Which defence standards apply to you?

The families of standards a defence supplier meets

Most companies meet these standards the same way: a contract, a tender or a customer's quality clause names one, and the name is all you get. This page explains what the names mean, how the families fit together and where the documents come from. The explorer below then finds the ones that match what you supply.

Start with ISO 9001

For most suppliers the first standard a customer asks about is ISO 9001, the international standard for a quality management system. It is one you can be certified against, it is the same in every industry, and almost every quality requirement in defence builds on it. A certified ISO 9001 system is the usual starting point, and a system that already follows it has done most of the work the defence families add to. See ISO 9001 and the ISO management-system standards.

EN 9100 and the AQAPs: what defence adds

EN 9100, published as AS9100 in the Americas, contains ISO 9001 in full and adds what aviation, space and defence require on top. NATO's own layer is the AQAP series, the Allied Quality Assurance Publications. AQAP 2110 sets the quality requirements for design, development and production and builds on ISO 9001. AQAP 2310 does the same for aviation, space and defence suppliers and builds on EN 9100. AQAP 2131 covers final inspection and test, AQAP 2210 adds software, and AQAP 2105 says what a quality plan must contain. Which AQAP applies to a contract is decided by the acquisition authority, not by the supplier. See AS9100 and EN 9100, the AQAP family, AQAP 2110 and AQAP 2310.

STANAG: the agreement between nations

A STANAG is a NATO Standardization Agreement. It records that member nations agree to use a common procedure, or to build to a common specification, so that their forces can work together. A STANAG is a covering document: it carries the agreement and its ratification status, and it names the publication that holds the technical content. STANAG 4107, for example, is the agreement under which nations accept each other's government quality assurance and use the AQAPs at all. Nations ratify and implement STANAGs; a supplier meets one because a contract cites it, or cites the publication under it. About 980 are active today. Read more on how STANAGs work.

Allied Publications: the standards themselves

An Allied Publication, or AP, is the document with the requirements in it. The letters say what kind it is: AQAP for quality assurance, AEP for engineering, AOP for ordnance and ammunition, ATP for tactical procedures, AMedP for medical, ANEP for naval engineering, AECTP for environmental testing, ACMP for configuration management and ACodP for codification. A STANAG usually covers one publication, sometimes several, and a few publications stand on their own. The catalogue holds around 1,200 of them.

STANRECs, and the civil standards NATO adopts

A STANREC is a NATO Standardization Recommendation: the non-binding form, recommended as good practice and not put to nations for ratification. A buyer can still write one into a contract, and then it binds you like any other clause. NATO also does not rewrite what industry already has: some STANAGs adopt an ISO, IEC, EN or SAE standard directly, around sixty in the catalogue, and a contract may then cite either name for the same requirement.

Information security, medical devices and risk

Three requirements reach a defence supplier from outside the NATO families and are in the explorer below for that reason. A NATO agency or a prime asks about information security, which means ISO/IEC 27001 and, for a supplier to the US Department of Defense, NIST SP 800-171; the cybersecurity page covers that world. A medical supplier is asked for ISO 13485, the device quality system; the pharma and medical device page covers it. And AQAP 2110 and ISO 9001 both ask for risk-based thinking, which the risk management page explains. The other ISO management systems, ISO 14001 environmental, ISO 45001 occupational health and safety and ISO 22301 business continuity, reach you through civil customers as often as defence ones.

Where the documents come from

NATO's Standardization Office lists every active standard in its public database, the NSDD, and serves the document itself for the unclassified ones, roughly a third of them. The rest come through your national standardization authority. ISO standards are bought from ISO or from your national standards body. Every entry in the explorer below links to its source.

Who decides what applies to you

Not this page, and not us. The contract and your customer's quality clause name the standards, and for AQAP the acquisition authority decides the level. What the explorer can do is show you the whole map: search it by number or name, browse it by area, or answer five questions about what you supply and see which areas suppliers like you are commonly asked about. Each entry links to its source, to its ComplyTrain page where one exists, and otherwise to a request. ComplyTrain holds a standard as a requirement tree with the evidence against each requirement. The certificate stays yours to earn.