+ Microsoft engagements across aerospace and defense, financial services, and health sciences. Delivery is senior and US-based. An i3solutions engagement does not produce managed-service ownership, a replacement for the internal team, open-ended scope expansion, or vendor lock-in. This work sits within i3solutions’ Embedding Governance into How the Enterprise Operates and Scales.

Key Takeaways

• A DoD 5015.2-style file plan maps onto Purview’s file plan as retention labels, one per record category, with file plan descriptors carrying the program’s identifiers and citations.
• Cutoffs and event triggers map to event-based retention; Microsoft says “you can also create your own event types.”
• Vital records map to the regulatory-record setting only after a decision per category; Microsoft calls it “more restrictive than a record.”
• None of the four current Microsoft Purview pages cited here describes a built-in transfer to an outside archive, so transfer maps to a disposition review plus a custom end-of-retention action.
• Microsoft’s current documentation on Purview Records Management makes no DoD 5015.2 claim; the certification Microsoft announced on May 29, 2007 covered Office SharePoint Server 2007.

Frequently Asked Questions

What does a DoD 5015.2 record category map to in Purview?

A retention label. Each record category or series becomes one retention label in Purview’s file plan, with the Category, Sub category and Reference ID file plan descriptors carrying the program’s own identifiers. Microsoft says “File plan lets you include more information as part of your retention labels.” and “You can bulk-create retention labels by importing the relevant information from a spreadsheet.”

How does a DoD-5015.2-style cutoff or event trigger map to Purview?

To event-based retention. Microsoft lists “Start different retention periods when an event occurs with event-based retention.” and says “you can also create your own event types.” A cutoff tied to an event maps directly to an event type; a calendar cutoff needs a records-team trigger recorded in the crosswalk.

Is Microsoft Purview Records Management DoD 5015.2 certified?

Microsoft does not say so. Read on September 24, 2026, none of the four current Microsoft Learn pages on Purview Records Management mentions DoD 5015.2, including the page where Microsoft names regulations one by one. That is silence, not a denial, and no current Microsoft Learn page supports telling an assessor that Purview holds a DoD 5015.2 certification.

What was the 2007 SharePoint Server DoD 5015.2 certification?

According to Microsoft’s press release of May 29, 2007, Office SharePoint Server 2007 received DoD 5015.2 certification. In November 2006 Microsoft’s Records Management team wrote that “Microsoft is pursuing Chapter 2 certification only.” That certification describes Office SharePoint Server 2007, not Microsoft Purview Records Management in Microsoft 365.

Planning the Decision

If your program needs its existing file plan mapped onto Purview record category by record category, a plan for calendar cutoffs and vital records, or a disposition design that says where transferred records go, the next step is a conversation about your file plan.

Contact a senior architect