{"text_format":"1","workbook":"xlsx","n_sheets":5,"sheets":["TTIPs","PivotPie","PivotStacked","Checklist","DashBoard"],"not_rendered":{"charts":2,"images":2,"macros":1,"external_links":0,"defined_names":4,"comments":0,"pivot_tables":3},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"TTIPs","index":0,"n_rows":115,"n_cols":14,"rows_kept":115,"cut":false,"hidden":true,"merged":[]}
["Ref","Policy ","Serial","§","Area",null,"Effect","Definition","Cross-Reference","N/A","Full","Suff.","Insuff.","Scarce\n/\nNone"]
[null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(J67:J9878,\"X\")","v":0},{"$f":"COUNTIF(K67:K9878,\"X\")","v":0},{"$f":"COUNTIF(L67:L9878,\"X\")","v":0},{"$f":"COUNTIF(M67:M9878,\"X\")","v":0},{"$f":"COUNTIF(N67:N9878,\"X\")","v":0}]
["C-M(2015)0041-REV1 ANN2","Service Management Policy","S001","6","Capabilities Delivered Through Services",null,"All NATO apportioned ICT capabilities shall be defined and provided as services and managed in accordance with this policy.","All NATO apportioned ICT capabilities shall be defined and provided as services ",null,"X"]
[null,"Service Management Policy","S002","7","Governance",null,"Service Management shall take input in the form of direction, monitoring and control from NATO governance bodies, including senior policy committees, supervisory boards, and programme steering committees","Service Management shall take input in the form of direction, monitoring and control from NATO governance bodies, including senior policy committees, supervisory boards, and programme steering committees",null,null,"X"]
[null,"Service Management Policy","S003","8","Adoption of ITIL",null,"In order to achieve a service-based ICT environment, NATO shall adopt ITIL as a service management framework, complemented by other industry best practices. The individual service lifecycle processes shall be aligned with the specific operational requirements of NATO","NATO shall adopt ITIL as a service management framework, complemented by other industry best practices. ",null,null,null,"X"]
[null,"Service Management Policy","S004","10","Coordination of Requirements and Planning",null,"Service requirements shall be coordinated amongst the Service Customers to meet operational and business needs and aligned with financial, managerial and policy frameworks, prior to being addressed to the Service Provider. Coordination shall be undertaken to prioritize of service provision via periodic, collective planning organised around the major Communities of Interest enabling functions. In both enterprise and federation contexts services should be identified against targets for incorporation in a service pipeline. ","Service requirements shall be coordinated amongst the Service Customers to meet operational and business needs and aligned with financial, managerial and policy frameworks, prior to being addressed to the Service Provider. ",null,null,null,null,"X"]
[null,"Service Management Policy","S005","11","Service Catalogues and Portfolio",null,"All services shall be planned though a coherent enterprise Service Portfolio and made available through one or more Service Catalogues","All services shall be planned though a coherent enterprise Service Portfolio and made available through one or more Service Catalogues",null,null,null,null,"X"]
[null,"Service Management Policy","S006","12","Need for Agreements and Contracts",null,"The provision of services must be efficient, effective and measurable. Prior to commencement of any service delivery, Service Providers and Service Customers shall establish between them an agreed contract for all services to be provided, supported by Service Level Agreements, Memoranda of Agreement/Understanding, and appropriate metrics, such as Service Level Targets and Key Performance Indicators","The provision of services must be efficient, effective and measurable. Service provision should be established by means of supporting SLA, MoA, MoU eitha ppropriate metrics",null,null,null,null,null,"X"]
[null,"Service Management Policy","S007","13","Costs",null,"All provided services must be costed. This includes all costs associated with the Service Lifecycle as well as the risks accepted by the Service Provider and covered under warranty.","All provided services must be fully costed. ",null,null,null,null,null,"X"]
[null,"Service Management Policy","S008","14","Interoperability and Standardisation",null,"To promote service management interoperability between services within NATO and at the interconnection with external entities, Service Management shall be based on NATO-agreed standards applicable to the provision, use and monitoring of all services in the enterprise","Service Management shall be based on NATO-agreed standards ","Interoperability Policy",null,null,null,null,"X"]
[null,"Service Management Policy","S009","15","Multiple Service Providers",null,"The provision of a service to a Service Customer may involve multiple Service Providers. Standardisation and reutilisation of existing services shall increase interoperability between services from different sources","Standardisation and reutilisation of existing services shall be favoured to increase interoperability between services from different sources"]
[null,"Service Management Policy","S010","16","Service Monitoring and Improvement",null,"To ensure service quality and interoperability, Service Management shall identify and provide suitable management tools, metrics and measurement methods to report and assess the level of service requested and provided. The distributed, interconnected set of organisational relationships within the NATO enterprise and through interface points to Nations mean operations dependent upon federated services from several sources are particularly vulnerable to manipulation, degradation or loss of infrastructure. Feedback shall be provided to the Service Provider and appropriate regulatory bodies for assessment and service improvement. Service management regulatory documents will provide the necessary guidance for monitoring and management of services","Service Management shall identify and provide suitable management tools, metrics and measurement methods to report and assess the level of service requested and provided. The distributed, interconnected set of organisational relationships within the NATO enterprise and through interface points to Nations mean operations dependent upon federated services from several sources are particularly vulnerable to manipulation, degradation or loss of infrastructure. "]
["C-M(2015)0041-REV1 ANN3","Lifecycle Management","S011","10","ITIL",null,"This lifecycle should be aligned with the Information Technology Infrastructure Library (ITIL) lifecycle phases and processes to enable the adaptation of best practices for ICT service management to NATO needs.","This lifecycle should be aligned with the Information Technology Infrastructure Library (ITIL) lifecycle phases and processes.","ITIL"]
[null,"Lifecycle Management","S012","11","Coherence",null,"The coherence and traceability of requirements and resources across the lifecycle shall be enabled through use of the the NATO C3 Taxonomy, the C3 Integrated Master Plan and a Customer Catalogues for C3 Capabilities and ICT Services, which shall be used as the basis for Service Level Agreements, CIS support to NATO operations, and a Technical V&V function for interoperability","The coherence and traceability of requirements and resources across the lifecycle shall be enabled through use of the the NATO C3 Taxonomy, the C3 Integrated Master Plan and a Customer Catalogues for C3 Capabilities and ICT Services","Interoperability Policy"]
[null,"Lifecycle Management","S013","11.1.1","Customer Catalogue",null,"All NATO C3 Capabilities and ICT Services offered in Customer Catalogues shall be traceable to the NATO C3 Taxonomy and to the NDPP collective requirements ","All NATO C3 Capabilities and ICT Services offered in Customer Catalogues shall be traceable to the NATO C3 Taxonomy and to the NDPP collective requirements "]
[null,"Lifecycle Management","S014","11.1.2","Identification of Service Providers",null,"For each service in the C3 Taxonomy the NATO Enterprise organisation(s) assigned as Service Provider shall be identified","For each service in the C3 Taxonomy the NATO Enterprise organisation(s) assigned as Service Provider shall be identified"]
[null,"Lifecycle Management","S015","13","Use of existing tools",null,"NATO Enterprise organisations shall use the C3 Taxonomy, C3 Integrated Master Plan and Customer Catalogues to integrate and satisfy short, mid and long term C3 requirements for translation into ICT Services in a coherent way.","NATO Enterprise organisations shall use the C3 Taxonomy, C3 Integrated Master Plan and Customer Catalogues to integrate and satisfy short, mid and long term C3 requirements for translation into ICT Services in a coherent way."]
[null,"Lifecycle Management","S016","14","Reuse",null,"In developing C3 Capabilities and ICT Services requirements, NATO Enterprise organisations shall maximise reuse of existing solutions, using proven off-the-shelf solutions, and only developing NATO-unique solutions where no affordable alternative exists, according to Adopt, Buy or Create (ABC) principle.","NATO Enterprise organisations shall maximise reuse of existing solutions, using proven off-the-shelf solutions, and only developing NATO-unique solutions where no affordable alternative exists, according to Adopt, Buy or Create (ABC) principle.","Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery"]
["C-M(2015)0041-REV1 ANN4","Waveform Policy","S017",4.0999999999999996,"Waveform Standards",null,"The number of Alliance-adopted waveform standards as well as modifications to Alliance-adopted waveform standards should be kept to a minimum to help ensure interoperability between various implementations","The number of Alliance-adopted waveform standards as well as modifications to Alliance-adopted waveform standards should be kept to a minimum "]
[null,"Waveform Policy","S018",4.2,null,null,"The introduction of new Alliance-adopted waveform standards shall be based on agreed operational requirements or offer an opportunity for significant enhancement to existing Alliance operational capability","The introduction of new Alliance-adopted waveform standards shall be based on agreed operational requirements or offer an opportunity for significant enhancement to existing Alliance operational capability"]
[null,"Waveform Policy","S019",4.3,null,null,"New Alliance-adopted waveform specifications and those selected to be part of the set of existing Alliance-adopted waveform standards shall be free of any charge for use for NATO and NATO Nations","New Alliance-adopted waveform specifications shall be free of any charge for use for NATO and NATO Nations"]
[null,"Waveform Policy","S020",4.4000000000000004,null,null,"Alliance-adopted waveform specifications shall be divided into mandatory and optional functions; the mandatory functions shall define the minimum interoperability capability","Alliance-adopted waveform specifications shall be divided into mandatory, which define the minimum interoperability solution,  and optional functions; "]
[null,"Waveform Policy","S021",4.5,null,null,"Alliance-adopted waveform specifications shall not prevent the implementation of national encryption","Alliance-adopted waveform specifications shall not prevent the implementation of national encryption"]
[null,"Waveform Policy","S022",4.5999999999999996,"Waveform Reference Software",null,"Alliance-adopted waveforms shall be supported by a complete waveform specification, and shall be supported in due course by waveform functional reference software and waveform interoperability reference software","Alliance-adopted waveforms shall be supported by a complete waveform specification, and shall be supported in due course by waveform functional reference software and waveform interoperability reference software"]
[null,"Waveform Policy","S023",4.7,null,null,"Alliance-adopted waveform functional reference software and waveform interoperability reference software shall be provided free of charge to NATO Nations and shall be freely redistributable within NATO and NATO national governments under agreed predefined conditions ","Alliance-adopted waveform functional reference software and waveform interoperability reference software shall be provided free of charge and freely distributable to and within NATO Nations under agreed conditions","Software Policy"]
[null,"Waveform Policy","S024",4.8,null,null,"The waveform functional reference software should be used to provide example instantiations of the Alliance-adopted waveforms and should support further waveform definition work","The waveform functional reference software should be used to provide example instantiations of the Alliance-adopted waveforms and should support further waveform definition work"]
[null,"Waveform Policy","S025",4.9000000000000004,null,null,"The waveform interoperability reference software should be used by NATO and NATO Nations to support waveform interoperability testing and further waveform definition work","The waveform interoperability reference software should be used by NATO and NATO Nations to support waveform interoperability testing and further waveform definition work"]
[null,"Waveform Policy","S026","4.10",null,null,"Additional versions of the waveform functional and interoperability reference software with IPR are acceptable, particularly where they demonstrate an ability to enhance the performance.","Additional versions of the waveform functional and interoperability reference software with IPR are acceptable"]
[null,"Waveform Policy","S027","4.11",null,null,"Alliance-adopted waveform software, except for target waveform software, shall not rely on platform specific signal processing functions or OS specific real time mechanisms. Any interaction and dependency required by the Radio Platform for proper waveform operational use shall be documented","Alliance-adopted waveform software, except for target waveform software, shall not rely on platform specific signal processing functions or OS specific real time mechanisms. "]
[null,"Waveform Policy","S028","4.12",null,null,"Alliance-adopted waveform software should be based on open software standards, whenever possible, using the Software Communications Architecture (SCA) to facilitate sharing between nations, and include the use of open Application Programming Interfaces (APIs","Alliance-adopted waveform software should be based on open software standards, whenever possible, using the Software Communications Architecture (SCA) "]
[null,"Waveform Policy","S029","4.13",null,null,"NATO Nations and industry developing prototype waveform software are encouraged to offer these, with the necessary terms and conditions, for use as Alliance waveform reference software (functional and interoperability).","NATO Nations and industry developing prototype waveform software are encouraged to offer these, with the necessary terms and conditions, for use as Alliance waveform reference software (functional and interoperability)."]
[null,"Waveform Policy","S030","4.14",null,null,"Nations and industry implementing NATO waveforms in base or target waveform software are encouraged to offer these, with the necessary terms and conditions, for use in waveform definition and interoperability testing processes","Nations and industry implementing NATO waveforms in base or target waveform software are encouraged to offer these, with the necessary terms and conditions, for use in waveform definition and interoperability testing processes"]
[null,"Waveform Policy","S031","4.15",null,null,"Nations are encouraged to notify the C3B, through the NHQC3S of national development of waveform software (typically prototype, base or target) subject to serve as Alliance software references. Nations and industry developing base and/or target waveform software should offer these to NATO Nations under agreed predefined conditions. NATO shall create a registry of waveform artefacts consisting of links to current NATO Nation waveform libraries","Nations are encouraged to notify the C3B, through the NHQC3S of national development of waveform software (typically prototype, base or target) subject to serve as Alliance software references. Nations and industry developing base and/or target waveform software should offer these to NATO Nations under agreed predefined conditions. NATO shall create a registry of waveform artefacts consisting of links to current NATO Nation waveform libraries"]
[null,"Waveform Policy","S032","4.16","Base Waveforms",null,"NATO shall endeavor to obtain a base waveform implementation to act as a basis for interoperable implementation, and as a basis for interoperability testing that does not bias interoperability testing towards any specific commercial implementation.","NATO shall endeavor to obtain a base waveform implementation to act as a basis for interoperable implementation, and as a basis for interoperability testing that does not bias interoperability testing towards any specific commercial implementation."]
[null,"Waveform Policy","S033","4.17",null,null," IPR may be attached to the endorsed base waveform applications, which shall be evaluated for recognition as licensed under Fair, Reasonable, and Non-discriminatory (FRAND) terms by the community of users in the early steps of the endorsement procedure.","IPR may be attached to the endorsed base waveform applications, which shall be evaluated for recognition as licensed under Fair, Reasonable, and Non-discriminatory (FRAND) terms by the community of users in the early steps of the endorsement procedure."]
["C-M(2015)0041-REV1 ANN5","Interoperability Policy","S034","7.1","Architectural Approach",null,"NATO C3 Interoperability Requirements (C3 IOR) shall be expressed in terms of the required sharing of information and ICT services and shall be identified and consolidated by the NATO Military Authorities (NMA) and Staffs within NATO capability requirement statements for execution by NATO and Nations","NATO C3 Interoperability Requirements (C3 IOR) shall be expressed in terms of the required sharing of information and ICT services and shall be identified and consolidated by the NATO Military Authorities (NMA) and Staffs within NATO capability requirement statements for execution by NATO and Nations"]
[null,"Interoperability Policy","S035","7.2",null,null,"Architecture products shall serve to inform, guide and document interoperability of C3 Capabilities and ICT Services in their lifecycle.","Architecture products shall serve to inform, guide and document interoperability of C3 Capabilities and ICT Services in their lifecycle.","Enterprise Architecture Policy"]
[null,"Interoperability Policy","S036","8.1","Standards and Profiles",null,"Standards and profiles shall be included within the NATO Interoperability Standards\nand Profiles (NISP).","Standards and profiles shall be included within the NATO Interoperability Standards and Profiles (NISP)."]
