Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 5639
National authorities and NATO bodies implementing AComP-5639, and defence suppliers working to a contract or task order that invokes its protected core networking requirements
STANAG 5639 is NATO's agreement committing member nations to implement AComP-5639, the protected core networking (PCN) static environment specifications; it binds nations, not suppliers, directly.
STANAG 5639 is a NATO Standardization Agreement, currently Edition 1, dated 5 December 2025. It is not a technical specification. It is the agreement by which NATO nations commit to ratify and implement AComP-5639, Edition A, the Allied Communications Publication that sets out the protected core networking (PCN) static environment specifications. The specifications themselves, the detail a reader usually wants, live inside AComP-5639, not inside this cover. Read on its own, STANAG 5639 requires almost nothing of a supplier directly. Its obligations run to nations, and it reaches a contractor only indirectly, once a nation has implemented it and a contract or task order names AComP-5639's requirements.
STANAG 5639 is explicit that it binds nations rather than organisations. It "is effective upon receipt for use by the participating nations and NATO bodies." Its letter of promulgation describes the enclosed agreement as one "which has been ratified by member nations, as reflected in the NATO Standardization Documents Database (NSDD), is promulgated herewith." Ratification and implementation are separate steps: nations that have not already done so are invited to "advise the NSO of their intention regarding its ratification and implementation." So "is STANAG 5639 mandatory" has no single answer. It depends on whether a given nation has ratified and implemented it, and, for a supplier, on whether a specific contract invokes AComP-5639 as a result.
The stated aim is to respond to a set of interoperability requirements: PCN "provides the specifications required interconnect efficiently different national network segments so as to formulate a global, core network while at the same time ensuring a minimum level of security and quality services." The document adds that the PCN Core specifications cover "both Static and Deployable environments, as well as the description of interoperable capabilities between them." Under "Agreement," participating nations agree to implement AComP-5639, Edition A. None of this is written as a duty on a supplier; it is a duty on the nation, and on the network segments and commands that build and connect to the protected core.
A reader who only has STANAG 5639 in hand does not yet have the static-environment specifications themselves. AComP-5639 holds the technical detail this STANAG points at. This document names two sibling publications for context: STANAG 5637 (AComP-5637, the Protected Core Networking specifications in general) and STANAG 5640 (AComP-5640, the deployable-environment counterpart to this static-environment document). Neither is a prerequisite in a supplier's own sense; they show where AComP-5639 sits among NATO's other PCN publications.
STANAG 5639 "is implemented when a nation has issued instructions that all national documents will follow the provisions of this agreement when connecting different national network segments so as to build a federated operational backbone network." Allies and NATO bodies report implementation details through the electronic reporting tool, and partner nations are separately invited to do the same. This is Edition 1: the document states plainly, "This STANAG does not supersede any document." The STANAG "is to be reviewed in accordance with AAP-03." The result is recorded in the NSDD, and the agreement is supervised under NATO's digital policy and communications-and-information committee chain.
STANAG 5639 names no supplier obligation directly: every duty in the text runs to "nations" or "NATO bodies," never to a contractor or manufacturer. It also names no assessment or certification scheme of any kind. The only stated check is that the agreement itself is reviewed periodically against AAP-03, not that an organisation, a network segment or a PCN implementation is certified.
STANAG 5639 itself gives a supplier nothing to implement in software: it is an agreement between nations, and the static-environment specifications sit in AComP-5639. Where ComplyTrain fits is the paperwork trail behind whichever PCN-related tasks a contract actually assigns: documented procedures for the network configuration and interoperability work involved, training records showing the people responsible understand them, and a clear corrective-action trail an auditor or customer quality representative can follow when protected core networking compliance is questioned. That work is done in the day-to-day handling of network configuration and testing, not in software, and ComplyTrain's role is to hold the evidence that it happened.
ComplyTrain does not configure or operate a protected core network, decide what a specific mission or contract requires of a network segment, or substitute for AComP-5639's own specifications - that is work carried out by the nations and NATO commands implementing it. The applicable tier and which PCN requirements a supplier actually faces are set by the contract and the customer's quality clause, not by this page. Our standards explorer shows what else sits alongside STANAG 5639 - if you are weighing up what a tender actually requires, we're glad to talk it through.
Tell us how you need to work with STANAG 5639 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. A STANAG binds a nation once that nation has ratified and implemented it, and it reaches a supplier only when a contract or task order names AComP-5639. Whether it applies to a given programme is a question for the contract, not for this page.
STANAG 5639 is the cover agreement: it commits nations to implement AComP-5639 but contains no protected core networking specifications itself. AComP-5639 is the Allied Communications Publication that actually sets out the static environment specifications.
No. STANAG 5639 describes no certification or accreditation scheme. Its only stated check is a periodic review of the agreement's own currency, carried out in accordance with AAP-03. NATO does not certify organisations or components against a STANAG.
Edition 1, dated 5 December 2025. The document states it does not supersede any earlier document.
STANAG 5639 names them as related documents: STANAG 5637 covers AComP-5637, the general Protected Core Networking specifications, and STANAG 5640 covers AComP-5640, the deployable-environment counterpart to this static-environment document. They inform AComP-5639's specifications rather than being required by it.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.