Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 5668
National authorities implementing NATO's information exchange package documentation requirements, and defence and CIS suppliers building systems under a contract or tasking that invokes ADatP-5668
STANAG 5668 is NATO's agreement committing member nations to implement ADatP-5668, the specification for constructing and packaging NATO information exchange package documentation.
STANAG 5668 is a NATO Standardization Agreement, currently Edition 1, promulgated 5 February 2026. Like most STANAGs, it is not a technical specification in its own right. It is the agreement by which NATO nations commit to ratify and implement ADatP-5668, Edition A, the Allied Publication that defines the Information Exchange Package Documentation (IEPD) specification: the rules and practices for constructing and packaging a recurring NATO message so that it can be exchanged and understood consistently. The technical detail a reader usually wants sits inside ADatP-5668, not inside this five-page cover. Read on its own, STANAG 5668 requires almost nothing of a supplier directly: its obligations run to nations, and it reaches a contractor only indirectly, once a nation has implemented it and a contract or tasking brings ADatP-5668's requirements into play.
STANAG 5668 is explicit that it binds nations, not suppliers. Its letter of promulgation describes the enclosed agreement as one "which has been ratified by member nations, as reflected in the NATO Standardization Documents Database (NSDD), is promulgated herewith." Ratification and implementation are separate steps, and once ratified, the agreement is "effective upon receipt for use by the participating nations and NATO bodies." So "is STANAG 5668 mandatory" has no single answer: it depends on whether a given nation has ratified and implemented it, and, for a supplier, on whether a specific contract or tasking then invokes ADatP-5668.
The document states the interoperability requirement plainly: "To define the rules and practices for constructing and packaging a NATO Information Exchange Package Documentation (IEPD)." An IEPD "defines a recurring message in an arbitrary syntax and is built to satisfy information exchange business requirements," and will "ultimately define instance documents that will contain the information to be exchanged." The document treats the IEPD as the point of interoperability itself, between the systems on either side of an exchange. STANAG 5668 does not define the data model, schema or package format that makes that happen; ADatP-5668 does.
Ratifying the STANAG is not the same as putting it into practice. The document sets a two-part test: a nation has implemented the agreement when it "can receive, store, process and disseminate NATO standardization documents in IEPD format" and when it "has issued instruction to ensure that all NATO standards for which it is the custodian, that contain machine-readable artefacts, are complemented by a corresponding IEPD." Allies and NATO bodies are then required to report their implementation details through the electronic reporting tool; partner nations are only invited to report theirs.
STANAG 5668 names no detail of the IEPD construction and packaging rules themselves, which is all in ADatP-5668. It also states plainly: "This STANAG does not supersede any document." There is no earlier edition replaced by this one. The document names one related document, STANAG 4778's metadata binding mechanism (ADatP-4778), and no assessment or certification scheme of its own: the only stated check is procedural, described below.
The STANAG is to be reviewed in accordance with AAP-03, with the result recorded in the NSDD. It is supervised under the authority of NATO's DPC, DPC, CaP1, DM CaT.
STANAG 5668 itself gives a supplier nothing to implement: it is an agreement between nations, and the IEPD construction and packaging rules sit in ADatP-5668. Where ComplyTrain fits is the paperwork trail behind whichever ADatP-5668 requirements a contract or tasking actually invokes: documented procedures describing how the organisation's systems and processes build and package NATO standardization information the way the rules in force require, training records showing the people configuring and operating those systems have been briefed on the applicable requirements, and the audit trail an auditor or customer quality representative asks for when a specific tasking's compliance is questioned.
ComplyTrain does not define or implement the IEPD construction and packaging rules in a system, issue the national instructions that put ADatP-5668 into effect, or decide which ADatP-5668 provisions a given tasking carries - that work is done in the day-to-day building and operation of the information systems concerned, to whatever a specific contract requires. What applies to a specific programme is set by the contract and the customer's quality clause, not by this page. Our standards explorer shows what else sits alongside STANAG 5668 - if you are weighing up what a tasking actually requires, we're glad to talk it through.
Tell us how you need to work with STANAG 5668 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. A STANAG binds a nation once that nation has ratified and implemented it, and it reaches a supplier only once a contract or tasking invokes ADatP-5668's requirements. Whether it applies to a given programme is a question for the contract, not for this page.
STANAG 5668 is the cover agreement: it commits nations to implement ADatP-5668 but contains no detail of the IEPD construction and packaging rules themselves. ADatP-5668 is the Allied Publication that actually defines the specification.
No. STANAG 5668 describes no certification or accreditation scheme. Nations report their own ratification responses and implementation details to the NSO through the electronic reporting tool, and the only other stated check is a review of the STANAG itself in accordance with AAP-03. NATO does not certify organisations or products against a STANAG.
STANAG 5668 names STANAG 4778, which covers ADatP-4778's metadata binding mechanism, as another related document. STANAG 5668 does not make it a condition of its own implementation; it is named as related reading rather than a requirement.
The document sets a two-part test: when a nation can receive, store, process and disseminate NATO standardization documents in IEPD format, and when it has issued instruction bringing the NATO standards it is custodian of, that contain machine-readable artefacts, into a corresponding IEPD.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.