[null,"Interoperability Policy","S037","8,2",null,null,"NATO Enterprise entities shall ensure the service interface profiles associated with the C3 Capabilities and ICT Services they develop and provide are published in the NISP and are available for verification and validation testing to other NATO Enterprise entities and\nNATO Nations.","The service interface profiles associated with the C3 Capabilities and ICT Services they develop and provide shall be  published in the NISP.\nThey have to be madee available  to other NATO Enterprise entities and NATO Nations."]
[null,"Interoperability Policy","S038","8.3",null,null,"NATO architectures shall utilise the agreed standards (STANAGs) and profiles from the NISP as appropriate to achieve the required interoperability of C3 Capabilities and ICT Services.","NATO architectures shall utilise the agreed standards (STANAGs) and profiles from the NISP as appropriate ","Enterprise Architecture Policy"]
[null,"Interoperability Policy","S039","8.4",null,null,"Appropriate interoperability solutions and procedures to match C3 IOR over time shall be identified/developed and documented by the implementer and coordinated with the C3 Board as appropriate.","Appropriate interoperability solutions and procedures to match C3 IOR over time shall be identified/developed and documented by the implementer and coordinated with the C3 Board as appropriate."]
[null,"Interoperability Policy","S040","8.5",null,null,"NATO Enterprise entities shall implement and adopt the appropriate interoperability solutions and procedures to meet agreed C3 IOR. This will involve the achievement of semantic as well as syntactic, empirical and physical interoperability.","NATO Enterprise entities shall implement and adopt the appropriate interoperability solutions and procedures to meet agreed C3 IOR. This will involve the achievement of semantic as well as syntactic, empirical and physical interoperability."]
[null,"Interoperability Policy","S041","9.1","Verification and validation of Interoperability Solutions through Testing",null,"Interoperability of solutions to C3 IOR shall be verified and validated, in a cost effective manner, by testing regularly during the life cycle, in accordance with the provisions of this policy.","Interoperability of solutions to C3 IOR shall be verified and validated, in a cost effective manner, by testing regularly during the life cycle"]
[null,"Interoperability Policy","S042","9.2",null,null,"Testing of the interfaces of C3 Capabilities and ICT Services shall be conducted, including testing against the agreed standards and profiles that are contained within the NISP. Testing at National level is a national responsibility and NATO is responsible for testing as a Host Nation.","Testing of the interfaces of C3 Capabilities and ICT Services shall be conducted, including testing against the agreed standards and profiles that are contained within the NISP. Testing at National level is a national responsibility and NATO is responsible for testing as a Host Nation."]
[null,"Interoperability Policy","S043","9.3",null,null,"C3 Capabilities and ICT Services shall have their interfaces pass NATO level C3 Interoperability tests; this testing shall be between NATO, NATO Nations and Partners Nations C3 Capabilities and ICT Services interfaces, based on the NATO agreed standards and profiles that are contained within the NISP. The testing shall include assessment, analysis, evaluation, verification, validation and up to, but not including, the certification of C3 Capabilities and ICT Services.","C3 Capabilities and ICT Services shall have their interfaces pass NATO level C3 Interoperability tests; The testing shall include assessment, analysis, evaluation, verification, validation and up to, but not including, the certification of C3 Capabilities and ICT Services."]
[null,"Interoperability Policy","S044","9.4",null,null,"The status of interoperability testing of STANAGs is valuable information that must be recorded. To the extent possible, this information shall be included in the NISP.","The status of interoperability testing of STANAGs is valuable information that must be recorded. To the extent possible, this information shall be included in the NISP."]
[null,"Interoperability Policy","S045","9.5",null,null,"A harmonised spectrum of test capabilities shall be established and used to verify and validate NATO and national C3 interoperability. Test activities shall include technology demonstration and experimentation, standards development and implementation, system interoperability testing, field, pre-deployment and reference system testing.","A harmonised spectrum of test capabilities shall be established and used to verify and validate NATO and national C3 interoperability. "]
["C-M(2015)0041-REV1 ANN6","Federation of Communications Services Policy","S046","7","Federated Networks",null,"The Alliance shall be supported by federated networks, both static and deployed, to execute its business processes, tasks and missions. These networks shall provide the required network capabilities and services to include communications transport services","The Alliance shall be supported by federated networks, both static and deployed, to execute its business processes, tasks and missions, including necessary communications transport services"]
[null,"Federation of Communications Services Policy","S047","8",null,null,"Federated networks shall be established using a set of flexible and tailored nonmaterial and material contributions from NATO Bodies, NATO Nations and, where applicable, non-NATO Nations and International Organisations.","Federated networks shall be established using a set of flexible and tailored nonmaterial and material contributions from NATO Bodies, NATO Nations and, where applicable, non-NATO Nations and International Organisations."]
[null,"Federation of Communications Services Policy","S048","9",null,null,"Federated networks should support the interconnection of network elements to facilitate the extension of NATO or national services to remote NATO or national sites in line with agreed requirements of Allies and NATO. The arrangements to resource and manage any of these extensions is to be agreed on a case-by-case basis between the national and NATO service providers before any implementation.","Federated networks should support the interconnection of network elements to facilitate the extension of NATO or national services to remote NATO or national sites in line with agreed requirements of Allies and NATO."]
[null,"Federation of Communications Services Policy","S049","10",null,null,"The extension of communications transport services from NATO to a Nation or from a Nation to NATO shall at all times be governed through a Service Level Agreement","The extension of communications transport services from NATO to a Nation or from a Nation to NATO shall at all times be governed through a Service Level Agreement"]
[null,"Federation of Communications Services Policy","S050","11",null,null,"A Service Level Agreement to extend NATO services over National Defence Networks shall be based on a formal requirement approved by the NATO Body or committee responsible for the supported NATO Service Customer. The consideration of eligibility and affordability of those services shall be addressed by the resource committees in line with the extant resource policies.","A Service Level Agreement to extend NATO services over National Defence Networks shall be based on a formal requirement approved by the NATO Body or committee responsible for the supported NATO Service Customer. "]
[null,"Federation of Communications Services Policy","S051","12",null,null,"The basic principle for extending communications transport services from NATO to Nations and from Nations to NATO shall be the reciprocity principle. If the level of effort between the service providers is imbalanced, a cost-reimbursement may be considered by either provider. Common-funded financial consequences will at all times be governed by the Resource Committees","The basic principle for extending communications transport services from NATO to Nations and from Nations to NATO shall be the reciprocity principle. If the level of effort between the service providers is imbalanced, a cost-reimbursement may be considered by either provider. "]
[null,"Federation of Communications Services Policy","S052","13","Interconnection Points",null,"The interconnection points between NATO and national networks shall support the information exchange requirements and include mediation and boundary protection functions.","The interconnection points between NATO and national networks shall support the information exchange requirements and include mediation and boundary protection functions.","Interoperability Policy "]
[null,"Federation of Communications Services Policy","S053","14",null,null,"NATO shall provide up to two network interconnection points within each NATO Nation between the NATO and national Secret networks, the second interconnection point being provided for resilience. Subject to agreed operational requirements, additional interconnection points, between NATO and national Secret networks, may be provided. Funding of these additional interconnection points shall be borne by the entity requesting the additional interconnection point","NATO shall provide up to two network interconnection points within each NATO Nation between the NATO and national Secret networks. Funding of additional interconnection points, between NATO and national Secret networks, will be borne by the requesting entity."]
[null,"Federation of Communications Services Policy","S054","15",null,null,"The interconnection points shall be implemented in existing NATO communications sites within the Nation. These NATO communications sites may be existing NATO HQs elements, parts of the NATO Command Structure or Points of Presence. In the absence of NATO HQ elements or of NATO Command Structure entities, the location of the interconnection point shall be decided between the responsible NATO service provider and the concerned Nation.","The interconnection points shall be implemented in existing NATO communications sites within the Nation."]
[null,"Federation of Communications Services Policy","S055","16",null,null,"The interconnection point is a demarcation point for service management and security between the NATO service provider and the external service provider, with each having full responsibility and covering the costs for its side of the connection.","The interconnection point is a demarcation point for service management and security between the NATO service provider and the external service provider, with each having full responsibility and covering the costs for its side of the connection."]
[null,"Federation of Communications Services Policy","S056","17","Service Interoperability Profiles",null,"Federated network service providers will establish Federated Network Instructions for interconnection points between member networks. These instructions shall contain the Service Interoperability Profiles that specify the characteristics of the service interfaces implemented in the interconnection points. These Service Interoperability Profiles shall be based on agreed NATO STANAGs and/or civil, commercial, or national standards and specifications. These Communications profiles shall be included within the NATO Interoperability Standards and Profiles (NISP) and be updated as required.","Federated network service providers will establish Federated Network Instructions for interconnection points between member networks. "]
[null,"Federation of Communications Services Policy","S057","18",null,null,"Service Interoperability Profiles should be considered in the NATO Defence Planning Process’ Common and Individual Targets.","Service Interoperability Profiles should be considered in the NATO Defence Planning Process’ Common and Individual Targets."]
[null,"Federation of Communications Services Policy","S058","19",null,null,"Service Interoperability Profiles shall be supported by Concepts of Employment to facilitate implementation.","Service Interoperability Profiles shall be supported by Concepts of Employment to facilitate implementation"]
[null,"Federation of Communications Services Policy","S059","20",null,null,"Changes to Service Interoperability Profiles with affected service providers will be coordinated through Service Transition Plans","Changes to Service Interoperability Profiles with affected service providers will be coordinated through Service Transition Plans"]
[null,"Federation of Communications Services Policy","S060","21","CIS Security",null,"When a national network is connected to a NATO network, the minimum requirements for CIS Security (including Cyber defence) on the national network shall be implemented in line with PO(2014)0801, Minimum Requirements of CIS Security (Including Cyber Defence) for National CIS Critical for NATO Core Tasks","When a national network is connected to a NATO network, the minimum requirements for CIS Security (including Cyber defence) on the national network shall be implemented in line with PO(2014)0801, Minimum Requirements of CIS Security (Including Cyber Defence) for National CIS Critical for NATO Core Tasks"]
["C-M(2015)0041-REV1 ANN7","NATO Software Policy","S061","5","Acquisition of Software",null,"For the acquisition of Software the strategic principle of Adopt, Buy, Create (ABC) found in Ref. (A) shall be applied. The appropriate acquisition approach shall be determined by a business case covering the entire life-cycle. For adoption of existing software as NATO Software, it shall either become the property of NATO or NATO receives unlimited rights to use and distribute.","The appropriate approach for siftware acquisition shall be determined under the principle of Adopt, Buy, Create (ABC) by a business case covering the entire life-cycle. Adopted Software shall either become the property of NATO or NATO receives unlimited rights to use and distribute.","Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery"]
[null,"NATO Software Policy","S062","6","Use of NATO Software",null,"Allies having participated in the funding of the software shall have the ability to use NATO Software on a no-fee basis, and are authorized to make NATO Software available as a service, in line with NATO security rules, to relevant non-NATO entities for the national purposes of respective NATO Nations, provided control remains with that NATO Nation. However, release of NATO Software to non-NATO entities is subject to separate approval by Allies on a case-by-case basis, details will be regulated in a separate Directive. Software support is subject to separate agreements and funding arrangements","NATO Software should be profide to the funding Allies on a no-fee basis,\nRelease of NATO Software to non-NATO entities is subject to separate approval by Allies on a case-by-case basis.\nSoftware support is subject to separate agreements and funding arrangements"]
[null,"NATO Software Policy","S063","7","Support for mission critical use",null,"In the absence of NATO Security Investment Programme (NSIP) solutions, prototype NATO Software designed for eventual fielding may be used to support urgent operational requirements provided the need to minimize operational risk outweighs the limitations of the software in terms of support or functionality","In the absence of NATO Security Investment Programme (NSIP) solutions, prototype NATO Software designed for eventual fielding may be used to support urgent operational requirements provided the need to minimize operational risk outweighs the limitations of the software in terms of support or functionality"]
[null,"NATO Software Policy","S064","8","Managed software life-cycle",null,"NATO Software shall be developed and maintained, including appropriate funding, through an appropriate formalised life cycle methodology. The governance over NATO Software is executed by Allies. This includes authority of Configuration Control of NATO Software baselines, which may be delegated. Life Cycle Management of each NATO Software product, including design, change and configuration management, shall be the responsibility of a single NATO body. Where there are consequences for interoperability and software compliance with the C3 Taxonomy, architectures and agreed standards, issues shall be escalated to the configuration control authority.","NATO Software shall be developed and maintained through an appropriate formalised life cycle methodology. \nLife Cycle Management of each NATO Software product shall be the responsibility of a single NATO body. ","Life Cycle Management  Policy"]
[null,"NATO Software Policy","S065",9,"Single NATO Software baseline",null,"Asingle baseline for each NATO Software product shall be maintained and is independent of the type of deployment; this includes integration with national systems, distribution in an executable form or provision as a service","A single baseline for each NATO Software product shall be maintained and is independent of the type of deployment; "]
[null,"NATO Software Policy","S066",10,"Managed Requirements",null,"NATO Software shall be developed based on managed requirements, maximising opportunities to consolidate across the Alliance","NATO Software shall be developed based on managed requirements, maximising opportunities to consolidate across the Alliance"]
[null,"NATO Software Policy","S067",11,"Integration of national requirements",null,"NATO Software may address national requirements with appropriate funding arrangements and transfer of property for the results to the Alliance. Integration of national requirements is subject to approval in accordance with NAC approved regulations","NATO Software may address national requirements with appropriate funding arrangements and transfer of property for the results to the Alliance. "]
[null,"NATO Software Policy","S068",12,"Security",null,"NATO Software is subject to security risk assessment. Security mechanisms and controls shall be embedded in the life cycle of NATO Software, including its design, its use and release, being subject to Ref. (B), Ref. (C) and Ref. (D).","NATO Software is subject to security risk assessment throught mechanisms embedded in its life-cycle."]
[null,"NATO Software Policy","S069",13,"Proprietary Solutions",null,"NATO Software design shall seek to minimise ‘lock-in’ to proprietary solutions. If appropriate, Open Source Software shall be adopted, provided adequate lifecycle support is available.","NATO Software design shall seek to minimise ‘lock-in’ to proprietary solutions. \nIf appropriate, Open Source Software shall be adopted, provided adequate lifecycle support is available."]
