Data-centric security: frequently asked questions

Data-centric security protects each item of data according to its sensitivity and releasability, with the protection travelling with the data. It does not depend on the network or system the data happens to be on, which makes it suited to sharing between organisations and nations.

DCS-3 is the highest ACP 240 maturity level. The data is encrypted and its security metadata is signed, so it stays confidential and tamper-evident wherever it goes, and the key is released only after a policy decision about the person or system asking. ACP 240 sets it as the target for 2033.

DCS-1 adds a standard label. DCS-2 binds that label to the data so tampering can be detected. DCS-3 adds encryption of the content and policy-based key release, so the data cannot be read by anyone the policy does not allow, on any network.

Espanaro has achieved data-centric security Level 3 (DCS-3) for document and live stream sharing, demonstrated at NATO EFDI Accelerator 2.0 in September 2026. This is Espanaro's own assessment against the ACP 240 maturity levels; it has not been independently certified.

No. DCS Level 3 is Espanaro's own assessment against the ACP 240 maturity levels, demonstrated at NATO EFDI Accelerator 2.0. It has not been independently certified. We welcome independent assessment and can demonstrate the capability on request.

Yes. Espanaro applies DCS Level 3 to live camera and sensor streams. Footage is encrypted at the device, each viewer is checked before the stream opens and re-checked every few seconds, and a policy change takes effect within seconds without touching any screen.

No. In the demonstration the protected feed plays normally for authorised viewers, while each viewer is re-checked every few seconds, so access can change within seconds and the video stays usable.

No. Espanaro's DCS capability is software and is system and hardware agnostic. It runs on-premises, in private cloud, in hybrid environments and at the edge, and connects to existing systems through open interfaces.

No. ByteHarbour, HarbourGuard and Consilium work alongside the systems you already run. Use one, two or all three, depending on what you need to protect and who needs to see it.

Espanaro's DCS capability is built to implement ACP 240 and STANAG 4774 and 4778, and is designed to align with Federated Mission Networking data-centric interoperability.

It is designed to align with FMN Spiral 6 data-centric interoperability. Espanaro has not claimed formal Spiral 6 conformance; formal testing against the published specification would follow in the normal way.

Yes. At CWIX 2026 Espanaro integrated SAPIENT cameras, DCS enabled their feeds and shared them over secure chat between two NATO nations.

No. DCS is data-centric security, about how data itself is protected. DCC is Defence Cyber Certification, a UK supplier cyber assurance scheme. They are unrelated.

Yes. Espanaro Ltd is UK sovereign, UK owned and veteran owned, with its registered office at Capital Tower, Greyfriars Road, Cardiff (Company No. 12836498) and UK-based engineering.

Start with a short demonstration and a discovery conversation about your data, systems and sharing partners. We then align the capability to your environment and run a pilot.

With data-centric security, each item of data is encrypted, labelled and opened only when policy allows. The decision about who may receive it can be made wherever it is requested, rather than only at a fixed network boundary, which reduces how many information flows depend on dedicated cross-domain devices.

A domain can be described by nation or owner, classification, permitted data types, user groups such as a REME LAD or J2 cell, physical location such as a building or site, device type and trust, and mission or time. HarbourGuard evaluates these attributes against policy on every request.

Not everywhere. Some boundaries will keep dedicated cross-domain solutions, for example where content must be inspected or transformed. Data-centric security reduces how many flows need one, and any change remains a decision for the relevant accreditation authority.

Decision advantage is deciding and acting faster and better than an adversary, using information that is trusted, timely and releasable. It depends on getting the right information to the right person or system, at the right time, for the right reason.

Data-centric interoperability means protected data can be exchanged, understood and used across nations, organisations and systems under agreed policy. NATO describes achieving it by combining data-centric security with zero trust, federated identity and attribute-based access control.

DCS protects each item of data wherever it goes. DCI builds on DCS so that partners can open, trust and use that protected data. DCS makes data safe to move; DCI makes it safe and useful to share.

Each person, system, device, network and item of data carries attributes such as nationality, clearance, mission, owner, classification or health. HarbourGuard evaluates them against policy on every request, so access follows the facts of the situation rather than fixed roles.

HarbourGuard policy decides what is allowed. Consilium playbooks decide what should happen next, such as raising an alert, sharing a feed with a team or requiring acknowledgement. ByteHarbour enforces the policy on the data itself, so a playbook can never release data the policy does not permit.

Espanaro covers the path from sensor to decision: Pulse Sentinel and Cognisight for sensing and understanding, ByteHarbour for protection, HarbourGuard for policy decisions, Consilium for orchestration and command, WayForge for uncrewed tasking and RibbonFlow for connection. Each works on its own or alongside existing systems.

Yes. Playbooks can require acknowledgement or approval before an action continues, policies have named owners, and every request, decision and action is recorded in a tamper-evident audit trail.

C2 integration connects separate command and control systems so that data held in one can be used in the others. Espanaro's Consilium takes the data from an entire C2 system, decides by policy what is relevant and releasable to each other system, and shares it in a form that system understands.

No. Consilium sits between your C2 systems. Each one keeps its own users, screens and authorities, and Consilium connects to it through its APIs, message bus, database or a vendor adapter.

No. Policy and playbooks decide what each system needs, and attributes on the data, the receiving system, its network and its users decide what it may see. Every share and every refusal is recorded.

ByteHarbour applies data-centric security to each item, so its protection and classification labels travel with it from one system to the next. Espanaro has demonstrated DCS Level 3 for documents and live video, not independently certified.

It connects once to Consilium and joins the same layer. Its data can then be shared with every other connected system, by policy, without building a new gateway to each of them.

Start with a discovery conversation about the C2 systems you run, what each holds and who needs what. We then connect two systems in a short pilot and expand from there.