Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 4728
National authorities implementing NATO's system life cycle management framework, and defence suppliers working under a contract that names AAP-20 or AAP-48
STANAG 4728 is NATO's agreement committing member nations to implement AAP-20 and AAP-48, the Allied Publications on system life cycle management for armaments programmes, binding nations rather than suppliers directly.
STANAG 4728 is a NATO Standardization Agreement on system life cycle management. It is not a technical specification. It is the agreement by which NATO nations commit to ratify and implement two Allied Publications: AAP-20, Edition C, the NATO Programme Management Framework (also called the NATO Life Cycle Model), and AAP-48, Edition C, NATO System Life Cycle Processes, both built on the basis of ISO/IEC 15288. The life cycle principles and process detail that a reader usually wants live inside AAP-20 and AAP-48 themselves, not inside this short cover. Read on its own, STANAG 4728 requires almost nothing of a supplier directly. Its obligations run to nations, and it reaches a contractor only indirectly, once a nation has implemented it and a contract or tender names AAP-20 or AAP-48.
STANAG 4728 is explicit that it binds nations rather than organisations. Its letter of promulgation describes the enclosed agreement as one which has been ratified by member nations, as reflected in the NATO Standardization Document Database (NSDD), and promulgated on that basis. Ratification and implementation are separate steps, and the document invites nations that have not yet reported their position to advise the NATO Standardization Office of their intention regarding ratification and implementation. So "is STANAG 4728 mandatory" has no single answer: it depends on whether a given nation has ratified and implemented it, and, for a supplier, on whether a specific contract invokes AAP-20 or AAP-48 as a result. The agreement takes effect upon receipt for use by the participating nations and NATO bodies, and it names no separate NATO Effective Date of its own.
The stated aim is to respond to a single interoperability requirement: to implement harmonised system life cycle management principles in national and multinational armaments programmes, so that armament systems and equipment meet the Alliance's interoperability needs. Under "Agreement," participating nations agree to implement AAP-20 and AAP-48. In response to the NATO Policy for System Life Cycle Management, C-M(2005)0108, this means applying the life cycle framework in armaments projects supporting NATO capabilities, with both publications required in their respective latest version. None of this is written as a duty on a supplier; it is a duty on the nation running the armaments programme.
A reader who only has STANAG 4728 in hand does not yet have a life cycle model to work to. The framework itself, and the detail of what a programme has to produce at each stage, is in AAP-20 and AAP-48. This document does settle one practical question for anyone working across both: where AAP-20 and AAP-48 conflict, AAP-20 has priority. Its "Other related documents" field also names STANREC 4808 (engineering in NATO programmes), AEP-67 and ALP-10, though as informative reading rather than content this STANAG requires anyone to implement.
Allies and NATO bodies are required to report their implementation details through the electronic reporting tool; partner nations are separately invited to report their implementation details the same way, as a voluntary step rather than a mandatory duty. The STANAG itself is reviewed in accordance with AAP-03, with the result recorded in the NSDD, a check on whether the agreement is still current rather than an audit of any organisation. The agreement is supervised by the CNAD Life Cycle Management Group (AC/327, Working Group 1), and comments on it go to the NATO Standardization Office in Brussels. This is the third promulgated edition, superseding Edition 2, dated 16 October 2015.
STANAG 4728 names no life cycle stage, deliverable or acceptance criterion of its own, and no assessment or certification scheme: the only stated check is that the agreement itself is reviewed periodically, not that an organisation or a product is certified. The substance a programme actually works to sits entirely in AAP-20 and AAP-48.
STANAG 4728 itself gives a supplier nothing to implement in software: it is an agreement between nations, and the testable content sits in AAP-20 and AAP-48. Where ComplyTrain fits is the paperwork trail behind whichever life cycle requirements a contract actually invokes: a documented programme management framework with defined stages and decision points, records of the reviews and approvals that move a programme from one stage to the next, and a clear link from a life cycle deliverable to the evidence that it was produced and reviewed as required.
ComplyTrain does not define a programme's life cycle model, run the technical or programmatic reviews that AAP-20 and AAP-48 describe, or decide which national ratification another nation should accept - that work sits with the programme office and national authorities acting under AAP-20 and AAP-48. What applies to a specific programme is set by the contract and the customer's quality clause, not by this page. Our standards explorer shows what else sits alongside STANAG 4728 - if you are weighing up what a tender actually requires, we're glad to talk it through.
Tell us how you need to work with STANAG 4728 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. A STANAG binds a nation once that nation has ratified and implemented it, and it reaches a supplier only when a contract or tender names AAP-20 or AAP-48. Whether it applies to a given programme is a question for the contract, not for this page.
STANAG 4728 is the cover agreement: it commits nations to implement AAP-20 and AAP-48 but contains no life cycle framework itself. AAP-20 is the NATO Programme Management Framework (NATO Life Cycle Model); AAP-48 is NATO System Life Cycle Processes, built on ISO/IEC 15288. Where the two conflict, AAP-20 takes priority.
No. STANAG 4728 describes no certification or accreditation scheme. Its only stated check is a periodic review of the agreement's own currency, carried out in accordance with AAP-03. NATO does not certify organisations or products against a STANAG.
The third promulgated edition, which the letter of promulgation states supersedes Edition 2, dated 16 October 2015.
The document names partner nations separately from Allies and NATO bodies: they are invited to report their implementation details through the same electronic reporting tool, but as a voluntary step rather than the ratification obligation that applies to member nations.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.