[null,"NATO Software Policy","S070",14,"Evolutionary development",null,"NATO Software shall be developed in an evolutionary and incremental way in order to: Deliver in a timely and cost effective manner, manage risk, respond to changing requirements and leverage technological possibilities","NATO Software shall be developed in an evolutionary and incremental way "]
[null,"NATO Software Policy","S071",15,"Adaptability",null,"NATO Software shall be designed to be configurable for deployment in different missions, exercises and training environments. NATO Software shall also be designed in a modular fashion with reusable software components. Awareness of such re-usable components shall be promoted","NATO Software shall be designed to be configurable for deployment in different missions, exercises and training environments. NATO Software shall also be designed in a modular fashion with reusable software components. "]
[null,"NATO Software Policy","S072",16,"Re-use",null,"The acquisition of NATO Software shall optimise the re-use of software products and components","The acquisition of NATO Software shall optimise the re-use of software products and components"]
["C-M(2015)0041-REV1 ANN8","Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery","S073","9","Investigation of Alternatives.",null,"Alternatives shall be investigated to include: use of existing Services, adoption of NATO solutions, adoption of National solutions, purchasing of COTS, outsourcing, creating new capabilities or any combination of the above. Recognizing that not all situations will be the same, there is no prescribed order in the preference of options considered","Alternatives shall be investigated to include: use of existing Services, adoption of NATO solutions, adoption of National solutions, purchasing of COTS, outsourcing, creating new capabilities or any combination of the above (not listed in order of  preference)"]
[null,"Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery","S074","10","Shaping of Requirements to Fit Existing Solutions",null,"Requirement shall be shaped to fit existing solutions where possible or a trade-off shall be proposed between meeting 100% of the original requirements and the advantages of reducing risk and decreasing time to implementation and operation","Requirement shall be shaped to fit existing solutions where possible or a trade-off shall be proposed between meeting 100% of the original requirements and the advantages of reducing risk and decreasing time to implementation and operation"]
[null,"Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery","S075","11","Business Case Recommendations.",null,"A business case shall be developed, to be included in the Type B Cost Estimate (TBCE) that outlines the potential alternative approaches (adopt, buy, create or some combination) and makes a recommendation to the governing body on the implementation.","A business case shall be developed, to be included in the Type B Cost Estimate (TBCE) that outlines the potential alternative approaches (adopt, buy, create or some combination) and makes a recommendation to the governing body on the implementation."]
[null,"Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery","S076","12","Testing and Accreditation",null,"The chosen alternative must have been tested and\naccredited or have a clear path to being tested and accredited by NATO","The chosen alternative must have been tested and\naccredited or have a clear path to being tested and accredited by NATO","Interoperability Policy (V&V)"]
[null,"Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery","S077","13","Modular Design",null,"If the create option is necessary the solution shall be built in a modular fashion to allow complete or partial reuse by other NATO Enterprise organizations\nand Nations","If the create option is necessary the solution shall be built in a modular fashion to allow complete or partial reuse by other NATO Enterprise organizations and Nations","Software Policy"]
[null,"Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery","S078","14","Termination of Obsolete Technology",null,"To avoid inextricably linking financial resources to an approved investment, where scant progress is made in the face of an aging requirement, early termination of a procurement initiative shall be considered. \nConsiderations shall also be made on optimizing the time for introducing new technology to\nsucceed aging technology in a Life Cycle Cost-perspective.","To avoid inextricably linking financial resources to an approved investment, where scant progress is made in the face of an aging requirement, early termination of a procurement initiative shall be considered. \nConsiderations shall also be made on optimizing the time for introducing new technology to succeed aging technology in a Life Cycle Cost-perspective."]
["C-M(2015)0041-REV1 ANN9","Nato Enterprise Architecture Policy","S079","6","Architecture support for strategy definition",null,"NATO Enterprise entities shall use enterprise architectures to support the definition of business and ICT strategies, and to assess the complexity, feasibility, cost and dependencies of strategic change initiatives.","NATO Enterprise entities shall use enterprise architectures to support the definition of business and ICT strategies, and to assess the complexity, feasibility, cost and dependencies of strategic change initiatives."]
[null,"Nato Enterprise Architecture Policy","S080","7","Architecture support for strategy execution",null,"NATO Enterprise entities shall use enterprise architectures to support the execution of business and ICT strategies. To this end, enterprise architectures shall be embedded into relevant processes such as resource planning, programme / project management requirements management or acquisition and procurement.","NATO Enterprise entities shall use enterprise architectures, embedded in relevant processes,  to support the execution of business and ICT strategies. "]
[null,"Nato Enterprise Architecture Policy","S081","8","Requirements-based change",null,"NATO Enterprise entities shall use enterprise\narchitectures to ensure that changes to applications and technology are solely made in\nresponse to business needs. Changes will only be made following examination of the\nproposed change against the enterprise architectures. Solution requirements described by\narchitectural products shall maintain traceability with operational requirements","NATO Enterprise entities shall use enterprise architectures to ensure that changes to applications and technology are solely made in response to business needs."]
[null,"Nato Enterprise Architecture Policy","S082","9","Standardized architecture deliverables",null,"NATO Enterprise entities shall develop architectures using standardized deliverables to increase understandability. The deliverables shall, wherever possible, be developed using the content meta model and views described in the NATO Architecture Framework (NAF).","NATO Enterprise entities shall develop architectures using standardized deliverables to increase understandability. The deliverables shall, wherever possible, be developed using the content meta model and views described in the NATO Architecture Framework (NAF)."]
[null,"Nato Enterprise Architecture Policy","S083","10","Re-use, and traceability, of architecture content",null,"In order to define and implement C3 capabilities and ICT services in an effective, efficient and consistent manner across the NATO Enterprise, architecture deliverables of lower level architectures shall reuse the content of, or shall be traceable to, deliverables of higher level architectures. This implies that, e.g. architecture content at the capability level shall be traceable to content on the enterprise level (e.g. the C3 Taxonomy, the NATO Interoperability Standards and Profiles or the C3 Integrated Master Plan).","In order to define and implement C3 capabilities and ICT services in an effective, efficient and consistent manner across the NATO Enterprise, architecture deliverables of lower level architectures shall reuse the content of, or shall be traceable to, deliverables of higher level architectures. "]
[null,"Nato Enterprise Architecture Policy","S084","11","Standardized architecture process.",null,"NATO Enterprise entities shall develop and use architectures following a standardized process to increase collaboration and understanding between different entities. The process shall be based on the Architecture Development Method described in The Open Group Architecture Framework (TOGAF)","NATO Enterprise entities shall develop and use architectures following a standardized process to increase collaboration and understanding between different entities. The process shall be based on the Architecture Development Method described in The Open Group Architecture Framework (TOGAF)"]
[null,"Nato Enterprise Architecture Policy","S085","12","Sharing of NATO Enterprise Architecture Information",null,"NATO Enterprise Architecture Information, describing artefacts at the appropriate level (e.g. capability level,cfr. paragraph 16), shall be accessible to interested parties by means of a shared solution to facilitate the understanding of the interrelationship between artefacts at the same\narchitecture level and across levels.","NATO Enterprise Architecture Information, describing artefacts at the appropriate level shall be accessible to interested parties by means of a shared solution "]
[null,"Nato Enterprise Architecture Policy","S086","13","Architecture as a Service",null,"Architecture as a service shall to be supported by a comprehensive Service design for the definition of operational services to link ICT services with operational services.","Architecture as a service shall to be supported by a comprehensive Service design for the definition of operational services"]
[null,"Nato Enterprise Architecture Policy","S087","14-17","Architecture Levels And Types",null,"In order to manage the complexity of the NATO Enterprise, NATO maintains architectures at  NATO Enterprise, Capability and project levels","In order to manage the complexity of the NATO Enterprise, NATO maintains architectures at  NATO Enterprise, Capability and project levels"]
[null,"Nato Enterprise Architecture Policy","S088","18","Architecture scope",null,"Architectures on each level shall cover the Business, Information, Application and Technology architecture domains/types","Architectures on each level shall cover the Business, Information, Application and Technology architecture domains/types"]
["C-M(2015)0041-REV1 ANN10","NATO Cloud Computing Policy","S089","8","Service Models.",null,"NATO Enterprise shall follow a cloud computing approach incorporating ICT Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) models","NATO Enterprise shall follow a cloud computing approach incorporating ICT Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) models"]
[null,"NATO Cloud Computing Policy","S090","9","ICT Infrastructure",null,"The goal is one ICT infrastructure supporting the entire NATO Enterprise for all information domains and all levels of security up to and including NATO SECRET. This will maximise seamless information sharing and pooling of computing resource across the NATO Enterprise","The goal is one ICT infrastructure supporting the entire NATO Enterprise for all information domains and all levels of security up to and including NATO SECRET. "]
[null,"NATO Cloud Computing Policy","S091","10","ICT Infrastructure Partitions",null,"The NATO Enterprise cloud shall allow the creation of Community of Interest (COI) segments via logical/virtual partitioning. The use of such COI segments will need to be justified.","The NATO Enterprise cloud shall allow the creation of justified Community of Interest (COI) segments via logical/virtual partitioning. "]
[null,"NATO Cloud Computing Policy","S092","11","Deployment4 Model",null,"A NATO Enterprise ICT infrastructure, handling NATO CONFIDENTIAL and above information, shall use a private cloud deployment model that is owned by NATO or by an Allied Nation. For the infrastructure handling information classified NATO RESTRICTED and below, community, hybrid or public deployment models may be considered once all information assurance and data sovereignty considerations are satisfied. The determination of appropriate service and deployment models for all business functions or operational requirements shall take account of operational constraints, effectiveness of ICT services, and cost efficiency","A NATO Enterprise ICT infrastructure, handling NATO CONFIDENTIAL and above information, shall use a private cloud deployment model that is owned by NATO or by an Allied Nation. For the infrastructure handling information classified NATO RESTRICTED and below, community, hybrid or public deployment models may be considered once all information assurance and data sovereignty considerations are satisfied. The determination of appropriate service and deployment models for all business functions or operational requirements shall take account of operational constraints, effectiveness of ICT services, and cost efficiency"]
[null,"NATO Cloud Computing Policy","S093","12","Cloud Security",null,"NATO cloud services shall comply with the NATO security policies and directives for CIS","NATO cloud services shall comply with the NATO security policies and directives for CIS"]
[null,"NATO Cloud Computing Policy","S094","13","Data Protection and Sovereignty",null,"Alliance data protection in a cloud shall ensure the ability to control the access, alteration, archiving and deletion of digital information. This control may be limited by different aspects like laws of the country in which the data is stored or policies of the service providers involved. ","Alliance data protection in a cloud shall ensure the ability to control the access, alteration, archiving and deletion of digital information. This control may be limited by different aspects like laws of the country in which the data is stored or policies of the service providers involved. "]
[null,"NATO Cloud Computing Policy","S095","14","Cloud-First.",null,"All future ICT solutions within the NATO Enterprise should use the NATO Enterprise’s cloud infrastructure rather than deploying distinct additional infrastructures","All future ICT solutions within the NATO Enterprise should use the NATO Enterprise’s cloud infrastructure rather than deploying distinct additional infrastructures"]
[null,"NATO Cloud Computing Policy","S096","15","Cloud Services Request",null,"All requests for cloud services by NATO entities must be addressed to the service provider.","All requests for cloud services by NATO entities must be addressed to the service provider."]
[null,"NATO Cloud Computing Policy","S097","16","Re-Use",null,"When considering the re-use of ICT solutions, care must be taken to ensure the re-used capability can be re-hosted in the cloud computing environment","When considering the re-use of ICT solutions, care must be taken to ensure the re-used capability can be re-hosted in the cloud computing environment","Policy on the Efficient Implementation of C3 Capabilities and ICT Services Delivery"]
[null,"NATO Cloud Computing Policy","S098","17","Legacy Migration",null,"Legacy ICT solutions will be migrated to the cloud computing environment only after careful analysis to ensure there is a reasonable business case","Legacy ICT solutions will be migrated to the cloud computing environment only after careful analysis to ensure there is a reasonable business case"]
[null,"NATO Cloud Computing Policy","S099","18.1","Cloud Business Model.",null,"ICT solutions will be designed with the expectation that the infrastructure has already been designed and will be provisioned, when needed.","ICT solutions will be designed with the expectation that the infrastructure has already been designed and will be provisioned, when needed."]
[null,"NATO Cloud Computing Policy","S100","18.2",null,null,"ICT solutions will be hosted on infrastructure owned, operated and maintained by the Cloud Service Provider","ICT solutions will be hosted on infrastructure owned, operated and maintained by the Cloud Service Provider"]
[null,"NATO Cloud Computing Policy","S101","18.3",null,null,"Service providers will be responsible for acquiring, running and maintaining the cloud infrastructure in accordance with the outline at Figure 1.","Service providers will be responsible for acquiring, running and maintaining the cloud infrastructure in accordance with the outline at Figure 1."]
[null,"NATO Cloud Computing Policy","S102","19","Application development",null,"Application development shall use a shared cloud infrastructure and shall access that infrastructure through a service interface. The Service Provider shall provide a robust application development environment to allow for smooth transition between development,\ntest and production environments","Application development shall use a shared cloud infrastructure and shall access that infrastructure through a service interface. The Service Provider shall provide a robust application development environment to allow for smooth transition between development, test and production environments"]
["C-M(2007)0118","NATO Information Management Policy","S103","5","Information as Corporate Resource",null," Information is a corporate resource and shall be managed as such to support NATO’s missions, consultation, decision making processes, and operational requirements by organising and controlling information throughout its life-cycle regardless of the medium and format in which the information is held.","Information is a corporate resource and shall be managed as such to support NATO’s missions, consultation, decision making processes, and operational requirements by organising and controlling information throughout its life-cycle regardless of the medium and format in which the information is held."]
[null,"NATO Information Management Policy","S104","6","Ownership and ustiodianship",null,"Information shall have an originator, and clearly defined ownership and custodianship assigned throughout its life-cycle.","Information shall have an originator, and clearly defined ownership and custodianship assigned throughout its life-cycle."]
[null,"NATO Information Management Policy","S105","7","Leadership ",null,"Management of information is a fundamental responsibility, which shall require executive leadership, top-level involvement and the creation and maintenance of an effective organizational structure.","Management of information is a fundamental responsibility, which shall require executive leadership, top-level involvement and the creation and maintenance of an effective organizational structure."]
[null,"NATO Information Management Policy","S106","8","Information Sharing.",null," Information shall be managed with an emphasis on the ‘responsibility-to-share’ balanced by the security principle of ‘need-to-know’, and managed to facilitate access, optimise information sharing and re-use, and reduce duplication, all in accordance with security, legal and privacy obligations.","Information shall be managed with an emphasis on the ‘responsibility-to-share’ balanced by the security principle of ‘need-to-know’, and managed to facilitate access, optimise information sharing and re-use, and reduce duplication, all in accordance with security, legal and privacy obligations."]
