Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 5644
National authorities implementing NATO web services messaging agreements, and defence suppliers working to a contract that invokes ADatP-5644
STANAG 5644 is NATO's agreement committing member nations to implement ADatP-5644, the Web Services Messaging Profile for exchanging XML-based messages between systems; it binds nations, not suppliers, directly.
STANAG 5644 is a NATO Standardization Agreement. It is not a technical specification. It is the agreement by which NATO nations commit to implement ADatP-5644, Edition A, the Allied Publication that sets out the Web Services Messaging Profile (WSMP) for exchanging messages between systems over web services. The service profiles and interface detail that a reader usually wants live inside ADatP-5644 itself, not inside this five-page cover. Read on its own, STANAG 5644 requires almost nothing of a supplier directly. Its obligations run to nations, and it reaches a contractor only indirectly, once a nation has implemented it and a contract or tender names ADatP-5644.
STANAG 5644 is explicit that it binds nations rather than organisations. Its letter of promulgation describes the enclosed agreement as one "which has been ratified by member nations, as reflected in the NATO Standardization Document Database (NSDD), is promulgated herewith." Ratification and implementation are separate steps: nations that have not already reported their position are invited to "examine their ratification of the STANAG and, if they have not already done so, advise the NSO of their intention regarding its ratification and implementation." So "is STANAG 5644 mandatory" has no single answer: it depends on whether a given nation has ratified and implemented it, and, for a supplier, on whether a specific contract invokes ADatP-5644 as a result.
The stated aim is "to respond to the following interoperability requirements." Those requirements: the "Web Services Messaging Profile (WSMP) standard defines a set of service profiles and provides guidance to implement interoperability interfaces for the message based exchange," and the agreement is also "to provide specification for data forwarding to include message standards and data link protocols." Under "Agreement," participating nations agree to implement ADatP-5644, Edition A. None of this is written as a duty on a supplier; it is a duty on the nation, and on whichever national body runs the messaging infrastructure in question.
A reader who only has STANAG 5644 in hand does not yet have anything to build an interface against. The actual service profiles and interface requirements are in ADatP-5644. This document's own "Other related documents" field reads simply "None," a useful marker of how narrow its own scope is: it covers one publication and nothing beside it. Its cover also states plainly that "this STANAG does not supersede any document," and its "NATO Effective Date" is stated as "Not applicable."
Allies report their ratification details through the electronic reporting tool (e-Reporting), and national responses are recorded in the NATO Standardization Document Database (NSDD). The profile "is considered to be implemented by NATO bodies and nations when it is established as the primary infrastructure, where appropriate, to exchange XML-based messages"; Allies and NATO bodies report implementation the same way, and partner nations are separately invited to do so. The STANAG itself "is to be reviewed in accordance with AAP-03," with the result "recorded within the NSDD" - a check on whether the agreement is still current, not an audit of any organisation. Comments are directed to the NATO Standardization Office.
STANAG 5644 names no service profile, interface definition or message schema of its own - that detail sits entirely in ADatP-5644. It also names no assessment or certification scheme: the only stated check is that the STANAG itself is reviewed periodically under AAP-03, not that an organisation, a product or a system integration is certified.
STANAG 5644 itself gives a supplier nothing to implement in software: it is an agreement between nations, and the testable content sits in ADatP-5644. Where ComplyTrain fits is the paperwork trail behind whichever messaging requirements a contract actually invokes: documented interface specifications and configuration records for the systems exchanging messages, the evidence trail behind an interoperability test or integration event, and a clear link from a delivered system to the records that show it was built and checked against the agreed profile.
ComplyTrain does not define or build the WSMP service profiles and interfaces themselves, or run the interoperability tests, that is work carried out by system integrators and national authorities acting under ADatP-5644. What applies to a specific programme is set by the contract and the customer's quality clause, not by this page. Our standards explorer shows what else sits alongside STANAG 5644 - if you are weighing up what a tender actually requires, we're glad to talk it through.
Tell us how you need to work with STANAG 5644 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. A STANAG binds a nation once that nation has ratified and implemented it, and it reaches a supplier only when a contract or tender names ADatP-5644. Whether it applies to a given programme is a question for the contract, not for this page.
STANAG 5644 is the cover agreement: it commits nations to implement ADatP-5644 but contains no service profile or interface specification itself. ADatP-5644 is the Allied Publication that actually sets out the Web Services Messaging Profile (WSMP).
No. STANAG 5644 describes no certification or accreditation scheme. Its only stated check is a periodic review of the agreement's own currency, carried out in accordance with AAP-03. NATO does not certify organisations, products or systems against a STANAG.
The letter of promulgation in hand is dated 23 October 2023, and the cover states that "this STANAG does not supersede any document."
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.