News
Convergence of NATO & CCEB DCS Standards
23rd June 2026 Steve Kille Blog
About the author
Steve Kille has worked for many years on open standards for Messaging, XMPP, Directory, Security, and HF Radio. He has worked on CCITT, IETF, XSF, and NATO standards (currently editing STANAG 5066), which have been implemented by Isode.
He is also Isode’s CEO
DCS Convergence
NATO and Five Eyes are moving towards Data Centric Security (DCS), where access to data is controlled within the data itself rather than relying on external security controls.
Data Centric Security is a key Isode target. We have worked closely with NATO for a number of years, and our approach has always followed NATO standards. For this particular set of requirements, the goal is STANAG 4774/8 labeling in the context of the STANAG 5678 framework. For a more detailed look at exactly how we’re achieving this, you can read the white paper “Isode Approach to Data Centric Security using NATO Confidentiality Labels”.
A parallel DCS standard, in development by the Combined Communications Electronics Board (CCEB), named ‘ACP-240’, has until recently been on a diverging path from the standards set out by NATO. This has caused significant concern for both national agencies and industry.
Thankfully, the two groups led by NATO & the CCEB have decided to converge the two standards.
The first key step happened early this year, when the CCEB decided to fully align its standards to the NATO ones for maturity level 2 (DCS ML-2), which covers core labelling and access control. With the publication of ACP-240(A) amendment 2, Isode’s messaging and XMPP products are now supporting ACP-240 with “full” support. It was neat to achieve this compliance without any additional development effort.
The next step happened at a joint NATO/CCEB meeting in May 2026, looking at how to move forward jointly to maturity level 3 (DCS ML-3), which includes a number of capabilities, in particular encryption. There was a high level of consensus, and a joint plan is emerging.
Key elements of this are:
- Specification of Federated Credentials and Key Management (FCKM)
- Key Access Service (KAS), which is critical to support cross-domain encryption
- Profile for Web Access to Encrypted Documents
- Profile for Secure Messaging using S/MIME
Isode will be actively involved with developing these standards and, in due course, adding them to our product set.
