STANAG 4427 configuration management in system life cycle

What it is

STANAG 4427 is a NATO Standardization Agreement, currently Edition 3, dated 18 December 2014. It is not a technical specification. It is the agreement by which NATO nations commit to ratify and implement three companion Allied publications on configuration management: ACMP-2000 (Policy on Configuration Management), ACMP-2009 (Guidance on Configuration Management) and ACMP-2100 (Configuration Management Contractual Requirements), all Edition A. The configuration management principles, guidance and contract wording that a reader usually wants live inside those three publications, not inside this six-page cover. Read on its own, STANAG 4427 requires almost nothing of a supplier directly. Its obligations run to nations, and it reaches a contractor only indirectly, once a nation has implemented it and a contract or tender names one of the ACMPs, most often ACMP-2100.

Who it binds, and how

STANAG 4427 is explicit that it binds nations rather than organisations. Its letter of promulgation describes the enclosed agreement as one "which has been ratified by member nations, as reflected in the NATO Standardization Document Database (NSDD), is promulgated herewith." Ratification and implementation are separate steps, and the document invites nations that have not yet reported their position to "advise the NSO of their intention regarding its implementation." So "is STANAG 4427 mandatory" has no single answer: it depends on whether a given nation has ratified and implemented it, and, for a supplier, on whether a specific contract invokes one of the three ACMPs as a result.

Three publications covered together

Where STANAG 4427 differs from a narrower cover is that it commits nations to three publications at once. Under "Agreement," and "in accordance with the NATO Policy for System Life Cycle Management, C-M(2005)0108," ratifying nations agree to implement ACMP-2000 (policy), ACMP-2009 (guidance) and ACMP-2100 (contractual requirements) together. The stated aim is "to harmonize Configuration Management (CM) principles in national and multinational programmes to ensure armament systems and equipment meet the Alliance's interoperability needs." None of this is written as a duty on a supplier; it is a duty on the nation. Of the three, ACMP-2100 is the one most likely to reach a contractor directly, since it is the volume written as contractual wording rather than policy or guidance.

A cover agreement, not the configuration management process

A reader who only has STANAG 4427 in hand does not yet have a configuration management procedure to follow. The actual policy, guidance and contract clauses are in ACMP-2000, ACMP-2009 and ACMP-2100 respectively. The document also names four further items as related reading rather than covered content: AEDP-1 (Engineering Documentation in Multinational Joint Projects), ADatP-02 (the NATO Information Technology Glossary), ISO 10007 (the civil standard "Quality management systems - Guidelines for configuration management") and STANAG 4661 (Product Life Cycle Support, PLCS). Naming a civil ISO standard alongside NATO's own publications is worth noting on its own: STANAG 4427 treats ISO 10007 as background, not as something it covers or requires.

What this edition replaced

Edition 3 "supersedes the following documents: STANAG 4427 Edition 2, February 2007" and, unusually, "STANAG 4159 Edition 2, September 1991" - a separately-numbered predecessor folded into this STANAG rather than merely replaced by a same-numbered edition. A reader who still has STANAG 4159 on file should know it now lives inside STANAG 4427.

Reporting and review

Nations are invited to report their effective implementation of the STANAG using the form at Annex H to AAP-03(J); partner nations report their adoption using the form at Annex G to AAP-03(J). The STANAG itself "is to be reviewed at least once every three years," with the result recorded in the NSDD - a check on whether the agreement is still current, not an audit of any organisation. The agreement is supervised by the CNAD Life Cycle Management Group (AC/327), with Norway's Defence Logistics Organisation named as custodian.

What it does not cover

STANAG 4427 defines no configuration baseline, change control procedure or contract clause itself - that detail sits entirely in ACMP-2000, ACMP-2009 and ACMP-2100. It also names no assessment or certification scheme of its own: the only stated check is that the STANAG itself is reviewed periodically, not that an organisation or a product is certified.

Standards it references

• AEDP-01Background
• ADatP-02Background
• ISO 10007Background