Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 6513
National authorities implementing NATO doctrine on countering insider threats, and organisations supporting an Allied joint operation under a specific tasking or contract
STANAG 6513 is NATO's agreement committing member nations to implement ATP-3.16.1, the doctrine for countering insider threats; it binds nations, not suppliers, directly.
STANAG 6513 is a NATO Standardization Agreement, Edition 1, promulgated 13 April 2016. It is not a technical specification. It is the agreement by which NATO nations commit to ratify and implement ATP-3.16.1, Edition A, the Allied Publication on countering insider threats. The doctrine itself, not this cover, is where the substance lives: the interoperability requirement stated in the STANAG is that "this doctrine will contribute to interoperability by describing NATO with a useful framework to understand, prevent, and counter insider threats and insider acts of violence during Allied joint operations." It adds that the doctrine "explains the nature of insider threats and insider attacks" and "provides guidance on the fundamentals of countering those threats while working with host nation security forces." Read on its own, STANAG 6513 requires almost nothing of a supplier directly. Its obligations run to nations, and it reaches an organisation supporting an Allied operation only once a nation has implemented it and a specific tasking or contract invokes the doctrine.
STANAG 6513 is explicit that it binds nations rather than organisations. Nations are "invited to examine their ratification of the STANAG and, if they have not already done so, advise the NSO of their intention regarding its implementation." Ratification and implementation are kept as separate steps, and the document defines implementation precisely: this STANAG and ATP-3.16.1 "are implemented when the procedures detailed in ATP-3.16.1 have been incorporated in national regulations, manuals and training." So "is STANAG 6513 mandatory" has no single answer: it depends on whether a given nation has ratified and implemented it, and, for an organisation supporting an Allied operation, on whether a specific tasking or contract then invokes the doctrine that implementation puts in place.
The stated aim is to respond to an interoperability requirement, met by "describing NATO with a useful framework to understand, prevent, and counter insider threats and insider acts of violence during Allied joint operations." Under "Agreement," participating nations "agree to implement the following standard," named as ATP-3.16.1, Edition A. None of this is written as a duty on a supplier; it is a duty on the nation, and on the NATO and national bodies that turn the doctrine into national regulations, manuals and training.
A reader who only has STANAG 6513 in hand does not yet have the doctrine it points to. The actual content on countering insider threats sits in ATP-3.16.1, Edition A. Other related documents named alongside it are STANAG 2437, which covers AJP-01, allied joint doctrine; STANAG 2190, which covers AJP-2, allied joint doctrine for intelligence, counter-intelligence and security; STANAG 2490, which covers AJP-3, allied joint doctrine for the conduct of operations; STANAG 2288, which covers AJP-3.2, allied joint doctrine for land operations; STANAG 2180, which covers AJP-3.4, allied joint doctrine for non-Article 5 crisis response operations; STANAG 2181, which covers AJP-3.4.1, the military contribution to peace support; STANAG 2611, which covers AJP-3.4.4, counterinsurgency doctrine; and STANAG 2528, which covers AJP-3.14, allied joint doctrine for force protection.
National ratification and implementation decisions "are provided to the NSO," recorded in the NATO Standardization Document Database. Nations are "requested to provide to the NSO their actual STANAG implementation details," using the reporting forms in AAP-03: the form in Annex H for nations and the form in Annex G for partner nations. The STANAG itself "is to be reviewed at least once every three years," with the result "recorded within the NSDD" - a check on whether the agreement is still current, not an audit of any organisation. It is supervised under the authority of MC, MCLSB, LO, SLDP.
STANAG 6513 names no indicator, screening criterion or detection method for identifying an insider threat, and no assessment or certification scheme for an organisation or a force. The only stated check is that the STANAG itself is reviewed periodically. Any operational detail on countering insider threats sits in ATP-3.16.1, which this cover does not reproduce.
STANAG 6513 itself gives an organisation nothing to implement in software: it is an agreement between nations, and the doctrinal content sits in ATP-3.16.1. Where ComplyTrain fits is the paperwork trail behind whatever insider-threat awareness or reporting role a specific tasking or contract actually assigns: documented procedures for that role, training records showing the people carrying it out have received the guidance the doctrine calls for, and the audit trail an assessor or a customer's quality representative would ask for when an insider-threat commitment is questioned.
ComplyTrain does not identify, screen or investigate an individual for insider-threat indicators, decide how a force or headquarters should structure its personnel security, or determine which doctrine applies to a specific tasking - that is set by the contract and the customer's quality clause, not by this page. Our standards explorer shows what else sits alongside STANAG 6513 - if you are weighing up what a tasking or tender actually requires, we're glad to talk it through.
Tell us how you need to work with STANAG 6513 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. A STANAG binds a nation once that nation has ratified and implemented it, and it reaches an organisation supporting an Allied operation only when a specific tasking or contract invokes the doctrine that implementation puts in place. Whether it applies to a given programme is a question for the contract, not for this page.
STANAG 6513 is the cover agreement: it commits nations to implement ATP-3.16.1 but contains no doctrinal content itself. ATP-3.16.1, Edition A is the Allied Publication that actually sets out the doctrine for countering insider threats.
No. STANAG 6513 describes no certification or accreditation scheme. Its only stated check is a periodic review of the agreement itself, at least once every three years. NATO does not certify organisations against a STANAG.
Edition 1, promulgated 13 April 2016. The letter of promulgation states that this STANAG does not supersede any document.
The STANAG itself answers this precisely: it and ATP-3.16.1 "are implemented when the procedures detailed in ATP-3.16.1 have been incorporated in national regulations, manuals and training." That is a national act, not a step an external organisation takes.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.