When DMF certification becomes a necessity, understanding how controls, documentation, and attestation come together is key to meeting NTIS requirements.
Organizations that rely on accurate death data as part of claims administration, insurance processing, fraud prevention, or eligibility validation may eventually encounter Death Master File (DMF) compliance requirements. Access to the Death Master File, which is derived from records maintained by the Social Security Administration (SSA), is governed by the National Technical Information Service (NTIS) and requires formal certification before access is granted.
For many organizations, DMF certification becomes relevant during regulatory review, vendor due diligence, or broader data governance initiatives. At that point, attention typically shifts from whether certification is required to how the process actually works and what operational changes may be necessary to meet NTIS DMF requirements.
While the certification process is often discussed at a high level, the work itself tends to be far more operational. Organizations are not simply completing an application. They are demonstrating that appropriate systems, facilities, procedures, and safeguards exist around sensitive death data, that those safeguards operate consistently, and that sufficient documentation exists to support formal attestation.
In practice, Death Master File compliance centers on controls. That includes how access is restricted, how users are approved and reviewed, how sensitive data is protected, how incidents are addressed, and how evidence is retained to demonstrate controls are functioning as intended. In many environments, those safeguards already exist through broader security or governance programs. The challenge is often less about implementing entirely new controls and more about documenting, testing, and validating them in a way that aligns with NTIS requirements.
There are a few established approaches organizations use to satisfy DMF certification requirements. The structure of the process remains relatively consistent, though the certification path often depends on the maturity of the existing control environment and whether broader compliance reporting is already in place.
One approach involves a direct attestation against NTIS criteria as defined in the 15 CFR Part 1110. Under this model, controls are mapped directly to NTIS DMF requirements, gaps are identified, and testing is performed to validate whether safeguards operate as intended. This path is often appropriate for organizations seeking certification without the added scope of broader reporting frameworks.
Another common approach involves leveraging a SOC 2 examination as part of the attestation process supporting certification. In those environments, the organization’s control framework is evaluated against SOC 2 criteria, and that work supports the certification process. Organizations that already maintain formal security governance and reporting structures may find this approach aligns naturally with existing compliance activities. Similarly, ISO 27001 certification may also be used as a basis for meeting DMF certification requirements depending on how controls are structured and documented.
The distinction between these approaches is less about the certification outcome and more about how the work is organized and supported. Both paths require controls to be clearly defined, consistently applied, and supported through documentation and retained evidence.
SOC 1 reporting may also support certification in certain situations, though this is generally less common and typically only considered when a SOC 1 examination report already exists. Organizations may also maintain broader compliance frameworks tied to NIST, HIPAA, or other governance standards. Those frameworks may contribute to the overall control environment, though they do not replace the need to satisfy NTIS DMF requirements directly.
In many cases, organizations already have substantial portions of the necessary control structure in place. Logical access controls, user provisioning procedures, encryption standards, vendor oversight activities, incident response processes, and evidence retention practices may already operate within the business. The certification effort often centers on whether those controls can be demonstrated consistently through testing and documentation.
The DMF certification process generally follows a structured progression, even if organizations encounter different challenges along the way. The process usually begins with an initial assessment to determine how existing documented controls align with NTIS requirements and where additional support may be needed. In cases where a SOC 2 Type II examination has been completed that solidly addresses the revised points of focus, or where an ISO 27001 certification is current, this step is typically brief and identified gaps are generally not material.
In some cases, that early review often identifies gaps between operational practice and formal documentation. In some environments, controls are functioning appropriately but are not documented consistently across departments or technical environments. In others, evidence supporting control performance may not be centrally retained or readily available for review.
This stage is frequently where organizations discover that demonstrating controls can be more difficult than implementing them. Access reviews may occur regularly, approval workflows may exist, and incident escalation procedures may already be operating, yet supporting artifacts may be incomplete, decentralized, or inconsistently maintained.
Once gaps are identified, remediation work begins. Depending on the environment, that may involve formalizing policies, clarifying ownership responsibilities, strengthening review procedures, expanding documentation practices, or aligning evidence retention processes more closely with NTIS criteria.