[null,"NATO Information Management Policy","S107","9","Standardisation",null,"Information shall have standardised structures and consistent representations to enable interoperability, cooperation and more effective and efficient processes.","Information shall have standardised structures and consistent representations"]
[null,"NATO Information Management Policy","S108","10","Information Assurance. ",null,"Information shall be protected by applying the principle of Information Assurance, which is described as the set of measures to achieve a given level of confidence in the protection of communication, information and other electronic systems, non-electronic systems, and the information that is stored, processed or transmitted in these systems with respect to confidentiality, integrity, availability, non-repudiation and authentication.","Information shall be protected by applying the principle of Information Assurance"]
[null,"NATO Information Management Policy","S109","11","Information Needs. ",null,"Information needs shall be determined as part of the planning and architecture processes to meet intended activities and effects.","Information needs shall be determined as part of the planning and architecture processes [2] to meet intended activities and effects."]
["C-M(2002)60","The Management od non-classified information","S110","5",null,null,"All NATO information requires protection to ensure its integrity and availability.Even for NATO information which is deemed to be releasable to the public (e.g. a NATO press release or NATO information posted on the Internet) changes to its content (loss of integrity) or denial of legitimate access (loss of availability) could result in damage to NATO interests.","All NATO information requires protection to ensure its integrity and availability. "]
[null,"The Management od non-classified information","S111","6",null,null,"The marking NATO UNCLASSIFIED and any administrative or dissemination limitation markings as defined in paragraphs 9 and 10, determines handling and protection requirements to restrict access. All markings are applied by the originator and may only be modified by the originator in consultation, where appropriate, with the individual to whom they refer","The marking NATO UNCLASSIFIED and any administrative or dissemination limitation markings as defined in paragraphs 9 and 10, determines handling and protection requirements to restrict access. All markings are applied by the originator and may only be modified by the originator in consultation, where appropriate, with the individual to whom they refer"]
[null,"The Management od non-classified information","S112","7",null,null,"NATO information marked NATO UNCLASSIFIED is to be used only for official purposes. Only individuals, bodies or organisations that require it for official NATO purposes may have access to it.","NATO information marked NATO UNCLASSIFIED is to be used only for official purposes. "]
[null,"The Management od non-classified information","S113","8",null,null,"NATO information marked NATO UNCLASSIFIED is subject to release procedures (paragraphs 11 to 15 refer).","NATO information marked NATO UNCLASSIFIED is subject to release procedures (paragraphs 11 to 15 refer)."]

{"sheet":"PivotPie","index":1,"n_rows":2,"n_cols":5,"rows_kept":2,"cut":false,"hidden":true,"merged":[]}
["Sum of Full","Sum of Large","Sum of Partial","Sum of None","Sum of TBA"]
[45,24,15,8,0]

{"sheet":"PivotStacked","index":2,"n_rows":41,"n_cols":5,"rows_kept":41,"cut":false,"hidden":true,"merged":[]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["Row Labels","Sum of Full","Sum of Large","Sum of Partial","Sum of None"]
["20 NEW- Principles of Responsible Use of AI ",6,0,0,0]
["19 NEW - Identity, Credential and Access Management \nPolicy",0,13,0,0]
["18 NEW - Requirements Engineering Policy",18,0,0,0]
["17 Zero Trust  Policy",6,0,0,0]
["16 Modeling and Simulation Policy",11,0,0,0]
["15 - The Management of non-classified information",0,0,0,4]
["14 - NATO Information Management Policy",7,0,0,0]
["13 - Data Management Policy",0,0,14,0]
["12 - Internet Protocol Version 6 (IPv6)  Policy",10,0,0,0]
["11 - Green IT Policy ",0,0,17,0]
["10 - REVISED - Cloud and Edge Computing Policy",0,0,17,0]
["09 - REVISED- Enterprise Architecture Policy",7,0,0,0]
["08 - C3 Capabilities Implementation Policy ",0,0,0,6]
["07  - Software Policy ",0,15,0,0]
["06 - Federation of Communications Services Policy",0,0,15,0]
["05 - C3 Interoperability Policy",15,0,0,0]
["04 - Waveform Policy",0,0,17,0]
["03 - C3 Capabilities and ICT Services Lifecycle Management Policy",6,0,0,0]
["02  - ICT Service Management Policy",0,13,0,0]
["Grand Total",86,41,80,10]

{"sheet":"Checklist","index":3,"n_rows":219,"n_cols":13,"rows_kept":219,"cut":false,"hidden":false,"merged":[[1,0,13,0],[139,0,152,0],[129,0,138,0],[175,0,180,0],[164,0,174,0],[112,0,128,0],[153,0,159,0],[160,0,163,0],[67,0,81,0],[82,0,87,0],[88,0,94,0],[95,0,105,0],[14,0,19,0],[20,0,36,0],[37,0,51,0],[52,0,66,0],[182,0,186,0],[199,0,211,0],[212,0,217,0],[187,0,198,0]]}
["DSP","Policy ","Serial","§","Principle Definition","Degree of compliance","N/A","Full","Large","Partial","None","TBA","Remarks"]
["Revised - AC/322-D(2023)0048 (INV)","02  - ICT Service Management Policy","S001","7 ","Capabilities Delivered Through Services. All NATO apportioned ICT capabilities shall be defined and provided as services and managed in accordance with this policy.","Large",{"$f":"IF($F2=\"N/A\",1,0)","v":0},{"$f":"IF($F2=\"Full\",1,0)","v":0},{"$f":"IF($F2=\"Large\",1,0)","v":1},{"$f":"IF($F2=\"Partial\",1,0)","v":0},{"$f":"IF($F2=\"None\",1,0)","v":0},{"$f":"IF($F2=\"TBA\",1,0)","v":0}]
[null,"02  - ICT Service Management Policy","S002","8","Governance. Service Management shall take input in the form of direction, monitoring and control from NATO governance bodies, including senior policy committees, supervisory boards, and programme steering committees.","Large",{"$f":"IF($F3=\"N/A\",1,0)","v":0},{"$f":"IF($F3=\"Full\",1,0)","v":0},{"$f":"IF($F3=\"Large\",1,0)","v":1},{"$f":"IF($F3=\"Partial\",1,0)","v":0},{"$f":"IF($F3=\"None\",1,0)","v":0},{"$f":"IF($F3=\"TBA\",1,0)","v":0}]
[null,"02  - ICT Service Management Policy","S003","9","Adoption of best practice frameworks. In order to achieve a service-based ICT environment, NATO shall adopt service management frameworks such as eTOM (enhanced Telecom Operations Map) and ITIL (Information Technology Infrastructure Library) complemented by other industry best practices. The individual service lifecycle processes shall be aligned with the specific operational requirements of NATO.","Large",0,0,1,{"$f":"IF($F4=\"Partial\",1,0)","v":0},0,0,"Ver. 2.1"]
[null,"02  - ICT Service Management Policy","S004","10","Roles. Service Management in NATO shall be based on clearly defined, harmonised and standardised roles, processes and functions. Organizational elements shall be categorised as Service Providers, Service Customers and Vendors’ Managers. All individuals within NATO bodies are categorised as Service Users.","Large",0,0,1,{"$f":"IF($F5=\"Partial\",1,0)","v":0},0,0,"Ver. 2.1"]
[null,"02  - ICT Service Management Policy","S005","11","Coordination of Requirements and Planning. Service requirements shall be coordinated amongst the Service Customers and approved by relevant governance bodies to meet operational and business needs and aligned with financial, managerial and policy frameworks, prior to being addressed to the Service Provider. Coordination shall be undertaken to prioritize service provision via periodic, collective planning organised around the major Communities of Interest enabling functions. In both NATO Enterprise and federation contexts services should be identified against targets for incorporation in a service pipeline.","Large",0,0,1,{"$f":"IF($F6=\"Partial\",1,0)","v":0},0,0,"Ver. 2.1"]
[null,"02  - ICT Service Management Policy","S006","12","Service Catalogues and Portfolio. Service Providers shall plan their services through a coherent Enterprise Service Portfolio and offer them through one or more Service Catalogues.","Large",0,0,1,0,0,0,"Ver. 2.1"]
[null,"02  - ICT Service Management Policy","S007","13","Need for Agreements and Contracts. The provision of services must be efficient, effective and measurable. Prior to commencement of any service delivery, Service Providers and Service Customers shall establish between them an agreed contract for all services to be provided, supported by Service Level Agreements (SLA), Memoranda of Agreement/Understanding, and appropriate metrics, such as Service Level Targets and Key Performance Indicators.","Large",{"$f":"IF($F8=\"N/A\",1,0)","v":0},0,1,0,0,0,"Ver. 2.1"]
[null,"02  - ICT Service Management Policy","S008","14","Risk related to Obsolescence. In the case of externally managed services, the risk related to obsolescence management and sustainment of the underlying service-enabling capabilities is effectively transferred to the external service provider (i.e. commercial vendors and/or an Allied nation), through the SLA. However, NATO retains the responsibility to monitor the external services’ provision throughout their lifecycle, including their adherence to agreed levels of availability and reliability, which effectively serve as indicators of managing obsolescence risk. In the case of internally managed services, NATO has the responsibility to manage the risk related to obsolescence.\n\n","Large",0,0,1,0,0,0,"Ver. 2.1"]
[null,"02  - ICT Service Management Policy","S009","15","Costs. All provided services must be costed. This includes all costs associated with the Service Lifecycle as well as the risks accepted by the Service Provider and covered under warranty.","Large",0,0,1,0,0,0]
[null,"02  - ICT Service Management Policy","S010","16","Interoperability and Standardisation. The Alliance relies on federations of Networking and Information Infrastructures—both static and deployed—supported by multiple service providers to enable consultation and decision making processes and for the conduct of NATO’s missions6. Federated Allies and NATO Enterprise entities shall operate Service Management and Control (SMC) capabilities and services in accordance with NATO-agreed standards. The NATO Enterprise shall provide Service Management Authorities for those federations.\n\n","Large",0,0,1,0,0,0,"Ver. 2.1"]
[null,"02  - ICT Service Management Policy","S011","17","Multiple Service Providers. The provision of a service to a Service Customer may involve multiple Service Providers. Standardisation and reutilisation of existing services shall increase interoperability between services from different sources.","Large",0,0,1,0,0,0]
[null,"02  - ICT Service Management Policy","S012","18","Service Monitoring and Improvement. To ensure service quality and interoperability, Service Management shall identify and provide suitable management tools, metrics and measurement methods to report and assess the level of service requested and provided. The distributed, interconnected set of organisational relationships within the NATO Enterprise and through interface points to Nations mean operations dependent upon federated services from several sources are particularly vulnerable to manipulation, degradation or loss of infrastructure. Feedback shall be provided from the Service User and the Vendor Manager to the Service Customer, the Service Provider and appropriate regulatory bodies for assessment and service improvement.","Large",{"$f":" IF($F13=\"N/A\",1,0)","v":0},0,1,0,0,0,"Ver. 2.1"]
[null,"02  - ICT Service Management Policy","S013","19","Service Integration. When multiple providers offer interdependent services, Service integration refers to the necessary functions to ascertain end-to-end delivery across the portfolio of Services in accordance with the business needs. It can be performed by the NCI Agency, an external service integrator or through collaboration between the two (hybrid structure).","Large",{"$f":" IF($F14=\"N/A\",1,0)","v":0},0,1,0,0,0,"Ver. 2.1"]
["Revised - AC/322-D(2019)0046 (INV)","03 - C3 Capabilities and ICT Services Lifecycle Management Policy","S001","10","The lifecycle should be aligned with the Information Technology Infrastructure Library (ITIL) lifecycle phases and processes.","Full",0,1,0,0,0,0]
[null,"03 - C3 Capabilities and ICT Services Lifecycle Management Policy","S002","11","The coherence and traceability of requirements and resources across the lifecycle shall be enabled through use of the the NATO C3 Taxonomy, a Customer Catalogues for C3 Capabilities and ICT Services","Full",0,1,0,0,0,0]
[null,"03 - C3 Capabilities and ICT Services Lifecycle Management Policy","S003","11.2"," All NATO C3 Capabilities and ICT Services offered in Customer Catalogues shall be traceable by (to) the NATO C3 Taxonomy and to the NDPP collective requirements ","Full",0,1,0,0,0,0]
[null,"03 - C3 Capabilities and ICT Services Lifecycle Management Policy","S004","11.3","For each service in the C3 Taxonomy the NATO Enterprise organisation(s) assigned as Service Provider shall be identified","Full",0,1,0,0,0,0]
[null,"03 - C3 Capabilities and ICT Services Lifecycle Management Policy","S005","13","NATO Enterprise organisations shall use the C3 Taxonomy, the Strategic Capability Development Plan (SDCP) and Customer Catalogues to integrate and satisfy short, mid and long term C3 requirements for translation into ICT Services in a coherent way.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"03 - C3 Capabilities and ICT Services Lifecycle Management Policy","S006","14","NATO Enterprise organisations shall maximise reuse of existing solutions, using proven off-the-shelf solutions, and only developing NATO-unique solutions where no affordable alternative exists, according to Adopt, Buy or Create (ABC) principle.","Full",0,1,0,0,0,0]
["C-M(2015) 0041-REV2 ANNEX 4","04 - Waveform Policy","S001",4.0999999999999996,"The number of Alliance-adopted waveform standards as well as modifications to Alliance-adopted waveform standards should be kept to a minimum ","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S002",4.2,"The introduction of new Alliance-adopted waveform standards shall be based on agreed operational requirements or offer an opportunity for significant enhancement to existing Alliance operational capability","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S003",4.3,"New Alliance-adopted waveform specifications shall be free of any charge for use for NATO and NATO Nations","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S004",4.4000000000000004,"Alliance-adopted waveform specifications shall be divided into mandatory, which define the minimum interoperability solution,  and optional functions","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S005",4.5,"Alliance-adopted waveform specifications shall not prevent the implementation of national encryption","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S006",4.5999999999999996,"Alliance-adopted waveforms shall be supported by a complete waveform specification, and shall be supported in due course by waveform functional reference software and waveform interoperability reference software","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S007",4.7,"Alliance-adopted waveform functional reference software and waveform interoperability reference software shall be provided free of charge and freely distributable to and within NATO Nations under agreed conditions","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S008",4.8,"The waveform functional reference software should be used to provide example instantiations of the Alliance-adopted waveforms and should support further waveform definition work","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S009",4.9000000000000004,"The waveform interoperability reference software should be used by NATO and NATO Nations to support waveform interoperability testing and further waveform definition work","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S010","4.10","Additional versions of the waveform functional and interoperability reference software with IPR are acceptable","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S011","4.11","Alliance-adopted waveform software, except for target waveform software, shall not rely on platform specific signal processing functions or OS specific real time mechanisms. ","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S012","4.12","Alliance-adopted waveform software should be based on open software standards, whenever possible, using the Software Communications Architecture (SCA) ","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S013","4.13","NATO Nations and industry developing prototype waveform software are encouraged to offer these, with the necessary terms and conditions, for use as Alliance waveform reference software (functional and interoperability).","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S014","4.14","Nations and industry implementing NATO waveforms in base or target waveform software are encouraged to offer these, with the necessary terms and conditions, for use in waveform definition and interoperability testing processes","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S015","4.15","Nations are encouraged to notify the C3B, through the NHQC3S of national development of waveform software (typically prototype, base or target) subject to serve as Alliance software references. Nations and industry developing base and/or target waveform software should offer these to NATO Nations under agreed predefined conditions. NATO shall create a registry of waveform artefacts consisting of links to current NATO Nation waveform libraries.","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S016","4.16","NATO shall endeavor to obtain a base waveform implementation to act as a basis for interoperable implementation, and as a basis for interoperability testing that does not bias interoperability testing towards any specific commercial implementation.","Partial",0,0,0,1,0,0]
