Platform
Modules
By sector
By sector
By standard
Blog
News
Events
JBP-2021.2
Programme offices, imagery-system developers and test facilities building or fielding NATO or US Department of Defense imagery-exchange systems
JBP-2021.2 is the joint NATO/US profile of ISO/IEC 12087-5 (BIIF) that fixes how NATO Secondary Imagery Format and NITFS imagery files must be structured, and how implementations are interoperability-tested.
JBP-2021.2, the Joint BIIF Profile, is a joint NATO and United States specification that profiles ISO/IEC 12087-5, the Basic Image Interchange Format (BIIF), for transmitting and storing electronic imagery. It supports both the NATO Secondary Imagery Format (NSIF), the format NATO nations use under STANAG 4545, and the United States National Imagery Transmission Format Standard (NITFS), so a system built to it can exchange imagery with either community without a separate implementation for each. It is jointly authored and maintained by the STANAG 4545 Custodial Support Team and the NITFS Technical Board, and is approved for use by NATO Command, Control, Communications and Intelligence systems and by every department and agency of the United States Department of Defense.
Its obligations are written against packing (producing) and unpacking (rendering) implementations rather than against an organisation directly. That distinction matters for a quality manager reading this page rather than a software architect: this is a specification a development team builds and tests against, and the evidence an assessor wants relates to what the software does, not to a management system.
A JBP file is a file header, with or without data segments. Where segments exist, they follow a fixed order - all image segments, then all graphic segments, then all text segments - and every segment is a subheader immediately followed by its own data. Every displayable item is positioned using a shared Common Coordinate System, with coordinates always positive and nothing permitted outside its positive quadrant. A complexity level, marked no lower than the most demanding feature the file actually contains, sets the outer bound of what that file may use.
Within an image segment, the profile fixes how pixel coordinates are addressed, requires the declared band count to match the image data, and sets rules for how look-up tables are structured and used for display. Blocked images must start each block on a byte boundary and pad out to it. Every image or graphic segment carries a unique display level, an attached segment inherits its parent's display level, and an overlay's display level must exceed its attachment level. Text segment lines are delimited by a carriage return and line feed.
Where an implementation needs a Support Data Extension - a Tagged Record Extension or a Data Extension Segment - beyond what the base profile defines, and that extension is controlled or registered, it has to be registered with the NSG GWG NITFS Technical Board (NTB), together with its name and purpose, before it can be used. One that is not registered is invalid, and an implementation that does not recognise a given extension has to ignore it and keep interpreting the rest of the file rather than fail. Reserved Extension Segments are documented as a structure but currently precluded from use in a JBP file altogether, because the NTB does not yet maintain a registry for them - worth knowing before a team designs around one.
The file header's overall security classification must be at least as high as the highest classification marked on any segment inside it, and every security field must carry valid data. The document also says, outside its formal requirements, that an implementation should always extract and display the classification data carried in a file's headers, and should not rely on a graphic overlay alone to convey security or handling instructions, because panning or zooming can move it out of view.
A packing implementation has to have a means of ensuring every file it produces stays within the complexity level the file declares. An unpacking implementation has to present content as the originator intended, and where it meets something it does not recognise or a conformance issue, it has to keep functioning and alert a system operator or administrator rather than fail outright. In practice, an assessor or a conformance test is checking segment presence and ordering, valid or correctly-defaulted field data, a complexity-level marking that matches the file's real content, genuine NTB registration for any extension identifier in use, and graceful handling of the unexpected.
JBP-2021.2 does not cover the physical handling, storage or network transport of imagery, who is authorised to see classified imagery, or the wider tasking and dissemination processes around an imagery system. It also does not restate the content of the compression, graphics and coordinate standards it invokes for particular techniques; it names the applicable standard and leaves the technical detail to it.
JBP-2021.2 is implemented in software and proved through testing, not through a management-system audit, so the honest place for ComplyTrain to help is the evidence trail around that work rather than the format itself. That means holding the procedure an organisation follows to register a new Tagged Record Extension or Data Extension Segment with the NTB, recording when each registration happened, against which system, and who owns it; keeping the record of an interoperability certification, an accredited test facility's findings, or a JITC conformance test, together with any corrective action that followed; and training the people involved on that internal process rather than on the file format.
ComplyTrain does not implement the JBP file format, does not pack or unpack JBP files, and does not perform or substitute for STANAG 4545 compliance testing or JITC interoperability certification. Those stay engineering and test-facility work.
The tier of standard that applies to a given contract, and what sits alongside JBP-2021.2 in it, is set by the contract and the customer's quality clause, not by us. Use the standards explorer to see what else applies to your programme, or talk to us about how you evidence the parts that are yours to prove.
Tell us how you need to work with JBP-2021.2 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. It is the joint profile that lets an implementation support both: the National Imagery Transmission Format Standard (NITFS) used by United States systems and the NATO Secondary Imagery Format (NSIF) defined under STANAG 4545. A system built to JBP-2021.2 can exchange imagery with either community rather than needing two separate implementations.
No. The document names no accredited certification scheme for an organisation. What it describes instead is conformance testing and registration for an implementation or IT capability: NATO programmes demonstrate compliance with STANAG 4545 through accredited test facilities, and United States government programmes obtain an interoperability certification, granted by JITC, before a new or upgraded IT capability is fielded.
Only if it introduces a controlled or registered Support Data Extension - a Tagged Record Extension or Data Extension Segment - that goes beyond the base profile. The registration covers that extension's identifier, name and purpose, not the whole system, and an unregistered extension is invalid wherever it appears.
The current edition is 2021.2, dated 2021-04-20. It replaces MIL-STD-2500C Change Notice 2 and the earlier BIIF Profile - NATO Secondary Imagery Format Version 01.01.
It binds through whichever route applies to the programme building or fielding the system: STANAG 4545 compliance for NATO imagery exchange, an interoperability certification for a United States Department of Defense IT capability, or a contract clause for a commercial supplier working for either.
It is catalogued in NATO's Standardization Document Database, which lists it and serves it free of charge. ComplyTrain does not sell it and hosts no copy. The ISO/IEC 12087-5 base standard it profiles is a separate publication, available from ISO or a national standards body on their own commercial terms.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.