- ABAC (attribute-based access control)
- Access decided by evaluating attributes of the person or system, the data and the context (for example clearance, nationality, mission, device and time) against policy, rather than by fixed roles.
- Access control framework (ACF)
- The set of services and rules that together decide and enforce access to protected data, including policy decision and key release.
- ACP 240
- Allied Communications Publication that describes data-centric security for coalition information sharing, including the DCS-1, DCS-2 and DCS-3 maturity levels.
- Audit chain (tamper-evident log)
- A record in which each entry is cryptographically linked to the one before, so altering any entry is detectable on verification.
- Binding
- Cryptographically tying security metadata to the data it describes so that changes to either can be detected. Defined for NATO by STANAG 4778.
- Confidentiality label
- Standard metadata that states an object's classification, releasability and handling caveats. Defined for NATO by STANAG 4774.
- Cross-domain
- Moving information between networks or systems that operate at different security levels or under different authorities.
- DCC (Defence Cyber Certification)
- A UK supplier cyber certification scheme. It is unrelated to DCS levels.
- DCI (data-centric interoperability)
- Building on data-centric security so that protected data can be exchanged, understood and used across nations, organisations and systems. NATO describes it as DCS combined with zero trust, federated identity and attribute-based access control, applied through frameworks such as FMN.
- DCS (data-centric security)
- Protecting data according to its sensitivity and releasability, with the protection travelling with the data rather than depending on the network.
- DCS-1
- First ACP 240 maturity level: data carries a standard confidentiality label.
- DCS-2
- Second level: the label and metadata are cryptographically bound to the data, so tampering is detectable.
- DCS-3
- Third level: the content is encrypted and the metadata signed, with keys released only by policy decision. ACP 240 target for 2033.
- Decision advantage
- Deciding and acting faster and better than an adversary, using information that is trusted, timely and releasable.
- Envelope encryption
- Encrypting data with a data key, then protecting that data key separately so it can be released to authorised recipients without re-encrypting the data.
- Federated identity
- Trusting identities issued by partner organisations or nations, so their people and systems can be evaluated by policy without separate accounts.
- FMN (Federated Mission Networking)
- NATO's framework for agreeing the standards that Allied and partner systems use to interoperate, published in successive spirals.
- Key access service
- The service that decides, by policy, whether to release the key needed to open a protected object.
- Need to know
- A requirement that a person has a legitimate operational reason to access specific information, in addition to holding the right clearance.
- Playbook
- A defined sequence of actions, such as alerting, sharing, assigning or escalating, triggered by an event and constrained by policy.
- Releasability
- Which nations, organisations or groups an item of information may be released to.
- SAPIENT
- The UK MOD's open interface standard for autonomous sensors and effectors, widely used in counter-drone and force protection systems.
- SPIF (security policy information file)
- A machine-readable definition of a security policy's classifications, categories and rules, used to create and check labels consistently.
- STANAG 4774
- NATO standard for confidentiality metadata labels.
- STANAG 4778
- NATO standard for binding metadata to data.
- Zero trust
- A security approach that trusts no user, device or network by default and verifies every request.
- ZTDF (Zero Trust Data Format)
- An object format for data-centric security that packages encrypted content with its signed security metadata.