[null,"04 - Waveform Policy","S017","4.17","IPR may be attached to the endorsed base waveform applications, which shall be evaluated for recognition as licensed under Fair, Reasonable, and Non-discriminatory (FRAND) terms by the community of users in the early steps of the endorsement procedure.","Partial",0,0,0,1,0,0]
["C-M(2015) 0041-REV2 ANNEX 5","05 - C3 Interoperability Policy","S001","7","NATO C3 Interoperability Requirements (C3 IOR) shall be expressed in terms of the required sharing of information and ICT services and shall be identified and consolidated by the NATO Military Authorities (NMA) and Staffs within NATO capability requirement statements for execution by NATO and Nations","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S002","8","Architecture products shall serve to inform, guide and document interoperability of C3 Capabilities and ICT Services in their lifecycle.","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S003","9","Standards and profiles shall be included within the NATO Interoperability Standards and Profiles (NISP).","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S004","10","The service interface profiles associated with the C3 Capabilities and ICT Services they develop and provide shall be  published in the NISP.\nThey have to be made available  to other NATO Enterprise entities and NATO Nations.","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S005","11","NATO architectures shall utilise the agreed standards (STANAGs) and profiles from the NISP as appropriate ","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S006","12","Appropriate interoperability solutions and procedures to match C3 IOR over time shall be identified/developed and documented by the implementer and coordinated with the C3 Board as appropriate.","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S007","13","NATO Enterprise entities shall implement and adopt the appropriate interoperability solutions and procedures to meet agreed C3 IOR. This will involve the achievement of semantic as well as syntactic, empirical and physical interoperability.","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S008","14","Agreed standards are applied in federated service development environments to ensure interoperability","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S009","15","Service specifications shall define the detailed design characteristics of Core and COI (Community of Interest) services and shall include Service Interface Profiles (SIPs).","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S010","16","Interoperability of solutions to C3 IOR shall be verified and validated, in a cost-effective manner, by testing regularly during the life cycle","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S011","17","Testing of the interfaces of C3 Capabilities and ICT Services shall be conducted, including testing against the agreed standards and profiles that are contained within the NISP. ","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S012","18","C3 Capabilities and ICT Services shall have their interfaces pass NATO level C3 Interoperability tests; this testing shall be between NATO, NATO Nations and Partners Nations C3 Capabilities and ICT Services interfaces, based on the NATO agreed standards and profiles that are contained within the NISP","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S013","19","The status of interoperability testing of STANAGs is valuable information that must be recorded. To the extent possible, this information shall be included in the NISP.","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S014","20","A harmonised spectrum of test capabilities shall be established and used to verify and validate NATO and national C3 interoperability. ","Full",0,1,0,0,0,0]
[null,"05 - C3 Interoperability Policy","S015","21","Service Interface Profiles and service interfaces shall be made available for verification and validation testing to NATO Enterprise entities and Nations","Full",0,1,0,0,0,0]
["C-M(2015) 0041-REV2 ANNEX 6","06 - Federation of Communications Services Policy","S001","7","The Alliance shall be supported by federated networks, both static and deployed, to execute its business processes, tasks and missions, including necessary communications transport services","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S002","8","Federated networks shall be established using a set of flexible and tailored nonmaterial and material contributions from NATO Bodies, NATO Nations and, where applicable, non-NATO Nations and International Organisations.","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S003","9","Federated networks should support the interconnection of network elements to facilitate the extension of NATO or national services to remote NATO or national sites in line with agreed requirements of Allies and NATO.","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S004","10","The extension of communications transport services from NATO to a Nation or from a Nation to NATO shall at all times be governed through a Service Level Agreement","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S005","11","A Service Level Agreement to extend NATO services over National Defence Networks shall be based on a formal requirement approved by the NATO Body or committee responsible for the supported NATO Service Customer. ","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S006","12","The basic principle for extending communications transport services from NATO to Nations and from Nations to NATO shall be the reciprocity principle. If the level of effort between the service providers is imbalanced, a cost-reimbursement may be considered by either provider. ","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S007","13","The interconnection points between NATO and national networks shall support the information exchange requirements and include mediation and boundary protection functions.","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S008","14","NATO shall provide up to two network interconnection points within each NATO Nation between the NATO and national Secret networks. Funding of additional interconnection points, between NATO and national Secret networks, will be borne by the requesting entity.","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S009","15","The interconnection points shall be implemented in existing NATO communications sites within the Nation.","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S010","16","The interconnection point is a demarcation point for service management and security between the NATO service provider and the external service provider, with each having full responsibility and covering the costs for its side of the connection.","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S011","17","Federated network service providers will establish Federated Network Instructions for interconnection points between member networks. ","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S012","18","Service Interoperability Profiles should be considered in the NATO Defence Planning Process’ Common and Individual Targets.","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S013","19","Service Interoperability Profiles shall be supported by Concepts of Employment to facilitate implementation","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S014","20","Changes to Service Interoperability Profiles with affected service providers will be coordinated through Service Transition Plans","Partial",0,0,0,1,0,0]
[null,"06 - Federation of Communications Services Policy","S015","21","When a national network is connected to a NATO network, the minimum requirements for CIS Security (including Cyber defence) on the national network shall be implemented in line with PO(2014)0801, Minimum Requirements of CIS Security (Including Cyber Defence) for National CIS Critical for NATO Core Tasks","Partial",0,0,0,1,0,0]
["Revised - AC/322-D(2020)0007-REV1","07  - Software Policy ","S001","5","The appropriate approach for software acquisition shall be determined under the principle of Adopt, Buy, Create (ABC) by a business case covering the entire life-cycle. Adopted Software shall either become the property of NATO or NATO receives unlimited rights to use and distribute.","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S002","6","NATO Enterprise entities and Allies having participated in the funding of the software shall have the ability to use NATO Software on a no-fee basis, and are authorized to make NATO Software available as a service (SaaS), to relevant non-NATO entities, in-line with NATO policies for classified and nonclassified information. Provisioning of NATO SaaS to relevant non-NATO entities may either be in support of NATO’s missions or for national purposes of respective NATO Nations, provided that control remains with that NATO Nation or the NATO Enterprise. Software support is subject to separate agreements and funding arrangements. The provisioning of NATO Software does not automatically entitle the receiving entity to provide NATO Software, in source code or executable form, to third parties or to receive support on that NATO Software from NATO entities.","Large",0,0,1,0,0,0,"Ver. 2.1"]
[null,"07  - Software Policy ","S003","7","In the absence of NATO Security Investment Programme (NSIP) solutions, prototype NATO Software designed for eventual fielding may be used to support urgent operational requirements provided the need to minimize operational risk outweighs the limitations of the software in terms of support or functionality","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S004","8","NATO Software shall be developed and maintained through an appropriate formalised life cycle methodology. \nLife Cycle Management of each NATO Software product shall be the responsibility of a single NATO body. ","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S005",9,"A single baseline for each NATO Software product shall be maintained and is independent of the type of deployment;","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S006",10,"NATO Software shall be developed based on managed requirements, maximising opportunities to consolidate across the Alliance","Large",{"$f":"IF($F73=\"N/A\",1,0)","v":0},{"$f":"IF($F73=\"Full\",1,0)","v":0},{"$f":"IF($F73=\"Large\",1,0)","v":1},{"$f":"IF($F73=\"Partial\",1,0)","v":0},{"$f":"IF($F73=\"None\",1,0)","v":0},{"$f":"IF($F73=\"TBA\",1,0)","v":0}]
[null,"07  - Software Policy ","S007",11,"NATO Software may address national requirements with appropriate funding arrangements and transfer of property for the results to the Alliance. Integration of national requirements must be subject to approval in accordance with NAC approved regulations","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S008",12,"NATO Software is subject to security risk assessment through mechanisms embedded in its life-cycle.","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S009",13,"NATO Software design shall seek to minimise ‘lock-in’ to proprietary solutions. \nIf appropriate, Open Source Software shall be adopted, provided adequate lifecycle support is available.","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S010",14,"NATO Software shall be developed in an evolutionary and incremental way ","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S011",15,"NATO Software shall be designed to be configurable for deployment in different missions, exercises and training environments. NATO Software shall also be designed in a modular fashion with reusable software components. ","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S012",16,"The acquisition of NATO Software shall optimise the re-use of software products and components","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S013","17","NATO Software shall only be used after NATO has granted an appropriate license","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S014","18","Disclosure and provisioning of NATO Software shall be subject to approval by Allies, on a case-by-case basis","Large",0,0,1,0,0,0]
[null,"07  - Software Policy ","S015","19","The use of NATO Software by non-NATO entities shall be regulated on fair and reasonable terms and conditions and in respect of the Intellectual Property Rights owned by NATO","Large",0,0,1,0,0,0]
["Revised - AC/322-D(2019)0046 (INV)","08 - C3 Capabilities Implementation Policy ","S001","9","Alternatives shall be investigated to include: use of existing Services, adoption of NATO solutions, adoption of National solutions, purchasing of COTS or MOTS solutions, outsourcing, creating new capabilities or any combination of the above (not listed in order of  preference)","None",0,0,0,0,1,0,"Ver. 2.1"]
[null,"08 - C3 Capabilities Implementation Policy ","S002","10","Requirement shall be shaped to fit existing solutions where possible or a trade-off shall be proposed between meeting 100% of the original requirements and the advantages of reducing risk and decreasing time to implementation and operation","None",0,0,0,0,1,0]
[null,"08 - C3 Capabilities Implementation Policy ","S003","11","A business case shall be developed, to be included in the Type B Cost Estimate (TBCE) that outlines the potential alternative approaches (adopt, buy, create or some combination) and makes a recommendation to the governing body on the implementation.","None",{"$f":"IF($F85=\"N/A\",1,P904)","v":0},0,0,0,1,0]
[null,"08 - C3 Capabilities Implementation Policy ","S004","12","The chosen alternative must have been tested and\naccredited or have a clear path to being tested and accredited by NATO","None",0,0,0,0,1,0]
[null,"08 - C3 Capabilities Implementation Policy ","S005","13","If the create option is necessary the solution shall be built in a modular fashion to allow complete or partial reuse by other NATO Enterprise organizations and Nations","None",0,0,0,0,1,0]
[null,"08 - C3 Capabilities Implementation Policy ","S006","14","To avoid inextricably linking financial resources to an approved investment, where scant progress is made in the face of an aging requirement, early termination of a procurement initiative shall be considered. \nConsiderations shall also be made on optimizing the time for introducing new technology to succeed aging technology in a Life Cycle Cost-perspective.","None",0,0,0,0,1,0]
["Revised - AC/322-D(2025)0048","09 - REVISED- Enterprise Architecture Policy","S001","10.1","Revised. Architecture support for strategy definition. Architectures shall be used to support the definition of business and digital strategies, and to assess the complexity, feasibility, cost and dependencies of strategic change initiatives.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"09 - REVISED- Enterprise Architecture Policy","S002","10.2","Revised. Architectures shall be used to support the execution of business and digital strategies. To this end, architectures shall inform relevant processes such as resource planning, programme/project management, requirements management, and acquisition and procurement. Architecture shall support rapid technologies and services adoption to replace obsolete technologies within programmes and projects.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"09 - REVISED- Enterprise Architecture Policy","S003","10.3","Revised. Architectures shall be used to ensure that changes are made in response to business needs to maintain relevance and stay abreast of emerging trends. Changes will only be made following examination of the proposed change against the architectures. Solution requirements described by architectural products shall maintain traceability with operational requirements.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"09 - REVISED- Enterprise Architecture Policy","S004","10.4","Revised. Standardized architecting process. Architectures shall be developed and used in accordance with open standard EA frameworks and modelling languages as agreed by Allies, to increase collaboration and understanding between different entities. In line with NATO’s policy on standardization, the adoption of widely used standards from internationally recognized standardisation bodies shall be prioritized rather than the creation of new ones.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"09 - REVISED- Enterprise Architecture Policy","S005","10.5","Revised. Reuse and traceability of architecture content. To enable data driven decision  making, architecture deliverables shall reuse the content of, or shall be traceable to, architecture reference data including NATO-approved taxonomies to increase content coherence across various architecture efforts. The use of repositories will enforce coherence, traceability and consistency between different architectures.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"09 - REVISED- Enterprise Architecture Policy","S006","10.6","Revised. Sharing of architecture information. Architecture information, describing artefacts at the appropriate level, shall be discoverable, accessible, understandable, trusted and secured to interested and authorized parties by means of a standardized sharing mechanism, in both human- and machine-readable formats. ","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"09 - REVISED- Enterprise Architecture Policy","S007","10.7","Revised. Architecting as a Service (AaaS). To implement the goals and principles in this policy, NATO Enterprise entities shall develop and maintain an architecture capability and may leverage external architectural expertise as well as architectural resources available within the NATO committee structure. ","Full",0,1,0,0,0,0,"Ver. 2.2"]
