Platform
Modules
By sector
By sector
By standard
Blog
News
Company
Events
Standards
Defence, cybersecurity, pharma and medical devices, and risk management: the standards, the laws and the guidance of each, explained in plain words, in one catalogue. Every entry links to its source, and any of them can be requested in ComplyTrain. The certificate stays yours to earn.
Overview
Four things that are true in every sector on this page. The cards below take you to the detail of yours.
A contract names a standard. A law names its own scope. A regulator's guidance names what it expects. The name decides what you must meet, not this page and not us.
The AQAPs, ISO 13485, ICH Q10 and ISO/IEC 27001 all build on the same management-system shape. A certified ISO 9001 system is the usual place to start.
NATO adds the AQAPs and the STANAGs. Security adds the 27000 family, the frameworks and the EU laws. Pharma adds GMP, ICH and the MDR. All of them add a risk process.
Search the whole catalogue by number or name, browse it by family, or answer four questions. Each entry links to its source and can be requested in ComplyTrain.
Defence
NATO's standards reach a supplier through a contract: a STANAG is the agreement between nations, the Allied Publication under it holds the requirements, and the AQAPs add what a defence contract needs on top of ISO 9001 and EN 9100. Around 980 STANAGs and 1,200 publications, all in the explorer.
Cybersecurity
A security requirement comes in three shapes: a standard you certify against, a framework you are assessed against, and a law that binds you directly. ISO/IEC 27001 and its family, NIST and CIS, IEC 62443, SOC 2 and TISAX, and NIS2, DORA, the Cyber Resilience Act and GDPR.
Pharma and medical devices
The law binds the manufacturer, guidance says how inspectors read it, and standards are how you build the system. EU GMP and its annexes, PIC/S, 21 CFR and the ICH guidelines for medicinal products; the MDR and IVDR with ISO 13485, ISO 14971 and IEC 62304 for devices and for software as a medical device.
Risk management
Every standard on this page asks you to manage risk and calls it something different: risk-based thinking, ISO/IEC 27005, ISO 14971, ICH Q9, the NIST framework, COSO. ISO 31000 describes the process they all share, IEC 31010 the techniques, from FMEA and HAZOP to bow-tie and Monte Carlo.
Whatever sector you are in, a requirement reaches you in one of three shapes, and the first thing to settle is which one you are holding. A standard is a document you meet because a contract, a tender or a customer's quality clause names it; ISO 9001, AQAP 2110 and ISO/IEC 27001 are standards, and the most useful of them are certifiable, meaning an accredited body audits you and issues a certificate. A regulation is a law that binds you because of what you are and what you sell, whether or not a contract mentions it; the MDR, EU GMP, NIS2 and DORA are regulations, and an authority, an inspector or a notified body enforces them. Guidance is what a regulator or an industry body publishes on how it expects a rule to be met; the GMP annexes, the ICH guidelines and the MDCG documents are guidance, not binding in themselves and read as if they were. The explorer below labels every entry as one of the three.
For most companies the first standard a customer asks about is ISO 9001, the quality management system standard, and almost everything else builds on it. Defence adds the AQAPs on top of it. A medical device quality system, ISO 13485, is ISO 9001 in shape with what a regulator expects added. A pharmaceutical quality system under ICH Q10 is built on the same concepts. ISO/IEC 27001 uses the same management-system structure for information security, so a company that holds one is halfway to holding the other. A certified ISO 9001 system is the usual place to start, and the ISO management-system standards page explains the family.
The cards below take you to the sector pages. Defence covers NATO's STANAGs and Allied Publications, the AQAP quality standards and EN 9100. Cybersecurity covers the ISO/IEC 27000 family, the NIST and CIS frameworks, IEC 62443, and the EU laws from NIS2 to the Cyber Resilience Act. Pharma and medical devices covers EU GMP and its annexes, the ICH guidelines, 21 CFR, the MDR and IVDR, and the ISO and IEC standards for devices and for software as a medical device. Risk management covers ISO 31000 and the techniques and sector standards that all describe the same process. Every page has its own explorer, scoped to its sector; the one on this page holds all of it.
Not this page, and not us. The contract names the standard, the law names its own scope, and the authority or the notified body decides what evidence it expects. What the explorer can do is show you the whole map: search it by number or name, browse it by family, or answer four questions and see which areas companies like you are commonly asked about. Each entry links to its source, to its ComplyTrain page where one exists, and otherwise to a request. ComplyTrain holds a standard as a requirement tree with the evidence against each requirement. The certificate stays yours to earn.
Standards explorer
Search NATO's catalogue, the ISO management systems, the cybersecurity standards and laws, the pharma and medical device rules and the risk standards together, browse them by family, or answer four questions.
Nothing matches that. Try a number, a code, or browse by family.
Which standards apply to you is set by your contracts, your licences and the laws your sector falls under. Treat this as a map, not a verdict.
Four questions, pick everything that applies. Nothing is stored.
The areas companies like you are commonly asked about, and the standards in each. Confirm against your contract, and see the sector pages for the detail.
Which standards apply to you is set by your contracts, your licences and the laws your sector falls under. Treat this as a map, not a verdict.
Each page sets out what the standard asks of you and how a ComplyTrain workspace is organised around it. The catalogue above holds far more than these, and any entry in it can be requested. Adding a standard to a workspace is usually a matter of days, not a project.
