Platform
Modules
By sector
By sector
By standard
Blog
News
Events
ARAMP-01
NATO acquisition programme offices, and the acquirers and suppliers running risk management on a NATO programme
A NATO guide to planning, running and monitoring risk management across an acquisition programme's life cycle, from risk register to response strategy.
ARAMP-1, NATO's Allied Risk Assessment Management Publication, is a guide to running risk management (RM) on an acquisition programme or project within NATO's System Life Cycle Management (SLCM) framework. It covers programmes of any kind and product class run under NATO or a NATO nation's acquisition policy, from a Risk Management Plan and a maintained risk register through to how risk is shared with a contractor across the life of a contract.
Clause 1.2 of the document is explicit: "This document is not mandatory for use but is principally focused toward NATO Nations." It is offered to "any NATO Nation or organization as well as industrial bodies, in their role as acquirer or supplier," and it is carried by STANREC 4739, a NATO Standardization Recommendation. A STANREC invites rather than commits, so ARAMP-1 has no force of its own; a supplier meets it only because a specific contract, RFP, or a national implementation of NATO's SLCM policy asks for a Risk Management Plan and risk register built along these lines.
The document's core is a five-step process, each step described with a common structure of inputs, tasks, outputs and toolbox:
The document maps this process onto NATO's system life cycle stages (AAP-48) and the programme/project management process (AAP-20). Stage transitions are controlled by decision gates at programme level; a project moves through milestones within a stage. At each decision gate, the authority responsible has to confirm that risks for the next stage are identified, that risks and actions carried over from the previous stage are accepted, and that the risk situation itself permits entering or leaving the stage.
Chapter 5 adds two NATO-specific concerns. It sets out a collaborative, rather than a purely risk-transferring, relationship between a NATO contracting authority and its contractor: a shared risk register, common definitions, and joint risk reviews across pre-contract-award, RFP development, source selection and post-contract-award phases. It also treats accelerated or rapid fielding as a distinct risk driver: reduced documentation, a compressed life cycle, and reliance on commercial or government off-the-shelf products all carry named risks, with concrete alternatives suggested rather than a blanket refusal.
Nobody certifies against ARAMP-1; it is guidance, and the document sets up no accreditation scheme. What does happen: internal risk audits check the RM process and response plans, and on a NATO contract, a source-selection evaluation team assesses an offeror's proposal risk and performance risk, with risk management sometimes used as a selection discriminator. After award, an Integrated Baseline Review checks the pre-award risk plans against what was actually contracted.
ARAMP-1 does not tell a reader whether it applies to their programme; that is set by the contract and the customer's quality clause, not by this guide or by us. It does not certify anything or anyone. And it is not a technical specification for a product: the risk register, RMP template and toolbox in its annexes are process tools, not requirements on what is being acquired.
ARAMP-1 describes a process run by people: risk workshops, a maintained risk register, RMP reviews, and periodic risk audits. That work happens in programme meetings and contractor reviews, not inside a piece of software, and ComplyTrain makes no claim of a built-in ARAMP-1 mapping, because there is none.
What ComplyTrain does for this kind of work in general: it holds the Risk Management Plan as a controlled, versioned document rather than a file that quietly diverges between the programme office and the contractor; it keeps training records for whoever is assigned to run risk management on a programme; and it logs the outcome of risk reviews and risk audits as dated, auditable records instead of meeting notes that get lost. That is the same document-control, training-record and corrective-action trail ComplyTrain provides for any process an organisation has to evidence, applied here to risk management rather than built specifically for it.
Which tier of NATO risk management practice a given programme has to meet, and which other Allied Publications sit alongside ARAMP-1, is set by the contract and the customer's quality clause. Use the standards explorer to see what else applies to your programme, and talk to us about how ComplyTrain holds the evidence for whichever of those a contract asks for.
Tell us how you need to work with ARAMP-01 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. Clause 1.2 of the document states plainly that it is not mandatory for use. It is carried by STANREC 4739, a NATO recommendation rather than a ratified STANAG, so it becomes relevant to a supplier only when a specific contract or RFP calls for a Risk Management Plan and risk register built to it.
No. ARAMP-1 is a process guide, and the document sets up no accreditation or certification scheme against it. What happens instead is internal risk audits and, on a NATO contract, a source-selection evaluation of an offeror's proposal and performance risk.
ARAMP-1's risk register template includes a field for linking a risk to a Mutual Government Quality Assurance reference, which is what AQAP-2070 governs. The two documents inform each other; ARAMP-1 does not require AQAP-2070 or vice versa.
Yes. The document treats risk as any uncertain event with a positive or negative effect on a project's objectives, and runs both threats and opportunities through the same five-step process, with separate response strategies: avoidance, mitigation and transfer for threats, exploit, enhance and share for opportunities.
STANREC 4739 is the NATO Standardization Recommendation that carries ARAMP-1: the cover document under which nations are invited, not required, to use this risk management guide.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.