["Revised AC/322-D(2024)0072","10 - REVISED - Cloud and Edge Computing Policy","S001","10","Revised. Service providers shall follow a cloud computing approach incorporating Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) models.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S002","11","Revised. Mission-oriented approach. The Alliance cloud and edge computing approach shall accommodate operational needs. Its implementation shall ensure enhanced operational effectiveness in NATO-led operations, for the NATO Command Structure and for Allies, by enabling digitally transformed battlespace and operational Command and Control (C2) functions that are interoperable and resilient.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S003","12","Revised. Digital Backbone enablement. NATO shall implement and maintain an extensible and secure ICT infrastructure serving Allied Forces wherever they need to operate. This will be enabled through a comprehensive NATO Digital Backbone (NDB), encompassing cloud services and extending to tactical edge components.The Alliance cloud and edge service continuum shall allow for the creation of Community of Interest (COI) segments via logical/virtual partitioning.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S004","13","Revised. Unified ICT Infrastructure. The goal is one secure ICT infrastructure supporting the entire federated NDB for all information domains, including the handling of non-classified information and security classifications up to and including NATO SECRET. This will be enabled by the implementation of Zero Trust Policy.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S005","14","Revised. Diversified Cloud-First. All future ICT solutions within the NDB shall use existing cloud infrastructure and services as opposed to deploying distinct additional infrastructures. NATO’s cloud infrastructure shall embrace, to the maximum possible extent, a multi-vendor and multi-cloud approach, whereby diversity and portability of data and services increase resilience and mitigate vendor lock-in.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S006","15","Revised. Deployment Model. ICT infrastructure, handling NATO CONFIDENTIAL (or national equivalent) and above information, shall use a private cloud deployment model that is combining cloud and edge services owned and operated by NATO Enterprise, NATO Nations and trusted commercial service providers. For the infrastructure handling information classified NATO RESTRICTED and below, public deployment models shall be preferred. ","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S007","16","Revised. Cloud and Edge Security. NATO cloud and edge services handling NATO information shall comply with NATO Security Policy and relevant directives for Communications and Information Systems (CIS). Furthermore, such services shall be subject to continuous, automated compliance monitoring and real-time auditing, in support of continuous accreditation, and leverage modern, AI-enabled CIS security services. ","Partial",{"$f":"IF($F102=\"N/A\",1,0)","v":0},0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S008","17","Revised. Data Protection and Sovereignty. Alliance data protection in a cloud environment shall ensure the ability to control the access, alteration, archiving and deletion of digital information. The cloud processing of NATO data shall be restricted to ICT infrastructure under Alliance’s oversight and shall be protected by the inviolability of archives. NATO data shall be protected from third party exposure,. For information classified NATO CONFIDENTIAL (or national equivalent) and above, storage in external cloud environments shall allow the selection of data-centres that are physically located within predefined boundaries.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S009","18","Revised. Legacy Migration. Legacy ICT solutions shall be migrated to a cloud computing environment, following a careful analysis to ensure there is a reasonable business case, with suitability, rationalization, architectural and financial considerations.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S010","19","Revised. Edge Computing implementation shall be considered in cases where: workloads need to be real-time with strict requirements on low latency, relevant data is ingested from edge-located Military IoT sensors and/or is of ephemeral nature affecting mainly users located at the edge’ s vicinity.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S011","20","Revised. Re-Use. The re-use of ICT solutions, hosted in the cloud computing environment, shall be considered.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S012","21.1","Revised: Cloud Business Model: CT solutions will be tailored to identified “business needs” to effectively adopt cloud and edge technology, leveraging data analytics and artificial intelligence in order to enhance business and operational functions, such as political consultation and military C2 processes. ","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S013","21.2","Revised: ICT solutions will be designed to be infrastructure-agnostic with the expectation that the infrastructure has already been designed and will be provisioned as needed, enabling the use of best-of-breed cloud-native solutions, where appropriate.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S014","21.3","Revised: ICT solutions will be hosted on cloud infrastructure owned, operated and maintained by a Service Provider (NATO Enterprise, commercial or an Allied Nation).","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S015","21.4","Revised: Service providers will be responsible for acquiring, running and maintaining the cloud infrastructure,  which reflects a shared-responsibility model.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S016","22","Revised: Software deployment shall be conducted through an Allied or NATO’s Software Factory to adequately perform the necessary testing and integration. This also allows the use of software not developed within the respective factories, as long as they comply with mandatory security and interoperability requirements . The Service Provider shall support robust DevSecOps.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
[null,"10 - REVISED - Cloud and Edge Computing Policy","S017","23","Revised: Edge services supporting warfighters at the tactical edge shall sustain their operation in contested, congested, degraded and disconnected (C2/D2) environments whilst provide for automatic synchronization with cloud services once communication is re-established.","Partial",0,0,0,1,0,0,"Ver. 2.2"]
["Revised - AC/322-D(2024)0001 (INV)","11 - Green IT Policy ","S001","10","Green IT principles shall enable business processes to become more energy efficient and environmentally sustainable, and promote NATO’s “green” profile, in accordance with the aims of the Green Defence Framework.","Partial",{"$f":"IF($F113=\"N/A\",1,0)","v":0},{"$f":"IF($F113=\"Full\",1,0)","v":0},{"$f":"IF($F113=\"Large\",1,0)","v":0},{"$f":"IF($F113=\"Partial\",1,0)","v":1},{"$f":"IF($F113=\"None\",1,0)","v":0},{"$f":"IF($F113=\"TBA\",1,0)","v":0}]
[null,"11 - Green IT Policy ","S002","11","Green IT principles shall be applicable to all stages of the lifecycle for C3 Capabilities and ICT Services.","Partial",{"$f":"IF($F114=\"N/A\",1,0)","v":0},{"$f":"IF($F114=\"Full\",1,0)","v":0},{"$f":"IF($F114=\"Large\",1,0)","v":0},{"$f":"IF($F114=\"Partial\",1,0)","v":1},{"$f":"IF($F114=\"None\",1,0)","v":0},{"$f":"IF($F114=\"TBA\",1,0)","v":0}]
[null,"11 - Green IT Policy ","S003","12","Applied Green IT principles shall support the effectiveness, interoperability, security and resilience of the C3 Capabilities and ICT Services.","Partial",{"$f":"IF($F115=\"N/A\",1,0)","v":0},{"$f":"IF($F115=\"Full\",1,0)","v":0},{"$f":"IF($F115=\"Large\",1,0)","v":0},{"$f":"IF($F115=\"Partial\",1,0)","v":1},{"$f":"IF($F115=\"None\",1,0)","v":0},{"$f":"IF($F115=\"TBA\",1,0)","v":0},"Ver. 2.1"]
[null,"11 - Green IT Policy ","S004","13","Emerging Disruptive Technologies (EDT) and Software intensive Capabilities, technologies and solutions will support Green IT as an enabler to reduce footprint or better monitor production and consumption of energy via IT.\n\n","Partial",{"$f":"IF($F116=\"N/A\",1,0)","v":0},{"$f":"IF($F116=\"Full\",1,0)","v":0},{"$f":"IF($F116=\"Large\",1,0)","v":0},{"$f":"IF($F116=\"Partial\",1,0)","v":1},{"$f":"IF($F116=\"None\",1,0)","v":0},{"$f":"IF($F116=\"TBA\",1,0)","v":0},"Ver. 2.1"]
[null,"11 - Green IT Policy ","S005",14,"When developing C3 capabilities, IT assets shall be properly tailored to the requirements in order to avoid excessive allocation of IT resources to individual users. At the capability level, notwithstanding the need to cater for flexibility and dynamic growth, the IT capacity shall not be over-provisioned above an agreed target, specific to each capability.","Partial",0,0,0,1,0,0]
[null,"11 - Green IT Policy ","S006","15 ","Green standards and best practices. C3 Capabilities and ICT services shall be acquired and introduced in service, by considering their energy efficiency, amount of computational power required by AI algorithms, greenhouse emissions standards in line with NATO’s climate change and security action plan and industry best-practices.\n","Partial",0,0,0,1,0,0,"Ver. 2.1"]
[null,"11 - Green IT Policy ","S007","16","A cost/benefit analysis of the lifecycle assessments of C3 Capabilities and ICT Services, including AI-based capabilities, shall be performed during the acquisition process. Due considerations to the lifecycle environmental impact shall also be part of this analysis, using energy-efficient standards according to industry best-practices.","Partial",0,0,0,1,0,0,"Ver. 2.1"]
[null,"11 - Green IT Policy ","S008","17","Improvements to existing lifecycle processes of C3 Capabilities and ICT Services shall be explored, identified and implemented for effective implementation of Green IT activities and to further reduce the environmental footprint.","Partial",0,0,0,1,0,0,"Ver. 2.1"]
[null,"11 - Green IT Policy ","S009","18","The energy consumption of AI-based capabilities shall be taken into account, both during model training and during execution, in line with NATO’s climate security agenda objectives. This includes selection of suitable models to train, optimising training approaches, data selection, followed by optimisation during execution of AI functions.","Partial",0,0,0,1,0,0,"Ver. 2.1"]
[null,"11 - Green IT Policy ","S010","19","Optimal use for energy efficiency. Service providers and service users shall ensure the use of energy efficiency mechanisms embedded within C3 Capabilities by aiming at agreed levels of consumption.","Partial",0,0,0,1,0,0]
[null,"11 - Green IT Policy ","S011","20","Paperless environment. NATO Enterprise shall continue to exploit the potential of ICT services with a view to achieving a paperless environment where applicable, taking into consideration mission critical services for business continuity.","Partial",0,0,0,1,0,0,"Ver. 2.1"]
[null,"11 - Green IT Policy ","S012","21","Collaboration tools. The capacity and availability of Collaboration tools shall be enhanced and exploited to the maximum extent possible in order to adapt NATO business processes, thereby resulting in the reduction of resource-intensive activities (e.g. business travel for meetings).","Partial",0,0,0,1,0,0]
[null,"11 - Green IT Policy ","S013","22","Reusing or sharing of ICT infrastructures shall be maximised over creating isolated silos of infrastructure assets. Cloud based solutions shall be effectively leveraged for increased sharing of and higher utilisation of IT capacity and resources.","Partial",0,0,0,1,0,0,"Ver. 2.1"]
[null,"11 - Green IT Policy ","S014","23","Use of virtualisation. As a matter of priority, the service customers shall consider and the service providers shall implement virtualisation solutions, in compliance with NATO policies.\n\n","Partial",0,0,0,1,0,0]
[null,"11 - Green IT Policy ","S015","24","Staff training and awareness. Staffs shall be provided with adequate training and awareness on best practices with regards to the environmental impacts of IT and its efficient use.","Partial",0,0,0,1,0,0,"Ver. 2.1"]
[null,"11 - Green IT Policy ","S016","25","Components re-use/recycling. Components of electronic waste shall be re-used or recycled in accordance with the applicable National or international legislation, whilst considering the NATO Security Policy to ensure proper disposal of classified information and components before recycling.","Partial",0,0,0,1,0,0]
[null,"11 - Green IT Policy ","S017","26","Consistent management of hazardous material. Hazardous waste shall be consistently identified as such and subsequently handled in accordance with the applicable National or international legislation.","Partial",0,0,0,1,0,0]
["C-M(2015) 0041-REV2 ANNEX 12","12 - Internet Protocol Version 6 (IPv6)  Policy","S001","6","The IPv6 implemenation timeline shall be determined by commercial developments and operational requirements (See S007)","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S002","7","The migration to a IPv6-only environment shall be gradual, indicating a certain overlap with the previous IPv4. The co-existence shall be kept to the minimum. ","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S003","8","Migration to IPv6 should not result in any degradation of service capabilities","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S004","9 - 12","New applications shall have both IPv4 and IPv6 software interfaces for data transfer and name-to-address resolution. ","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S005","10","Existing and legacy C3 Capabilities can use other than dual-stack approaches to transition from IPv4 to IPv6. ","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S006","11","Prior to the implementation of IPv6 a vulnerability assessment must be conducted before the networks carry any operational traffic.","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S007","13","During the transition period, IPv6 enabled C3 Capabilities shall also be accessible from IPv4 only C3 clients and networks.","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S008","14","The interworking between the IPv4 and IPv6 versions of software shall be tested prior to deployment of the software, and verified and validated to support the full functional and non-functional requirements, including information assurance, across the interworking.","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S009","15 -16","The migration to IPv6 shall be aligned with the IPv6 transition strategy and plan. The implementation status of IPv6 shall be developed and maintained.","Full",0,1,0,0,0,0]
[null,"12 - Internet Protocol Version 6 (IPv6)  Policy","S010","17"," An address and naming plan for NATO and the Alliance as a whole shall be defined to include federated networks using the globally unique address space as assigned by the International Assigned Numbers Authority (IANA).","Full",0,1,0,0,0,0]
["C-M(2015) 0041-REV2 ANNEX 13","13 - Data Management Policy","S001","10","Specific processes shall be put in place for accessing, using, sharing and protecting  data.","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S002","11 - 16 - 18","Data shall be advertised, discoverable and assessable by users and applications. New programs shall search for existing data elements before creating new data elements","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S003","12","Data shall be accessible in a networked environment to users and applications. ","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S004","13 - 19","Data of permanent value shall be retained and archived, whilst data of temporary value shall be destroyed when no longer needed. Critical data shall be consistently defined, stored and managed to provide a single point of reference. ","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S005","14","XML shall be used as a syntax for data exchange","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S006","20","Data stewards shall be established to manage the NATO Enterprise data.","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S007","15","Users and applications shall have the ability to determine and assess the authority of the source and integrity of the data.","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S008","17","Organisations shall use appropriate data architectures in support to planning for the provision of high quality data, collecting of data requirements, guiding data integration, controlling data assets and aligning data investments within NATO","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S009","21","Metadata shall be defined to allow discoverability of data and information, to enable the description of the structure and the content of data and information, to provide sufficient details for authenticity, pedigree, protection, security classification, and access control, to facilitate the identification of ownership and custodianship, to facilitate retention and disposition and long-term preservation, and to support system interoperability and information exchange","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S010","23","CoI (communities of interest) shall use metadata schemas that are aligned with the NATO core metadata.","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S011","24","Metadata and its metadata schema should be unclassified, visible to, accessible and exchangeable by all authorised users and systems (Metadata may have a different classification level from the data or information that it is associated with)","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S012","25","Metadata of records shall be maintained for long-term preservation beyond the destruction of the record itself.","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S013","27"," XML shall be used as the primary language to structure metadata","Partial",0,0,0,1,0,0]
