"trust me the Chapter 4 security requirements are way more than what any
organization outside of the DoD would ever want to implement. most if
not all std 5015 certified RMAs have the necessary security features
that one would need to protect items of a sensitive nature.

Software company's seek the Ch 4 certification so that they can sell
their products within DoD. don't have Ch 4 cert? then no one within DoD
will look at the product.

Peterk"

I concur with Peter's statement above for the following:

Chapter 4 of DoD 5015.2 is intended for RMA software installed on
SIPRnet (Secret Internet Protocol Router Network) and JWICS (Joint
Worldwide Intelligence Communications System) networks. SIPRnet is
classified SECRET and JWICS is classified TOP SECRET/SPECIAL
COMPARTMENTED INFORMATION (TS/SCI).

Only DoD entities and defense contractors would need RMA software that
meet Chp 4 specs. Contractors that elect to join the SIPRnet have to
spend a prodigous amount of money to meet SIPRnet standard and very few
do, electing to place their employees on site where they can access a
DoD workstation.

Contractors that do business with the DoD must use DoD 5015.2 rated RMA
software if transactions and communications with DoD are captured
electronically. Most contractors only handle UNCLASSIFIED BUT SENSITIVE
or FOUO (For Official Use Only) data over the public Internet that DoD
connects to via the NIPRnet (Non-Classified Internet Protocol Router
Network). They are not required to use software that meets Chp 4
standards.

Chp 4 is overkill for the vast majority of potential users.

Thomas C. Nield, MCP
Electronic Records Archivist
Records Management Division
Missouri Secretary of State
600 W Main, Rm. 153
Jefferson City, MO 65102
Phone: 573-751-7299
Fax: 573-526-5327
E-mail: [log in to unmask]

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance