Risk management with ISO 31000: a starter framework
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.
STANAG
STANAG: the NATO Standardization Agreements
Defence suppliers whose contract or tender flows down a STANAG requirement.
A STANAG is a NATO Standardization Agreement: the terms under which member nations agree to a common military or technical procedure, or a common piece of equipment. Nations ratify and implement them, and the requirement reaches a supplier through the contract.
What it is
What a STANAG is
STANAG stands for Standardization Agreement. It sets out the processes, procedures, terms and conditions under which NATO member nations agree to a common military or technical procedure, or to common equipment. The point is interoperability: an aircraft, a data link or an imagery feed from one nation has to work with another nation's systems.
A STANAG is agreed between nations, not issued to companies. Each member state ratifies the agreement and then implements it within its own armed forces. What reaches you as a supplier is the implementation: a national requirement written into a contract or a tender.
Every STANAG is maintained under AAP-03, NATO's directive for the production, maintenance and management of its standardization documents. It sets how nations report that they have ratified and implemented an agreement, and when the agreement is next reviewed, which is why every STANAG cover cites it. Because it governs how the agreement is kept rather than what the agreement requires, our pages do not list it among a standard’s references.
How the numbering works
STANAGs carry four-digit numbers, allocated in broad blocks by the body responsible for the subject area: 2000 and 2500 for army and joint-service matters, 3000 and 7000 for air, 4000 and 5000 for armaments and for communications and information systems, 6000 for the International Military Staff. The number is an address, not a difficulty rating: a low number is not an easier requirement.
The site now covers hundreds of STANAGs across every series, and the defence standards explorer finds any of them by number or title. The three below are written up in the most depth; all sit in the 4000 series, which is where unmanned systems, imagery and armaments interoperability sit.
Three STANAGs in depth
- STANAG 4586 - unmanned aircraft system control interoperability. It defines the interfaces that let one nation's control station command another's air vehicle, at a declared Level of Interoperability.
- STANAG 4609 - ISR motion imagery and its metadata. It is what makes a full-motion video feed usable by a NATO analyst who did not build the sensor that produced it.
- STANAG 4671 - the USAR airworthiness requirements for military unmanned aircraft. This is the one that leads to a type certificate, issued by a national military airworthiness authority.
Is there such a thing as STANAG certification?
Not in the way ISO 9001 certification works, and the distinction is worth getting right because the two are often confused. There is no accredited body that audits a company and issues it a STANAG certificate. A STANAG is ratified by nations and implemented nationally, and you meet it because a contract says so.
That said, a particular STANAG can sit underneath a national approval that very much is a certificate. STANAG 4671 is the clearest example: the airworthiness requirements in it are what a military airworthiness authority assesses a type certification case against. So the honest answer is that you are not certified to a STANAG, but you may hold an approval that a STANAG defines the basis for.
How STANAGs relate to the AQAPs
The two families are joined at the top. STANAG 4107 is the agreement that records nations' acceptance of mutual government quality assurance and their agreement to use the Allied Quality Assurance Publications, covering AQAP 2000, 2009, 2070, 2105, 2110, 2131, 2210 and 2310 among others. So when a contract cites AQAP 2110, the reason every NATO nation recognises it is a STANAG.
In practice the split is simple. The AQAPs govern how your quality is assured. The technical STANAGs govern what your product must do to work alongside everyone else's.
Not the standard you were looking for?
ComplyTrain is not limited to the standards written up on this site. The product is built around a requirement tree, and a requirement tree can be built for any standard, agreement or contractual specification that has requirements in it. The pages here are the ones we have documented so far, not the boundary of what the system handles.
We add standards on request, and the list grows steadily. If the STANAG or standard your contract cites is not here, tell us which one you need and we will tell you what supporting it in your workspace involves.
Most STANAGs are not published at all. STANAGs you cannot download explains why, how organisations obtain them, and lists every one that is not released or is classified.
How we help
How ComplyTrain helps you meet a STANAG
A technical STANAG lands on you as a long list of requirements that somebody will later ask you to evidence, one by one. That is the same shape of problem whichever agreement it is:
- The agreement's requirements held as a tracked set, each traced to the evidence that satisfies it - Requirements Management
- Procedures, test records and the compliance matrix under revision control with sign-off - Document Control
- The ISO 9001-structured quality system the contract usually requires underneath it - Quality Management
- Risk to contract performance as a living register - Risk Management
- Competence records for the engineers named on the contract - Training Management
Because the requirement tree is the product's core rather than a per-standard feature, a standard we have not written a page for is a content job, not an engineering one. Ask, and it can be added.
ComplyTrain holds no NATO qualification and does not need one: it is the system you run your own obligations in and hold the evidence for.
Request access to this standard
Tell us how you need to work with STANAG and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Questions
What does STANAG stand for?