EN 9100
One aerospace quality standard published under three names: AS9100 in the Americas, EN 9100 in Europe, JISQ 9100 in Asia-Pacific. It contains ISO 9001 in full and adds the requirements aviation, space and defence put on top.
ISO
The ISO standards behind a management system, and how they divide: a few you can be certified against, and many more that are guidance or control sets supporting them. Knowing which is which decides what you can claim.
STANAG
A STANAG is a NATO Standardization Agreement: the terms under which member nations agree to a common military or technical procedure, or a common piece of equipment. Nations ratify and implement them, and the requirement reaches a supplier through the contract.
AQAP-2210
AQAP 2210 adds NATO's software-specific quality assurance requirements on top of AQAP 2110 or AQAP 2310. It is never cited on its own: it supplements the quality system those publications require, for the part of the deliverable that is software.
AQAP
AQAP is NATO's family of Allied Quality Assurance Publications: the quality requirements a defence contract can place on a supplier. Which one applies depends on what you deliver and how complex the contract is, and the acquisition authority decides, not you.
STANAG 4671
STANAG 4671 sets the airworthiness requirements for military unmanned aircraft. ComplyTrain ships the USAR requirement tree and certification document set, so the compliance matrix an assessor asks for is the system's normal output.
STANAG 4609
STANAG 4609 defines how NATO motion imagery and its metadata are formatted for exploitation. ComplyTrain traces its 35 technical requirements to the procedure that implements each one.
STANAG 4586
STANAG 4586 defines the interfaces that let one control station fly another nation's unmanned aircraft. ComplyTrain scopes its 24 requirements to the Level of Interoperability you declare.
AQAP-2310
AQAP 2310 sets NATO's quality management requirements for aviation, space and defence suppliers. ComplyTrain ships its requirement tree and a Quality Plan built to AQAP 2105, with the evidence already assembled.
AQAP-2131
AQAP 2131 is NATO's quality assurance requirement set for final inspection and test. ComplyTrain ships its full requirement tree and document set, so the Certificate of Conformity you sign is backed by traceable evidence.
ISO/IEC 27017
ISO 27017 extends the ISO 27002 controls to cloud services and adds controls specific to them. ComplyTrain holds each one as a requirement, including the ones that belong to your provider rather than to you.
ISO/IEC 27005
ISO 27005 is the guidance for managing information security risk - the assessment and treatment that ISO 27001 requires but does not describe. ComplyTrain runs it as a living register, not an annual document.
ISO/IEC 27002
ISO 27002 is the implementation guidance for the information-security controls listed in ISO 27001 Annex A. ComplyTrain holds each control as a requirement with the evidence that shows it is operating - which is what an auditor samples.
ISO 31000
ISO 31000 is the international guidance for managing risk. ComplyTrain’s risk management is structured around its process, so risk is a living framework across the organisation, not a spreadsheet reviewed once a year.
AQAP-2110
AQAP 2110 is NATO’s quality assurance requirement for design, development and production. It builds on ISO 9001, and ComplyTrain gives you the framework to manage the additional contractual requirements it adds.
ISO/IEC 27018
ISO 27018 extends ISO 27001 to the protection of personal data in public clouds. ComplyTrain gives you the framework to manage and evidence those controls.
ISO/IEC 27001
ISO 27001 is the standard for an information security management system (ISMS). ComplyTrain gives you the framework to build, run and evidence your ISMS - the certificate stays yours to earn.
ISO 9001
ISO 9001 is the international standard for quality management systems. ComplyTrain is structured around its clause structure, so your QMS is audit-ready by design.
A standard usually arrives as a contract condition or a regulator's letter rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract or your regulator cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the audit or the inspection.
How an engagement worksWe run and maintain the system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansA standard is a document you meet because a contract names it, and the useful ones are certifiable by an accredited body. A regulation is a law that binds you because of what you are and what you sell, and an authority enforces it. Guidance is what a regulator or an industry body publishes on how it expects a rule to be met, not binding in itself and read as if it were. The explorer labels every entry as one of the three.
The management-system standards written as requirements: ISO 9001, ISO/IEC 27001, ISO 13485, ISO 14001, ISO 45001, ISO 22301 and their kind, plus EN 9100 and, through a contract, the AQAPs. Guidance standards such as ISO 31000 and ISO/IEC 27002 cannot be certified against, and a law is complied with, not certified. Frameworks such as NIST are assessed against; SOC 2 is an attestation report, not a certificate.
Software holds the system; someone still has to build it. A company with a quality manager who knows the standard can do that in ComplyTrain alone. A company that has just received a contract clause and has no quality function usually cannot, which is what Skylen's consultants are for: they build the system with your team, in the product, so that what remains at the end is yours.
As a requirement tree: every clause of the standard as a node, with your procedures, records and evidence attached to the node they satisfy, and the gaps visible as empty nodes. An auditor sees the standard's own structure with your evidence under it. Adding a standard to a workspace is usually a matter of days, not a project.
No. Certification is issued by an accredited certification body, a licence by your authority, and government quality assurance is exercised by the acquisition authority. ComplyTrain is the system you build, run and evidence your compliance in, and Skylen's consultants can take you through the work. The certificate stays yours to earn.
Yes, and that is what the Request access button on every entry is for. Tell us which standard and where the requirement comes from, and we come back to you on what holding it in your workspace involves, usually within one business day. Adding a standard to a workspace is usually a matter of days, not a project. ComplyTrain holds a standard as a requirement tree with your evidence against each requirement, and the tree is what we build.