What is data-centric security?
Traditional security protects the network: if you are inside the boundary, you are trusted. That model breaks down as soon as information has to move between organisations, coalition partners, classification levels and the tactical edge. Data-centric security turns it around. Each item of information carries its own protection and its own rules, wherever it goes.
NATO doctrine defines data-centric security (AJP-6), and the Alliance's Data Strategy puts secure, rapid data sharing at the centre of its digital transformation.
The three DCS levels at a glance
ACP 240 describes three maturity levels. Each adds stronger protection that travels with the data.
| Level | What it adds | What it means in practice |
|---|---|---|
| DCS-1: Labelling | A confidentiality label on each object (classification, releasability) | Systems can see how data should be handled, but nothing stops a label being changed or ignored |
| DCS-2: Bound labels | Richer metadata, cryptographically bound to the data (STANAG 4778) | Tampering with the label is detectable, but the content itself is not encrypted |
| DCS-3: Cryptographic protection | Content encrypted, metadata signed, keys released only by policy | Data stays protected wherever it is copied or sent and opens only for an authorised person or system |
ACP 240 sets DCS-3 as the target maturity level for 2033 (quoted in the DCS on AWS reference). Read the full explainer: DCS Levels 1, 2 and 3 explained.
How Espanaro delivers DCS-3
Three products, each usable on its own or together, alongside the systems you already run:
Every decision is written to a chained, tamper-evident audit record: who asked, for what, and the outcome, including every re-check of a live stream.
Live video, not just documents
Most data-centric security work stops at files and email. Operations run on live feeds. Espanaro's DCS-3 covers both: each camera stream carries its own classification, releasability and mission policy, so two people can watch the same feed at different clearances, and a single policy change takes effect within seconds without touching either screen.
See how DCS Level 3 works for live video and sensor streams.
Proven in NATO exercises
Standards and interoperability
Espanaro's DCS capability is built to implement ACP 240 and STANAG 4774 and 4778. It is designed to align with Federated Mission Networking (FMN) data-centric interoperability, including the MOD's stated need for FMN Spiral 6 compliant solutions. How Espanaro aligns to FMN Spiral 6 DCI.
From DCS to DCI to decision advantage
NATO is now moving from data-centric security to data-centric interoperability (DCI). DCI builds on DCS: it adds zero trust, federated identity and attribute-based access control so that protected data can be opened, understood and used by partner nations and other systems. Espanaro delivers the DCS foundation at Level 3, HarbourGuard provides the attribute and policy layer DCI depends on, and Consilium playbooks put the right information in front of the right person or system at the right time. That is decision advantage.
System and hardware agnostic
No proprietary appliance is required. The protection layer runs on-premises, in private cloud or in hybrid environments and at the edge, and connects to existing command, sensor, messaging and data systems through open interfaces. It can be aligned to whatever a programme's containers, networks and identity services need, rather than asking the programme to change around it.
A UK sovereign DCS team
Espanaro is UK sovereign, UK owned and veteran owned, with its registered office in Cardiff. Members of our team have worked on data-centric security with UK defence science and technology partners since the concept's early development in 2017, and have advised UK and NATO stakeholders on how DCS can be delivered in practice.
Common questions
What is data-centric security (DCS)?
Data-centric security protects each item of data according to its sensitivity and releasability, with the protection travelling with the data. It does not depend on the network or system the data happens to be on, which makes it suited to sharing between organisations and nations.
What is DCS Level 3 (DCS-3)?
DCS-3 is the highest ACP 240 maturity level. The data is encrypted and its security metadata is signed, so it stays confidential and tamper-evident wherever it goes, and the key is released only after a policy decision about the person or system asking. ACP 240 sets it as the target for 2033.
Has Espanaro achieved DCS Level 3?
Espanaro has achieved data-centric security Level 3 (DCS-3) for document and live stream sharing, demonstrated at NATO EFDI Accelerator 2.0 in September 2026. This is Espanaro's own assessment against the ACP 240 maturity levels; it has not been independently certified.
Is Espanaro's DCS Level 3 independently certified?
No. DCS Level 3 is Espanaro's own assessment against the ACP 240 maturity levels, demonstrated at NATO EFDI Accelerator 2.0. It has not been independently certified. We welcome independent assessment and can demonstrate the capability on request.
Can data-centric security protect live video, not just files?
Yes. Espanaro applies DCS Level 3 to live camera and sensor streams. Footage is encrypted at the device, each viewer is checked before the stream opens and re-checked every few seconds, and a policy change takes effect within seconds without touching any screen.
Do we need new hardware?
No. Espanaro's DCS capability is software and is system and hardware agnostic. It runs on-premises, in private cloud, in hybrid environments and at the edge, and connects to existing systems through open interfaces.
What is the difference between DCS and DCI?
DCS protects each item of data wherever it goes. DCI builds on DCS so that partners can open, trust and use that protected data. DCS makes data safe to move; DCI makes it safe and useful to share.
What is decision advantage?
Decision advantage is deciding and acting faster and better than an adversary, using information that is trusted, timely and releasable. It depends on getting the right information to the right person or system, at the right time, for the right reason.