[null,"13 - Data Management Policy","S014","28","Data management principles related to visibility, accessibility, interoperability, quality, assurance and security shall apply to metadata management.","Partial",0,0,0,1,0,0]
["C-M(2007)0118","14 - NATO Information Management Policy","S001","5","Information is a corporate resource and shall be managed as such to support NATO’s missions, consultation, decision making processes, and operational requirements by organising and controlling information throughout its life-cycle regardless of the medium and format in which the information is held.","Full",0,1,0,0,0,0]
[null,"14 - NATO Information Management Policy","S002","6","Information shall have an originator, and clearly defined ownership and custodianship assigned throughout its life-cycle.","Full",0,1,0,0,0,0]
[null,"14 - NATO Information Management Policy","S003","7","Management of information is a fundamental responsibility, which shall require executive leadership, top-level involvement and the creation and maintenance of an effective organizational structure.","Full",0,1,0,0,0,0]
[null,"14 - NATO Information Management Policy","S004","8","Information shall be managed with an emphasis on the ‘responsibility-to-share’ balanced by the security principle of ‘need-to-know’, and managed to facilitate access, optimise information sharing and re-use, and reduce duplication, all in accordance with security, legal and privacy obligations.","Full",0,1,0,0,0,0]
[null,"14 - NATO Information Management Policy","S005","9","Information shall have standardised structures and consistent representations","Full",0,1,0,0,0,0]
[null,"14 - NATO Information Management Policy","S006","10","Information shall be protected by applying the principle of Information Assurance","Full",0,1,0,0,0,0]
[null,"14 - NATO Information Management Policy","S007","11","Information needs shall be determined as part of the planning and architecture processes [2] to meet intended activities and effects.","Full",0,1,0,0,0,0]
["C-M(2002)60","15 - The Management of non-classified information","S001","5","All NATO information requires protection to ensure its integrity and availability. ","None",0,0,0,0,1,0]
[null,"15 - The Management of non-classified information","S002","6","The marking NATO UNCLASSIFIED and any administrative or dissemination limitation markings as defined in paragraphs 9 and 10, determines handling and protection requirements to restrict access. All markings are applied by the originator and may only be modified by the originator in consultation, where appropriate, with the individual to whom they refer","None",0,0,0,0,1,0]
[null,"15 - The Management of non-classified information","S003","7","NATO information marked NATO UNCLASSIFIED is to be used only for official purposes. ","None",0,0,0,0,1,0]
[null,"15 - The Management of non-classified information","S004","8","NATO information marked NATO UNCLASSIFIED is subject to release procedures (paragraphs 11 to 15 refer).","None",0,0,0,0,1,0]
["New AC/322-D(2024)0033) ","16 Modeling and Simulation Policy","S001",7,"Strategic and operational planning. M&S services shall enable course of action development and analysis, mission rehearsal and wargaming to inform the enrichment of Strategic and Operational Plans in support of MDO.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S002",8,"Education, Training, Exercises and Evaluation (ETEE). M&S Services shall support ETEE activities to replicate the complex multi-domain environment within which NATO will operate.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S003",9,"Combat Forces preparedness. M&S services shall enable realistic distributed training of commanders and military forces, across all operational domains, in a train as you fight paradigm, with integration of cyber effects as required.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S004",10,"Data-driven decision making. M&S services shall support data-driven decision-making processes, including by training AI algorithms embedded into complex systems and identifying patterns and trends within large datasets.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S005",11,"Concept Development and Experimentation. M&S Services shall enable the development of new NATO concepts, and their use shall be considered from the early stages. In that regard, M&S Services shall support experimentation to increase confidence in a conceptual solution and/or innovative idea, confirm its operational validity and effectiveness, and reduce the risk involved with its implementation.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S006",12,"M&S Ecosystem. M&S Services shall leverage cloud computing technology and service-oriented architecture and enable an ubiquitous, service-based NATO M&S ecosystem.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S007",13,"Interoperability. M&S related Interoperability Points shall be documented within the Alliance Digital Interoperability Architecture and M&S related Interoperability Profiles shall be established, based on agreed NATO STANAGs, STANRECs and/or civil, commercial, or national standards and specifications. M&S Services’ integration with Command and Control Information Services shall be enabled, in line with agreed standards.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S008",14,"Alliance Federation. Federation of NATO Enterprise M&S Services with relevant Services from Allied nations is mandatory when these services are offered over NATO’s Digital Backbone, in support of MDO enablement.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S009",15,"Re-use. Existing M&S services, models and/or datasets shall be reused, when operationally relevant, to the maximum extent possible. Such services will be accessible for re-use through the NATO Communications and Information Agency Costed Customer Services’ Catalogue (CCSC).","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S010",16,"Data availability and quality. Accurate and reliable data is crucial for effective M&S activities. M&S services shall conform to NATO’s Data Centric Reference Architecture to enable both data availability and the provision of high quality data10, that are developed once, coherently managed across, and available to all relevant users and communities of interest.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"16 Modeling and Simulation Policy","S011",17,"Continuous Evaluation and Adjustment: M&S services’ generated data shall be constantly evaluated to inform further adjustments, as required. M&S services shall follow NATO Verification, Validation and Accreditation (VV&A) processes. M&S Services shall comply with the NATO Principles of Responsible Use of AI, as applicable.","Full",0,1,0,0,0,0,"Ver. 2.1"]
["New (AC/322-D(2023)0063 (INV) ","17 Zero Trust  Policy","S001","10.1.","Assume Breach. This principle emphasizes the assumption that the network has been compromised. CIS design, development, and operation decisions shall be taken assuming the environment is compromised.","Full",{"$f":"IF($F176=\"N/A\",1,0)","v":0},{"$f":"IF($F176=\"Full\",1,0)","v":1},{"$f":"IF($F176=\"Large\",1,0)","v":0},{"$f":"IF($F176=\"Partial\",1,0)","v":0},{"$f":"IF($F176=\"None\",1,0)","v":0},{"$f":"IF($F176=\"TBA\",1,0)","v":0},"Ver. 2.1"]
[null,"17 Zero Trust  Policy","S002","10.2.","Never Trust, Always Verify. In all environments, users and resources cannot be trusted by default. Every request shall be authenticated and authorized before being granted access to required resources regardless of their nature or position within the CIS. Resources shall be protected against and monitored for unauthorised access, changes, creation, deletion, or any other possibly malicious behaviour.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"17 Zero Trust  Policy","S003",10.3,"Verify Explicitly and Continuously. In an environment where the threat landscape constantly changes, a user or resource cannot be considered as trusted permanently. Every access and transaction that has been granted shall be regularly and explicitly verified, and not considered valid by default.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"17 Zero Trust  Policy","S004",10.4,"Apply Least Privilege. The principle of ‘least privilege’ shall apply to every resource in a fine-grained fashion.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"17 Zero Trust  Policy","S005","10.5. ","Probabilistic and Explainable Security Decisions. Zero Trust access decisions are based on metrics that indicate the level of confidence using a granular probabilistic scale in order to achieve the desired decision accuracy. Furthermore, the access/transaction decisions can be explained so that it is clear why the access/transaction was granted or denied in each case.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"17 Zero Trust  Policy","S006","10.6.","Transparency. Zero Trust in federated environments requires transparency between federation partners in order to facilitate end-to-end zero trust when access/transactions cut across multiple federated systems. Requisite metrics will be shared for an accurate access/transaction decision to be made, while the detailed metrics will be processed by each individual federation partner.","Full",0,1,0,0,0,0,"Ver. 2.1"]
[null,"18 NEW - Requirements Engineering Policy","S001",5,"NEW - Structured and Evolving Requirements. Requirements shall be structured, and refined iteratively to ensure accuracy, feasibility, and relevance to NATO’s evolving operational needs. Requirements progress through distinct stages - operational, capability, and solution - undergoing iterative refinement to ensure clarity, feasibility, and alignment with NATO’s needs. A structured approach enhances decision-making, optimises resource allocation, and ensures alignment with NATO’s strategic objectives and long-term capability development","Full",0,1,0,0,0,0,"Ver. 2.2"]
["New AC/322-D(2025)0016          ","18 NEW - Requirements Engineering Policy","S002",6,"NEW - Architecture as a Foundation. Requirements shall be aligned with architectural principles and models to ensure structured, scalable and interoperable system development across NATO. A strong architectural foundation ensures coherence across NATO’s complex, multinational defence systems. Aligning requirement and architecture management enables modularity, reduces integration risks, and enhances adaptability for future capabilities. The architecture must support the modular integration of constituent systems within a SoS, fostering interoperability across NATO forces, maximising efficiency in system evolution, and ensuring long-term sustainability.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S003",7,"NEW - Interoperability by Design. Interoperability shall be a foundational requirement for the design, development, and governance  of NATO’s digital-enabled defence and security capabilities, ensuring seamless collaboration and information exchange across forces, systems, and NATO nations. A standardized approach to documenting and maintaining requirements in a machine-readable format, supported by automated verification where feasible, enables structured and decentralised management, ensuring interoperability across the Alliance.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S004",8,"NEW - Stakeholder Engagement. Relevant stakeholders  shall be actively involved throughout the requirements’ lifecycle. The requirements owner will coordinate with stakeholders and confirm refined requirements as they evolve, ensuring all perspectives are considered and documented.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S005",9,"NEW - Partnership with Industry. Engaging industry partners from Allied nations ensures that requirements are considered in the operational context and the ability to deliver the required military effects within technological feasibility and at an acceptable risk.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S006",10,"NEW - Change and Configuration Management. Requirements’ baselines shall be used to establish a structured configuration management process to effectively manage changes to requirements, assessing the impact of modifications and maintaining version control.. Following capability acceptance, the responsibility for change and configuration management, including the traceability of requirements, shall transition to the product owner within the service provider organization.","Full",0,1,0,0,0,0,"Ver. 2.2"]
["New AC/322-D(2025)0016          ","18 NEW - Requirements Engineering Policy","S007",11,"NEW - Accountability through Traceability. The traceability of requirements shall be established at each category as a key point of accountability for tracing a requirement set  backwards to its source and forward throughout the lifecycle to assess that the requirement has been met and verified. Traceability shall be enabled through federated repositories and standardised data formats for exchanging requirements, ensuring that requirement dependencies, changes, and compliance are well-documented and accessible across the Organization. Requirements traceability shall continue during the in-service life of a given capability to ascertain assurance of compliance and scope oversight during upgrades, updates and further subsequent enhancements.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S008",12,"NEW - Innovation. NATO may leverage prototyping and minimum viable products (MVPs) to proactively identify and document customer and end-user needs that can significantly contribute to the requirements’ elicitation and refinement, especially with regard to emerging and disruptive technologies. In such cases, prototypes and MVPs shall be integral in product roadmaps, and their requirements shall still be documented.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S009",13,"NEW - Agility. The engineering of requirements in NATO shall embrace agility by leveraging scope/performance tolerances, as well as promoting iterative and recursive development. Alongside this, continuous stakeholder engagement and feedback will be maintained (see paragraph 8). Moreover, to remain adaptive to changes (see paragraph 10) plans shall include provisions for incremental delivery (see paragraph 18.3).","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S010",14,"NEW - Verification and Validation. Formal processes leveraging modern tools for the verification and validation of the requirements’ baselines shall be established to confirm that requirements are correct, complete, and aligned with stakeholder needs. During capability delivery, automated verification (when possible) and security accreditation processes shall  be used to ensure that the provided capability conforms to all requirements across the DOTMLPFI  lines of development. Additionally, validation processes shall be used to demonstrate that it also meets the operational needs of the end-user, and is sustainable throughout its lifecycle.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S011",15,"Prioritisation for Strategic Impact. Prioritisation between different programmes  ensures that NATO’s most critical needs are addressed first, optimising resource allocation and operational effectiveness. Such prioritisation requires a portfolio management approach, with the assessment of inter-dependencies and risk management.  Aligning requirements with NATO’s strategic objectives ensures that the most impactful capabilities receive timely attention. Prioritisation decisions shall also include the early termination of outdated, unviable, or misaligned requirements, reallocating resources to capabilities that provide the greatest strategic advantage.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S012",16,"NEW - Autonomy of Constituent Systems. An essential characteristic of SoS is that its constituent systems (CS) are operationally independent, with their own independent management, . This autonomy necessitates an enhanced negotiation and collaboration across all stakeholders throughout the lifecycle of requirements to ensure that each system meets the SoS-level requirements without compromising its own objectives. It is vital that each CS can operate independently to fulfil their own purposes, separate from the SoS. Because the SoS provides unique capabilities beyond those of the CS, the SoS may even have unique inputs beyond inputs originally needed by the CS. Also, it is possible that the SoS represents an emergent capability that provides outputs not conveyed by any one of its CS.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S013",17,"NEW - Requirements are developed at different stages and varying levels of detail throughout their lifecycle, undergoing evolution and refinement over time.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S014",18.100000000000001,"NEW - Refined requirements shall be as unambiguous as possible but without unnecessary constraints on architecture and design to preserve implementation independence for industry.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S015",18.2,"NEW - Requirements’ baselines shall not conflict with each other and shall comprehensively cover the stakeholders’ needs without gaps.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S016",18.3,"NEW - Capability/solution level requirements shall be prioritised by importance, urgency and/or risk, leveraging techniques as per industry best practice (e.g. MoSCoW18 methodology).","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S017",18.399999999999999,"NEW - The requirements shall be structured and worded in a way that their realisation can be proven (verified) to the customers’ satisfaction at the level that requirements are defined.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"18 NEW - Requirements Engineering Policy","S018",18.5,"NEW - When relevant, the reuse of requirements across various programmes/projects shall be considered to enhance efficiency and consistency, reduce redundancy and foster interoperability","Full",0,1,0,0,0,0,"Ver. 2.2"]
