Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 4774
National authorities and NATO bodies implementing ADatP-4774's confidentiality metadata label syntax, and defence suppliers whose contracts invoke it
STANAG 4774 is NATO's agreement committing member nations to implement ADatP-4774's confidentiality metadata label syntax; it binds nations, not suppliers, directly.
STANAG 4774 is a NATO Standardization Agreement, Edition 1, promulgated 20 December 2017. It is not a technical specification. It is the agreement by which NATO nations commit to implement ADatP-4774, Edition A, the Allied publication that actually defines the confidentiality metadata label syntax. The document states its own purpose plainly: "The aim of this NATO standardization agreement (STANAG) is to respond to the following interoperability requirements," and that requirement is a single sentence: "To provide common XML-based formats and syntax for security policies and confidentiality metadata." Read on its own, STANAG 4774 requires nothing of a supplier directly. Its obligations run to nations, and it reaches a contractor only indirectly, once a nation has implemented it and a contract names ADatP-4774's requirements.
STANAG 4774 is explicit that it binds nations rather than organisations. "The enclosed NATO Standardization Agreement (STANAG), which has been ratified by member nations, as reflected in the NATO Standardization Document Database (NSDD), is promulgated herewith." It "is effective upon receipt and ready to be used by the implementing nations and NATO bodies." Nations that have not already done so are "invited to examine their ratification of the STANAG and, if they have not already done so, advise the NSO of their intention regarding its implementation." Partner nations sit outside that obligation: they are only "invited to adopt this STANAG," a lighter status than the ratification a member nation undertakes. So "is STANAG 4774 mandatory" has no single answer. It depends on whether a given nation has ratified and implemented it, and, for a supplier, on whether a contract invokes ADatP-4774 as a result.
Under "Agreement," "Participating nations agree to implement the following standard," naming "ADatP-4774, Edition A." None of this is written as a duty on a supplier; it is a duty on the nation, and it is discharged nationally: "The agreement is implemented when a nation has issued instructions that all national documents will follow the provisions of this agreement." Nations are separately invited "to report on their effective implementation of the STANAG using the form in Annex H to AAP-03(J)," and partner nations report adoption "using the form in Annex G to AAP-03(J)."
A reader who only has STANAG 4774 in hand does not yet have the confidentiality metadata label syntax itself. ADatP-4774 holds that. This document names no other related documents - the "Other related documents" heading is answered simply, "None" - so there is no sibling publication to weigh alongside ADatP-4774 here. The letter of promulgation also records that this edition "does not supersede any document."
"This STANAG is to be reviewed at least once every three years. The result of the review is recorded within the NSDD." A nation or NATO body may propose a change at any time, for processing at the next review. The agreement is supervised by the "C3 BOARD/BUREAU (C3B)" as tasking authority, with Canada named as custodian.
STANAG 4774 names no supplier obligation directly: every duty in the text runs to "nations" or "NATO bodies," never to a contractor or manufacturer. It also names no assessment or certification scheme of any kind, and it says nothing about how information should be classified - it sets a label format, not a classification policy. The only stated check is administrative: "The national decisions regarding the ratification and implementation of this STANAG are provided to the NSO."
STANAG 4774 itself gives a supplier nothing to implement in software: it is an agreement between nations, and the confidentiality metadata label syntax sits in ADatP-4774. Where ComplyTrain fits is the paperwork trail behind whichever labelling work a contract actually assigns: documented instructions for how security policy metadata and confidentiality labels are assigned and reviewed, training records showing the people responsible understand them, and a clear audit trail an auditor or customer quality representative can follow when labelling practice is questioned. That work is done in the information systems that produce and consume the labels, not in software we provide, and ComplyTrain's role is to hold the evidence that it happened.
ComplyTrain does not build, validate or process the XML-based label syntax itself, or substitute for ADatP-4774's own specification - that is systems-integration work for whoever designs the information systems concerned. The applicable tier and which interoperability requirements a supplier actually faces are set by the contract and the customer's quality clause, not by this page. Our standards explorer shows what else sits alongside STANAG 4774 - if you are weighing up what a tender actually requires, we're glad to talk it through.
Tell us how you need to work with STANAG 4774 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. A STANAG binds a nation once that nation has ratified and implemented it, and it reaches a supplier only when a contract names ADatP-4774. Whether it applies to a given programme is a question for the contract, not for this page.
STANAG 4774 is the cover agreement: it commits nations to implement ADatP-4774 but contains no label syntax itself. ADatP-4774 is the Allied publication that actually defines the confidentiality metadata label syntax.
No. STANAG 4774 describes no certification or accreditation scheme. Its only stated checks are nations reporting their ratification and implementation to the NSO, and a periodic review of the agreement itself. NATO does not certify organisations or products against a STANAG.
Edition 1, promulgated 20 December 2017. The letter of promulgation records that this edition "does not supersede any document."
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.