Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 2528
National authorities and NATO commands implementing AJP-3.14, and defence suppliers working to a contract or task order that invokes force protection requirements
STANAG 2528 is NATO's agreement committing member nations to implement AJP-3.14, the Allied joint doctrine for force protection; it binds nations, not suppliers, directly.
STANAG 2528 is a NATO Standardization Agreement, currently Edition 3, dated 21 October 2024. It is not a technical specification. It is the agreement by which NATO nations commit to ratify and implement AJP-3.14, Edition B, the Allied Joint Publication that sets out doctrine for force protection. The doctrine itself, the detail a reader usually wants, lives inside AJP-3.14, not inside this seven-page cover. Read on its own, STANAG 2528 requires almost nothing of a supplier directly. Its obligations run to nations, and it reaches a contractor only indirectly, once a nation has implemented it and a contract or task order names AJP-3.14's force protection requirements.
STANAG 2528 is explicit that it binds nations rather than organisations. It "is effective upon receipt for use by the participating nations and NATO bodies." Its letter of promulgation describes the enclosed agreement as one "which has been ratified by member nations, as reflected in the NATO Standardization Document Database (NSDD), is promulgated herewith." Ratification and implementation are separate steps: nations that have not already done so are invited to "advise the NSO of their intention regarding its ratification and implementation." So "is STANAG 2528 mandatory" has no single answer. It depends on whether a given nation has ratified and implemented it, and, for a supplier, on whether a specific contract invokes AJP-3.14 as a result.
The stated aim is "to respond to the following interoperability requirements": "To further contribute to interoperability by providing a common basis for the identification of operational user needs and for the design and procurement of systems, structures and equipment related to force protection." Under "Agreement," participating nations agree to implement AJP-3.14, Edition B. None of this is written as a duty on a supplier; it is a duty on the nation, and on the forces and commands that plan and conduct force protection.
A reader who only has STANAG 2528 in hand does not yet have the force protection doctrine itself. AJP-3.14 holds that doctrine. This cover names a long family of sibling Allied Joint Publications for context - among them AJP-3 on conducting operations (via STANAG 2490), AJP-3.8 on CBRN defence (via STANAG 2451), AJP-3.18 on explosive ordnance disposal support (via STANAG 2628), AJP-4 on logistics (via STANAG 2182), and AJP-5 on planning operations (via STANAG 2526) - alongside three force-protection-adjacent tactical publications: ATP-3.3.6 (air operations), ATP-74 (allied maritime force protection) and ATP-94 (harbour protection). None of these are prerequisites in a supplier's own sense; they show where AJP-3.14 sits among NATO's wider family of joint doctrine.
STANAG 2528 and AJP-3.14, Edition B, "are implemented when the procedures detailed in AJP 3.14(B) have been incorporated in national regulations, manuals and training." Allies and NATO bodies "shall provide implementation details through the electronic reporting tool," while partner nations are only invited to do the same. The current edition supersedes STANAG 2528, Edition 2, dated 2 April 2015; the cover's own note on this edition says it reduces redundancy with AJP-3.14 and related documents, reflects updated NATO command and force structure and current policy and practice including cyberspace operations and strategic communications, and moves risk management guidance into the main publication. The STANAG "is to be reviewed in accordance with AAP-03." The result is recorded in the NSDD, and the agreement is supervised under NATO's joint operations doctrine committee chain.
STANAG 2528 names no supplier obligation directly: every duty in the text runs to "the participating nations," "NATO bodies" or "partner nations," never to a contractor or manufacturer. It also names no assessment or certification scheme of any kind. The only stated check is that the agreement itself is reviewed periodically against AAP-03, not that an organisation, a unit or a force protection activity is certified. Whatever assessment a commander or staff actually runs against force protection performance is a matter for AJP-3.14 itself, not for this cover.
STANAG 2528 itself gives a supplier nothing to implement in software: it is an agreement between nations, and the force protection doctrine sits in AJP-3.14. That doctrine is operational, and the work it describes, planning and delivering force protection, is done by commanders, staffs and, where a contract says so, a contractor's own people on the ground, not in a compliance platform.
Where ComplyTrain fits is the paperwork trail behind whichever force-protection-related tasks a contract actually assigns: documented procedures for the work involved, training records showing the people responsible have completed what the contract requires, and a clear corrective-action trail an auditor or customer quality representative can follow when performance is questioned. ComplyTrain does not plan force protection, run risk assessments, or design protective measures - that work sits with the commanders, staffs and nations implementing AJP-3.14. The applicable tier and which force protection requirements a supplier actually faces are set by the contract and the customer's quality clause, not by this page. Our standards explorer shows what else sits alongside STANAG 2528 - if you are weighing up what a tender actually requires, we're glad to talk it through.
Tell us how you need to work with STANAG 2528 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. A STANAG binds a nation once that nation has ratified and implemented it, and it reaches a supplier only when a contract or task order names AJP-3.14. Whether it applies to a given programme is a question for the contract, not for this page.
STANAG 2528 is the cover agreement: it commits nations to implement AJP-3.14 but contains no force protection doctrine itself. AJP-3.14 is the Allied Joint Publication that actually sets out NATO's doctrine for force protection.
No. STANAG 2528 describes no certification or accreditation scheme. Its only stated check is a periodic review of the agreement's own currency, carried out in accordance with AAP-03. NATO does not certify organisations or components against a STANAG.
Edition 3, dated 21 October 2024, which supersedes Edition 2, dated 2 April 2015.
The cover states that this edition reduces redundancy with AJP-3.14 and related documents, reflects updated NATO command and force structure and current policy and practice including cyberspace operations and strategic communications, and moves risk management guidance into the main publication rather than a separate annex.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.