AMSP-02 concept of employment for Modelling and Simulation as a Service

What it is

AMSP-02 is the NATO Allied Modelling and Simulation Publication that sets out the Allied Framework for Modelling and Simulation as a Service (MSaaS): a common approach for NATO and Nations to share modelling and simulation capability as a discoverable, composable service rather than as stand-alone tools each organisation builds separately. It is a concept of employment, not a technical specification - it defines who is involved and how they relate, and leaves the architecture itself to a companion Technical Reference Architecture it points to.

The document is explicit about how it binds: its own procedures "are not formally mandated by NATO, unless supported by a specific NATO Standardization Agreement (STANAG)", and it is instead covered by a Standardization Recommendation, STANREC 4794, so nations are invited to apply it rather than committed to it by ratification. For a Supplier or Provider, what matters in practice is a procurement, licence agreement or programme that has adopted the Allied Framework and makes its policies a condition of participation.

Four roles, not one audience

AMSP-02 organises everything around four stakeholder roles. The Customer is "a defense organization with an operational need (e.g., training, mission planning, acquisition), and is the budget holder". The Provider makes M&S products and services available to Users "in accordance with Customer SLAs" and has to "manage and maintain a core set of secure M&S services" to meet them. The User consumes those services and "is responsible for providing data and feedback on performance and functionality". The Supplier "develop[s] and provide[s] M&S products", reaching a Provider "via a product procurement or license agreement" - examples given include large defence contractors, small and medium enterprises, academic institutions and government organisations. Readers commonly collapse Provider and Supplier into one role; the document treats them as distinct, with the Provider carrying the SLA relationship with the Customer and the Supplier one step further back in the chain.

What an implementation has to do

An MSaaS implementation has to align with AMSP-01, NATO's M&S Standards Profile, and comply with the MSaaS Technical Reference Architecture, which is where the actual technical rules live - AMSP-02's own Technical Policies section states simply "None", deferring entirely to that companion document.

The organisational policies are where the substance sits. Every M&S capability has to be defined and provided as a service, and a Service Level Agreement has to be agreed between provider and customer "prior to service usage", documented against the template in Annex A. Each service needs a Service Description Template entry held in a discoverable, machine-readable registry reachable through an MSaaS Portal, and each provider has to declare a forecasted end-of-life date for every version of a service as part of its metadata. Each implementation also has to define its own business model, covering value proposition, stakeholder segments, key partners and activities, cost structure and revenue streams.

Security policy requires providers to address risk management, account management, authentication and authorisation, monitoring, physical security and data handling, and to keep data within a security domain at one classification level, re-classifying if combining it raises that level. One security clause is easy to misread: it requires that "products and services developed by industry SHALL provide the required nation certifications as fit for use" - a national certification a country's own regime demands, not a NATO or AMSP-02 certification, which the document neither creates nor administers.

How compliance testing actually works

AMSP-02 sets no certification scheme of its own. Compliance testing of individual M&S services "is the ultimate responsibility of the participating organizations", with NMSG "provid[ing] oversight of the Compliance Testing service" rather than running an audit or issuing a certificate. Integration, verification and compliance testing follow "existing STANAG/STANRECs" rather than AMSP-02 itself - the document cites STANREC 4800, which covers AMSP-04's federation architecture, as the kind of instrument this testing actually runs against. NMSG itself is "the delegated NATO tasking authority for M&S standards", with the Modelling and Simulation Standards Subgroup (MS3) as permanent custodian of the technical standards and the Military Operational Requirements Subgroup (MORS) responsible for identifying operational needs.

Standards it references

AMSP-02 is covered by STANREC 4794, the recommendation that lets NATO nations apply it without a STANAG's ratification obligation. It requires alignment with AMSP-01, the NATO M&S Standards Profile that carries the recommended M&S standards and STANAGs/STANRECs AMSP-02 itself does not list. Its compliance-testing clause points, by example, to STANREC 4800, which covers AMSP-04's federation architecture and federation object model. It also names AMSP-03, NATO's Reference Architecture for Distributed Synthetic Training, as a document NMSG should review alongside AMSP-02 for possible integration, without requiring it directly.

Standards it references

• AMSP-01Background
• STANREC 4800Background
• AMSP-04Background
• AMSP-03Background