["New AC/322-D(2025)0075","19 NEW - Identity, Credential and Access Management \nPolicy","S001",10,"NEW - Federation. In order to securely exchange approved identities, attributes and data, ICAM shall be federated within the NATO Enterprise and with NATO Nations, both in static and deployable environments. Federation across the Alliance shall be based on clearly defined, identified and approved interoperability requirements.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S002",11,"NEW - Trust. Mutual trust relationships shall be established in a framework of trust to govern how members of a NATO federation operate and interact. The responsibility of verifying and managing the respective identities, resides with the relevant NATO entity or Nation.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S003",12,"NEW - Standardization. Federated ICAM shall be based on agreed or adopted NATO standards, and in compliance with NATO Security Policy and supporting directives. ICAM shall be based as much as possible on open industry standards to maximise interoperability, simplify service development and enable seamless interconnection/federation.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S004",13,"NEW - Scalability and Flexibility. Federated ICAM shall be scalable and flexible to accommodate potential federation participants and react to evolving operational requirements.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S005",14,"NEW - Entity uniqueness. In the context of federated ICAM all subjects involved across the federation shall be unambiguously identified.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S006",15,"NEW - Identity assurance. To maintain security, accuracy, and compliance, ICAM processes shall provide similar levels of assurance across the Alliance throughout the identity data lifecycle. Digital identity management ensures the integrity and authenticity of identities.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S007",16,"NEW - For an effective credential issuance and lifecycle management: The controlled issuance, renewal and revocation of digital identities and credentials, shall be enforced to ensure digital trust across the federation.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S008",17,"NEW - Strong authentication and identity assurance. The use of strong authentication and identity assurance such as Multi-Factor Authentication (MFA) shall be enforced for access to systems, particularly for sensitive or classified resources and is mandatory for all users, including highly privileged or administrator accounts. It may include combinations of passwords, authenticators on mobile devices, smart cards, tokens, biometrics, and one-time \npasscodes, based on the level of sensitivity.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S009",18,"NEW - Unified Access. Federated ICAM shall, as far as possible, reduce the number of credentials needed to access NATO systems, allowing users to authenticate once and access multiple resources without needing to re-enter credentials. This reduces the load on the user to remember multiple credentials, and allows a rapid and effective response in the event of compromise.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S010",19,"NEW - Transparency. The implementation of auditing and monitoring processes, accompanied by clearly defined procedures for reporting and responding to incidents related to identity and access security, is instrumental in fostering trust and security.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S011",20,"Personal Data Protection. When ICAM needs to share personal data, it will comply with the relevant policy. Each Identity Provider (IdP) manages its own user data in compliance with the applicable national and international privacy regulations. The ICAM federation shall only support the collection and usage of the minimum amount of personal data.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S012",21,"NEW - Balanced “Responsibility to Share” and “Need to Know”. Further implementation of ICAM, DCS and ZT will improve automated information sharing between different information domains and build trust between different communities of interest (CoI) while supporting dynamic and flexible enforcement of the need-to know principle and the use of Least Privilege. The originators retain control over their own information, and can apply their own “need-to-know” automated controls, while still abiding by the principle of “responsibility-to-share”.","Large",0,0,1,0,0,0,"Ver. 2.2"]
[null,"19 NEW - Identity, Credential and Access Management \nPolicy","S013",22,"NEW - Empower personnel. Training and Awareness is essential to ensuring that NATO’s ICAM systems are used securely, effectively, and consistently across the Alliance. It empowers personnel to maintain security, operational effectiveness, and collaboration, which are key to NATO’s overall mission success.","Large",0,0,1,0,0,0,"Ver. 2.2"]
["NEW PO(2024)0199","20 NEW- Principles of Responsible Use of AI ",1,null,"NEW - Lawfulness. AI applications will be developed and used in accordance with national and international law, including international humanitarian law and human rights law, as applicable. ","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"20 NEW- Principles of Responsible Use of AI ",2,null,"NEW - Responsibility and Accountability. AI applications will be developed and used with appropriate levels of judgment and care; clear human responsibility shall apply in order to ensure accountability.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"20 NEW- Principles of Responsible Use of AI ",3,null,"NEW - Explainability and Traceability. AI applications will be appropriately understandable and transparent, including through the use of review methodologies, sources, and procedures. This includes verification, assessment and validation mechanisms at either a NATO and/or national level. ","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"20 NEW- Principles of Responsible Use of AI ",4,null,"NEW - Reliability. AI applications will have explicit, well-defined use cases. The safety, security, and robustness of such capabilities will be subject to testing and assurance within those use cases across their entire life cycle, including through established NATO and/or national certification procedures. ","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"20 NEW- Principles of Responsible Use of AI ",5,null,"NEW - Governability. AI applications will be developed and used according to their intended functions and will allow for: appropriate human-machine interaction; the ability to detect and avoid unintended consequences; and the ability to take steps, such as disengagement or deactivation of systems, when such systems demonstrate unintended behaviour.","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,"20 NEW- Principles of Responsible Use of AI ",6,null,"NEW - Bias Mitigation. Proactive steps will be taken to minimise any unintended bias—including on the grounds of gender, race or ethnic origin, age, religion or belief, cultural background, sexual orientation or disability—in the development and use of AI applications and in data sets. ","Full",0,1,0,0,0,0,"Ver. 2.2"]
[null,null,null,null,null,"Verification COUNTER",{"$f":"SUM(G2:G218)","v":0},86,41,80,10,0,{"$f":" SUM(G219:L219)","v":217}]

{"sheet":"DashBoard","index":4,"n_rows":66,"n_cols":19,"rows_kept":66,"cut":false,"hidden":false,"merged":[[6,0,16,5]]}
[]
[]
[]
[]
[null,null,null,null,null,null,"POLICY COMPLIANCE REPORT"]
[null,null,null,null,null,null,"(CPP/CP XXXXXX/ PP/TBCE XXXXX…)"]
[]
[]
[null,null,null,null,null,null,null,"Row Labels","Count of Degree of compliance"]
[null,null,null,null,null,null,null,"Full",86]
[null,null,null,null,null,null,null,"Large",41]
[null,null,null,null,null,null,null,"None",10]
[null,null,null,null,null,null,null,"Partial",80]
[null,null,null,null,null,null,null,"Grand Total",217]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,"Detailed Record of the assessment"]
["Policy Name ↓ Policy Principles Serials →","S001","S002","S003","S004","S005","S006","S007","S008","S009","S010","S011","S012","S013","S014","S015","S016","S017","S018"]
["(02) ICT Service Management Policy",{"$f":"Checklist!F2","v":"Large"},{"$f":"Checklist!F3","v":"Large"},{"$f":"Checklist!F4","v":"Large"},{"$f":"Checklist!F5","v":"Large"},{"$f":"Checklist!F6","v":"Large"},{"$f":"Checklist!F7","v":"Large"},{"$f":"Checklist!F8","v":"Large"},{"$f":"Checklist!F9","v":"Large"},{"$f":"Checklist!F10","v":"Large"},{"$f":"Checklist!F11","v":"Large"},{"$f":"Checklist!F12","v":"Large"},{"$f":"Checklist!F13","v":"Large"},{"$f":"Checklist!F14","v":"Large"}]
["(03) Lifecycle Management",{"$f":"Checklist!F15","v":"Full"},{"$f":"Checklist!F16","v":"Full"},{"$f":"Checklist!F17","v":"Full"},{"$f":"Checklist!F18","v":"Full"},{"$f":"Checklist!F19","v":"Full"},{"$f":"Checklist!F20","v":"Full"}]
["(04) Waveform Policy",{"$f":"Checklist!F21","v":"Partial"},{"$f":"Checklist!F22","v":"Partial"},{"$f":"Checklist!F23","v":"Partial"},{"$f":"Checklist!F24","v":"Partial"},{"$f":"Checklist!F25","v":"Partial"},{"$f":"Checklist!F26","v":"Partial"},{"$f":"Checklist!F27","v":"Partial"},{"$f":"Checklist!F28","v":"Partial"},{"$f":"Checklist!F29","v":"Partial"},{"$f":"Checklist!F30","v":"Partial"},{"$f":"Checklist!F31","v":"Partial"},{"$f":"Checklist!F32","v":"Partial"},{"$f":"Checklist!F33","v":"Partial"},{"$f":"Checklist!F34","v":"Partial"},{"$f":"Checklist!F35","v":"Partial"},{"$f":"Checklist!F36","v":"Partial"},{"$f":"Checklist!F37","v":"Partial"}]
["(05) C3Interoperability Policy",{"$f":"Checklist!F38","v":"Full"},{"$f":"Checklist!F39","v":"Full"},{"$f":"Checklist!F40","v":"Full"},{"$f":"Checklist!F41","v":"Full"},{"$f":"Checklist!F42","v":"Full"},{"$f":"Checklist!F43","v":"Full"},{"$f":"Checklist!F44","v":"Full"},{"$f":"Checklist!F45","v":"Full"},{"$f":"Checklist!F46","v":"Full"},{"$f":"Checklist!F47","v":"Full"},{"$f":"Checklist!F48","v":"Full"},{"$f":"Checklist!F49","v":"Full"},{"$f":"Checklist!F50","v":"Full"},{"$f":"Checklist!F51","v":"Full"},{"$f":"Checklist!F52","v":"Full"}]
["(06) Federation of Communications Services  Policy",{"$f":"Checklist!F53","v":"Partial"},{"$f":"Checklist!F54","v":"Partial"},{"$f":"Checklist!F55","v":"Partial"},{"$f":"Checklist!F56","v":"Partial"},{"$f":"Checklist!F57","v":"Partial"},{"$f":"Checklist!F58","v":"Partial"},{"$f":"Checklist!F59","v":"Partial"},{"$f":"Checklist!F60","v":"Partial"},{"$f":"Checklist!F61","v":"Partial"},{"$f":"Checklist!F62","v":"Partial"},{"$f":"Checklist!F63","v":"Partial"},{"$f":"Checklist!F64","v":"Partial"},{"$f":"Checklist!F65","v":"Partial"},{"$f":"Checklist!F66","v":"Partial"},{"$f":"Checklist!F67","v":"Partial"}]
["(07) Software Policy",{"$f":"Checklist!F68","v":"Large"},{"$f":"Checklist!F69","v":"Large"},{"$f":"Checklist!F70","v":"Large"},{"$f":"Checklist!F71","v":"Large"},{"$f":"Checklist!F72","v":"Large"},{"$f":"Checklist!F73","v":"Large"},{"$f":"Checklist!F74","v":"Large"},{"$f":"Checklist!F75","v":"Large"},{"$f":"Checklist!F76","v":"Large"},{"$f":"Checklist!F77","v":"Large"},{"$f":"Checklist!F78","v":"Large"},{"$f":"Checklist!F79","v":"Large"},{"$f":"Checklist!F80","v":"Large"},{"$f":"Checklist!F81","v":"Large"},{"$f":"Checklist!F82","v":"Large"}]
["(08) C3 Capabilities Implementation Policy",{"$f":"Checklist!F83","v":"None"},{"$f":"Checklist!F84","v":"None"},{"$f":"Checklist!F85","v":"None"},{"$f":"Checklist!F86","v":"None"},{"$f":"Checklist!F87","v":"None"},{"$f":"Checklist!F88","v":"None"}]
["(09) REVISED - Enterprise Architecture Policy",{"$f":"Checklist!F89","v":"Full"},{"$f":"Checklist!F90","v":"Full"},{"$f":"Checklist!F91","v":"Full"},{"$f":"Checklist!F92","v":"Full"},{"$f":"Checklist!F93","v":"Full"},{"$f":"Checklist!F94","v":"Full"},{"$f":"Checklist!F95","v":"Full"}]
["(10) REVISED - Cloud and Edge Computing Policy",{"$f":"Checklist!F96","v":"Partial"},{"$f":"Checklist!F97","v":"Partial"},{"$f":"Checklist!F98","v":"Partial"},{"$f":"Checklist!F99","v":"Partial"},{"$f":"Checklist!F100","v":"Partial"},{"$f":"Checklist!F101","v":"Partial"},{"$f":"Checklist!F102","v":"Partial"},{"$f":"Checklist!F103","v":"Partial"},{"$f":"Checklist!F104","v":"Partial"},{"$f":"Checklist!F105","v":"Partial"},{"$f":"Checklist!F106","v":"Partial"},{"$f":"Checklist!F107","v":"Partial"},{"$f":"Checklist!F108","v":"Partial"},{"$f":"Checklist!F109","v":"Partial"},{"$f":"Checklist!F110","v":"Partial"},{"$f":"Checklist!F111","v":"Partial"},{"$f":"Checklist!F112","v":"Partial"}]
["(11) Green IT Policy",{"$f":"Checklist!F113","v":"Partial"},{"$f":"Checklist!F114","v":"Partial"},{"$f":"Checklist!F115","v":"Partial"},{"$f":"Checklist!F116","v":"Partial"},{"$f":"Checklist!F117","v":"Partial"},{"$f":"Checklist!F118","v":"Partial"},{"$f":"Checklist!F119","v":"Partial"},{"$f":"Checklist!F120","v":"Partial"},{"$f":"Checklist!F121","v":"Partial"},{"$f":"Checklist!F122","v":"Partial"},{"$f":"Checklist!F123","v":"Partial"},{"$f":"Checklist!F124","v":"Partial"},{"$f":"Checklist!F125","v":"Partial"},{"$f":"Checklist!F126","v":"Partial"},{"$f":"Checklist!F127","v":"Partial"},{"$f":"Checklist!F128","v":"Partial"},{"$f":"Checklist!F129","v":"Partial"}]
["(12) IPV6 Policy",{"$f":"Checklist!F130","v":"Full"},{"$f":"Checklist!F131","v":"Full"},{"$f":"Checklist!F132","v":"Full"},{"$f":"Checklist!F133","v":"Full"},{"$f":"Checklist!F134","v":"Full"},{"$f":"Checklist!F135","v":"Full"},{"$f":"Checklist!F136","v":"Full"},{"$f":"Checklist!F137","v":"Full"},{"$f":"Checklist!F138","v":"Full"},{"$f":"Checklist!F139","v":"Full"}]
["(13) Data Management Policy",{"$f":"Checklist!F140","v":"Partial"},{"$f":"Checklist!F141","v":"Partial"},{"$f":"Checklist!F142","v":"Partial"},{"$f":"Checklist!F143","v":"Partial"},{"$f":"Checklist!F144","v":"Partial"},{"$f":"Checklist!F145","v":"Partial"},{"$f":"Checklist!F146","v":"Partial"},{"$f":"Checklist!F147","v":"Partial"},{"$f":"Checklist!F148","v":"Partial"},{"$f":"Checklist!F149","v":"Partial"},{"$f":"Checklist!F150","v":"Partial"},{"$f":"Checklist!F151","v":"Partial"},{"$f":"Checklist!F152","v":"Partial"},{"$f":"Checklist!F153","v":"Partial"}]
["(14) NATO Information Management Policy",{"$f":"Checklist!F154","v":"Full"},{"$f":"Checklist!F155","v":"Full"},{"$f":"Checklist!F156","v":"Full"},{"$f":"Checklist!F157","v":"Full"},{"$f":"Checklist!F158","v":"Full"},{"$f":"Checklist!F159","v":"Full"},{"$f":"Checklist!F160","v":"Full"}]
["(15) Management of Non-Classified Information Policy",{"$f":"Checklist!F161","v":"None"},{"$f":"Checklist!F162","v":"None"},{"$f":"Checklist!F163","v":"None"},{"$f":"Checklist!F164","v":"None"}]
["(16) Modeling and Simulation",{"$f":"Checklist!F165","v":"Full"},{"$f":"Checklist!F166","v":"Full"},{"$f":"Checklist!F167","v":"Full"},{"$f":"Checklist!F168","v":"Full"},{"$f":"Checklist!F169","v":"Full"},{"$f":"Checklist!F170","v":"Full"},{"$f":"Checklist!F171","v":"Full"},{"$f":"Checklist!F172","v":"Full"},{"$f":"Checklist!F173","v":"Full"},{"$f":"Checklist!F174","v":"Full"},{"$f":"Checklist!F175","v":"Full"}]
["(17) Zero Trust",{"$f":"Checklist!F176","v":"Full"},{"$f":"Checklist!F177","v":"Full"},{"$f":"Checklist!F178","v":"Full"},{"$f":"Checklist!F179","v":"Full"},{"$f":"Checklist!F180","v":"Full"},{"$f":"Checklist!F181","v":"Full"}]
["(18) NEW - Requirements Engineering Policy",{"$f":"Checklist!F182","v":"Full"},{"$f":"Checklist!F183","v":"Full"},{"$f":"Checklist!F184","v":"Full"},{"$f":"Checklist!F185","v":"Full"},{"$f":"Checklist!F186","v":"Full"},{"$f":"Checklist!F187","v":"Full"},{"$f":"Checklist!F188","v":"Full"},{"$f":"Checklist!F189","v":"Full"},{"$f":"Checklist!F190","v":"Full"},{"$f":"Checklist!F191","v":"Full"},{"$f":"Checklist!F192","v":"Full"},{"$f":"Checklist!F193","v":"Full"},{"$f":"Checklist!F194","v":"Full"},{"$f":"Checklist!F195","v":"Full"},{"$f":"Checklist!F196","v":"Full"},{"$f":"Checklist!F197","v":"Full"},{"$f":"Checklist!F198","v":"Full"},{"$f":"Checklist!F199","v":"Full"}]
["(19) NEW - Identity, Credential and Access Management Policy",{"$f":"Checklist!F200","v":"Large"},{"$f":"Checklist!F201","v":"Large"},{"$f":"Checklist!F202","v":"Large"},{"$f":"Checklist!F203","v":"Large"},{"$f":"Checklist!F204","v":"Large"},{"$f":"Checklist!F205","v":"Large"},{"$f":"Checklist!F206","v":"Large"},{"$f":"Checklist!F207","v":"Large"},{"$f":"Checklist!F208","v":"Large"},{"$f":"Checklist!F209","v":"Large"},{"$f":"Checklist!F210","v":"Large"},{"$f":"Checklist!F211","v":"Large"},{"$f":"Checklist!F212","v":"Large"}]
["(20) NEW - Principles of Responsible Use of AI",{"$f":"Checklist!F213","v":"Full"},{"$f":"Checklist!F214","v":"Full"},{"$f":"Checklist!F215","v":"Full"},{"$f":"Checklist!F216","v":"Full"},{"$f":"Checklist!F217","v":"Full"},{"$f":"Checklist!F218","v":"Full"}]