Standardization Agreement. It records the terms under which NATO member nations agree to a common military or technical procedure, or to common equipment, so that one nation's systems work with another's.
Can a company be STANAG certified?
Not in the ISO 9001 sense: no accredited body audits a company and issues a STANAG certificate. Nations ratify a STANAG and implement it, and it reaches you as a contractual requirement. A specific STANAG can still underpin a national approval that is a certificate - STANAG 4671 is the basis on which a military airworthiness authority assesses a type certification case.
How are STANAGs numbered?
With four digits, allocated in blocks by subject area: roughly 2000 and 2500 for army and joint service, 3000 and 7000 for air, 4000 and 5000 for armaments and for communications and information systems, and 6000 for the International Military Staff. The number identifies the subject, not the difficulty.
What is the difference between a STANAG and an AQAP?
The AQAPs govern how your quality is assured; the technical STANAGs govern what your product must do to interoperate. They are formally linked: STANAG 4107 is the agreement recording nations' acceptance of mutual government quality assurance and their agreement to use the AQAPs.
The STANAG we need is not listed here. Can you support it?
Yes. The pages on this site are the standards documented so far, not the limit of what the product handles - ComplyTrain is built around a requirement tree, and one can be built for any standard, agreement or contractual specification. We add standards on request. Tell us which one your contract cites and we will explain what supporting it in your workspace involves.
What does "STANAG compliant" or "STANAG compatible" mean for a product?
That the product meets one specific STANAG, or more precisely the Allied standard that STANAG covers, in the edition and to the level a contract names. There is no general "STANAG compliant" status: AAP-03 defines a STANAG as nations' agreement to implement a standard, in whole or in part, with or without reservation. So ask of any such claim: which STANAG, which edition, which covered standard, and which level or options. A drone control station can meet STANAG 4586 at one Level of Interoperability and not at another.
Where can I find STANAG documents?
Public ones are listed in the NATO Standardization Office's document database (NSDD), and many can be downloaded there. Many others are not released to the public, or are classified; those are obtained through a national standardization authority. STANAGs you cannot download explains how and lists them. The text you have to meet is usually the Allied Publication the STANAG covers, not the STANAG itself.
What is the difference between a STANAG, a STANREC and an Allied Publication?
A STANAG is the agreement: AAP-03 defines it as the agreement of member nations to implement a standard, in whole or in part, with or without reservation, to meet an interoperability requirement. A STANREC is a non-binding recommendation, used only in the materiel field, that lists standards useful for an activity unrelated to interoperability; nations take it up voluntarily. An Allied Publication is the standard or standards-related document itself, named by a short title such as AEP, AJP or ATrainP. A STANAG usually covers one or more Allied Publications, and that is where the technical requirements live.
Does every NATO nation implement a STANAG the same way?
No. Each nation answers a STANAG with a ratification response: ratifying and implementing, ratifying with reservations, ratifying for future implementation (with or without reservations), not ratifying, or not participating. Reservations can leave out parts of the covered standard, and documents are reviewed at least every five years, so editions change. Two nations can both have ratified a STANAG and still require different things from a supplier. The national requirement in your contract is what you meet.
Implementation
Working a STANAG requirement into evidence
A technical agreement is met requirement by requirement, and demonstrated the same way.
Take the requirements from the contract, not the summary
The national implementation is what binds you, and it can add to or constrain the agreement. Work from what the contract actually cites.
Build the requirement tree
Every requirement as a tracked item with its criticality, so the set is countable and nothing sits in a paragraph nobody re-reads.
Attach evidence as it is produced
Test records, analyses and declarations belong on the requirement they satisfy, at the time they are made rather than in the week before a review.
Keep the compliance matrix current
The matrix is what an assessor or a prime asks for. Generated from the tree it is always true; maintained by hand it is true on the day it was written.
If you need to get there and have no quality function
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
Gap assessment
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversGuided implementation
Our consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksFull-service quality function
We run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service means
Official sources
The primary sources behind this page. Where a standard is quoted here, the publisher's own page is the authority.
What ComplyTrain does
One system for the whole compliance programme. Start with the module you need most.
Forms & Follow-up
Collect information the same way every time, and decide in advance what happens next.
Controls & Assurance
Know whether your controls are operating, not just whether a policy says they exist.
Project Planner
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Product Compliance
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Reporting & Analytics
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
Media Monitoring
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
Grants & Tenders
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
Stakeholder/Vendor Management
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
Requirements Management
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Risk Management
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Training Management
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Document Control
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Quality Management
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Latest from ComplyTrain
ISO 9001:2026: what changed from 2015, and what to do now
ISO 9001:2026 was published in September 2026. What changed from the 2015 edition, the transition deadlines, and a practical checklist for your next audit.
Compliance for two-person defence suppliers: where to start
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.