Match the Standard to the Contract and Risk
Start with the customer's specification and required evidence. AQAP publications concern quality assurance; they are not a universal equipment-performance specification. EN product tests and ISO management systems have different scopes. Confirm editions, acceptance criteria and any additional national or customer requirements before commissioning work.
🔐 Cybersecurity (InfoSec)
Use ISO/IEC 27001 to manage information-security risks within a defined scope. Classified information remains subject to the applicable security rules and authorisations.
🛡️ Physical Protection
EN 1063 concerns bullet-resistant glazing; EN 1522 concerns specified building openings. Component classifications do not establish whole-vehicle or whole-building protection.
🚛 Supply Chain Security
ISO 28000 provides a security-management framework, including supply-chain considerations. Its implementation does not eliminate tampering or disruption.
Essential Standards for Defence & Security
These are starting points for a specification review. They are not a compulsory package for every supplier or an assurance that a bid will be accepted:
| Standard | Title / Scope | Key Benefit |
|---|---|---|
| ISO/IEC 27001 | Information-security management system | Managing information risks within the stated scope. |
| AQAP 2110 | NATO quality assurance for design, development and production | Contractual requirements when invoked; confirm the specified edition. |
| ISO 28000 | Security management systems | Framework for managing security risks, including supply chains. |
| EN 1063 | Security glazing: testing and classification | Evidence for glazing under the standard's specified conditions. |
| EN 13123 series | Explosion resistance of windows, doors, shutters and curtain walling | Requirements and classification; select the appropriate part and test method. |
| ISO 22301 | Business-continuity management system | Planning, maintaining and reviewing continuity arrangements. |
Evidence to Check Before Contracting
Define what evidence the purchaser needs and what each report or certificate actually covers.
- Specification: Agree interfaces and acceptance criteria; a list of standards does not establish interoperability between complete systems.
- Procurement: Review the exact tender and contract. Distinguish management-system certification, AQAP obligations and product acceptance.
- Test evidence: Check the specimen, configuration, method and limitations. A successful test is not proof of protection against every operational threat.
- Information security: Verify the certificate scope and customer-specific controls. Keep security clearances and information-handling permissions separate.
📥 Access Official Defence Standards
Search the Genorma catalogue for relevant EN and ISO documents. Confirm the edition and licensing terms. Obtain required AQAP editions through the contracting authority or the relevant official publication source; catalogue availability is not assumed.
Frequently Asked Questions
What are AQAP standards?
AQAP means Allied Quality Assurance Publications. AQAP 2110 contains NATO quality-assurance requirements for design, development and production and invokes ISO 9001 with additional requirements. The contract determines which publication and edition apply, together with any quality plan or government quality-assurance arrangements. Do not treat an ISO 9001 certificate as automatic fulfilment of all AQAP obligations.
Is ISO 27001 mandatory for defence contractors?
There is no universal ISO/IEC 27001 requirement for every defence contractor. Check the tender, contract, information classification and relevant national security regime. A certificate concerns an information-security management system within its stated scope; it does not grant a security clearance or establish that breaches cannot occur.
How do standards help with EU Export Control?
Standards conformity does not confer an export authorisation. EU dual-use controls under Regulation (EU) 2021/821 require a separate assessment of items, technology, destination, end use and applicable controls. Military-goods controls and sanctions may also apply. Refer uncertain cases to the competent authority; a test report or management-system certificate does not replace that process.
Scope and Official Sources
Check the linked source and current document before commissioning work:
- ISO/IEC 27001 scope
- UK Ministry of Defence quality guidance and AQAP selection
- NEN: EN 1063 scope
- European Commission: dual-use export controls
For an initial discussion, choose specialist support and give only a non-sensitive outline of the required service. Do not send classified, export-controlled or security-sensitive technical material through a general enquiry form.
Explore Standards for Other Industries
Navigate to other key sectors to find relevant European and International standards.