STANAG 4774 confidentiality metadata label syntax

What it is

STANAG 4774 is a NATO Standardization Agreement, Edition 1, promulgated 20 December 2017. It is not a technical specification. It is the agreement by which NATO nations commit to implement ADatP-4774, Edition A, the Allied publication that actually defines the confidentiality metadata label syntax. The document states its own purpose plainly: "The aim of this NATO standardization agreement (STANAG) is to respond to the following interoperability requirements," and that requirement is a single sentence: "To provide common XML-based formats and syntax for security policies and confidentiality metadata." Read on its own, STANAG 4774 requires nothing of a supplier directly. Its obligations run to nations, and it reaches a contractor only indirectly, once a nation has implemented it and a contract names ADatP-4774's requirements.

Who it binds, and how

STANAG 4774 is explicit that it binds nations rather than organisations. "The enclosed NATO Standardization Agreement (STANAG), which has been ratified by member nations, as reflected in the NATO Standardization Document Database (NSDD), is promulgated herewith." It "is effective upon receipt and ready to be used by the implementing nations and NATO bodies." Nations that have not already done so are "invited to examine their ratification of the STANAG and, if they have not already done so, advise the NSO of their intention regarding its implementation." Partner nations sit outside that obligation: they are only "invited to adopt this STANAG," a lighter status than the ratification a member nation undertakes. So "is STANAG 4774 mandatory" has no single answer. It depends on whether a given nation has ratified and implemented it, and, for a supplier, on whether a contract invokes ADatP-4774 as a result.

What the agreement actually commits nations to

Under "Agreement," "Participating nations agree to implement the following standard," naming "ADatP-4774, Edition A." None of this is written as a duty on a supplier; it is a duty on the nation, and it is discharged nationally: "The agreement is implemented when a nation has issued instructions that all national documents will follow the provisions of this agreement." Nations are separately invited "to report on their effective implementation of the STANAG using the form in Annex H to AAP-03(J)," and partner nations report adoption "using the form in Annex G to AAP-03(J)."

A cover agreement, not the label syntax itself

A reader who only has STANAG 4774 in hand does not yet have the confidentiality metadata label syntax itself. ADatP-4774 holds that. This document names no other related documents - the "Other related documents" heading is answered simply, "None" - so there is no sibling publication to weigh alongside ADatP-4774 here. The letter of promulgation also records that this edition "does not supersede any document."

Review and governance

"This STANAG is to be reviewed at least once every three years. The result of the review is recorded within the NSDD." A nation or NATO body may propose a change at any time, for processing at the next review. The agreement is supervised by the "C3 BOARD/BUREAU (C3B)" as tasking authority, with Canada named as custodian.

What it does not cover

STANAG 4774 names no supplier obligation directly: every duty in the text runs to "nations" or "NATO bodies," never to a contractor or manufacturer. It also names no assessment or certification scheme of any kind, and it says nothing about how information should be classified - it sets a label format, not a classification policy. The only stated check is administrative: "The national decisions regarding the ratification and implementation of this STANAG are provided to the NSO."