From there, the process shifts into testing. Controls are evaluated based on how they operate in practice, with supporting evidence gathered to demonstrate consistency, traceability, and coverage. Documentation becomes particularly important during this phase because controls must be supported in a manner that can be independently examined as part of the attestation process.
As testing concludes, results are compiled into a formal report structure. Findings are organized, documentation is reviewed for completeness, and the attestation process moves through internal quality review before certification materials are finalized.
The final stage involves submission of the certification and supporting documentation, including the required attestation (such as Form FM 100A), in accordance with NTIS requirements. Once approved, organizations may obtain access to the Limited Access Death Master File as part of their operational or regulatory needs.
From beginning to end, DMF certification is ultimately an exercise in governance, consistency, and control maturity. Organizations that already maintain structured compliance environments often discover the process moves more efficiently when controls, documentation, and evidence retention practices are aligned before formal testing begins.
AAFCPAs serves as an Accredited Conformity Assessment Body (ACAB) and performs the attestation required for DMF certification. This work centers on evaluating controls against NTIS criteria, testing how those controls operate, and documenting the results in a way that supports certification. The process aligns with the steps outlined above, from initial assessment through testing and reporting, with certification completed as part of that attestation. For organizations that undergo a SOC 2 examination or ISO 27001 certification, that work can also be used as the basis for certification where appropriate, with the underlying objective remaining the same: demonstrating that safeguards are in place and supported in a manner that meets NTIS requirements.
These insights were contributed by Sumit Saxena, MBA, Advisor, Governance, Risk & Compliance and James Jumes, MBA, M.Ed., Partner, Governance, Risk & Compliance.
Questions? Reach out to our authors directly or your AAFCPAs partner. AAFCPAs offers a wealth of resources on SOC reporting and risk management. Subscribe to get alerts and insights in your inbox.
DMF certification refers to the process organizations complete to obtain access to the Limited Access Death Master File (LADMF), which is governed by the National Technical Information Service (NTIS). Certification involves demonstrating that appropriate systems, controls, procedures, and safeguards exist to protect sensitive death data derived from Social Security Administration (SSA) records.
Organizations that use death data as part of claims administration, insurance processing, fraud prevention, eligibility validation, or regulated transaction workflows may require DMF certification to access the Limited Access Death Master File.
NTIS DMF requirements focus on whether organizations maintain appropriate safeguards around the use, storage, access, and protection of Limited Access Death Master File data. Requirements generally address areas such as access controls, incident response, documentation, governance, and evidence retention.
The timeline varies depending on the maturity of the organization’s control environment, the condition of existing documentation, and whether remediation work is required. Organizations with established governance and compliance structures may move through the process more efficiently than environments where controls are less formalized.
No. A SOC 2 examination does not replace DMF certification requirements. However, organizations with existing SOC 2 reporting may already maintain controls, governance structures, and documentation practices that support portions of the certification process.
In many cases, yes. Organizations operating under frameworks such as SOC 2, ISO 27001, NIST, or HIPAA may already maintain controls relevant to NTIS DMF requirements. Those frameworks may support the certification effort, though they do not eliminate the need for attestation aligned specifically to NTIS criteria.
The certification process often involves evaluating logical access controls, user provisioning procedures, encryption practices, vendor oversight activities, incident response processes, and documentation retention practices. Controls must generally be supported through evidence demonstrating they operate consistently over time.
Delays frequently occur when controls exist operationally but are not consistently documented or supported through retained evidence. Organizations may also encounter challenges when responsibilities are decentralized across departments, approval workflows are informal, or supporting documentation is difficult to retrieve during testing.
Organizations generally complete certification and attestation activities on a recurring basis in accordance with NTIS requirements. Renewal timing may vary depending on the certification structure and ongoing compliance obligations.
Author Bio
More Articles
The Commonwealth’s new UFR eFiling system changes how human and social services organizations register, assign auditors, submit reports, and manage key compliance requirements.
Leadership development, mentorship, and opportunity remain essential to advancing women in the profession. AAFCPAs is proud to contribute to that conversation on a global stage.
National Health Center Week is an opportunity to recognize the organizations that expand access to care, strengthen communities, and improve lives every day.
