European Defence Compliance

Security frameworks for defence companies in Europe.

European defence security requirements are not defined by one certification. They combine cybersecurity, classified-information protection, quality assurance, product security, export controls and customer-specific contractual obligations. This page sets out which of them apply, and when.

Understand applicability Frameworks at a glance

Framework applicability depends on jurisdiction, contract, classification level and product scope. This content is informational and not legal advice.

§ 1Applicability

A layered requirement model.

There is no European equivalent to CMMC. Instead of one certification, the question is which layers apply at once, and which do not.

Jurisdiction

National rules apply where the entity and its operations are located.

Customer and contract

Defence ministries, primes, NATO and EU programmes can impose contractual controls.

Classification

National classified information, NATO classified information and EUCI require additional safeguards.

Product route

Defence-only, dual-use and commercial digital products can have different regulatory treatment.

Supply chain

Requirements commonly flow down to suppliers and subcontractors.

Cross-border delivery

Hosting, remote support, source code and technical data may trigger export-control and data-transfer requirements.

§ 2Overview

Frameworks at a glance.

None of these frameworks applies automatically to every company. The overview sets out what triggers applicability in each case.

Frameworks at a glance
Framework	Category	When it matters	Focus	Driver
ISO/IEC 27001	Information security management	Foundational baseline for most defence suppliers and frequently requested by customers.	ISMS governance, risk management, access control, supplier security, incident response and continuous improvement.	Core baseline
NATO AQAP	Defence quality assurance	NATO procurement or contracts that include AQAP requirements through a customer or prime contractor.	Design and production assurance, configuration control, traceability, supplier assurance and quality records.	Contract
NATO classified information	Industrial and classified security	Contracts involving NATO classified information.	Personnel and facility security, need-to-know, secure environments, secure communications and subcontractor controls.	Classification
EU Classified Information (EUCI)	EU programme security	EU institutional contracts and defence programmes, including European Defence Fund activities where security requirements apply.	Handling of EU classified information, programme-specific security instructions, personnel, physical and information security.	Programme
NIS2 and national implementation	Cybersecurity regulation	Depends on national implementation, entity type, activities and applicable defence and national-security exemptions.	Cyber-risk management, governance accountability, supply-chain security, incident handling and resilience.	Jurisdiction
EU Cyber Resilience Act (CRA)	Product cybersecurity	Digital hardware or software products placed on the EU market; assess defence-only exclusions separately from dual-use and commercial products.	Secure-by-design products, vulnerability management, support lifecycle, technical documentation and incident and vulnerability reporting.	Product
GDPR	Data protection	Personal data in workforce, supplier, customer, telemetry, testing and operational processes.	Personal-data processing, privacy by design, processor management, breach handling and international transfers.	Cross-cutting
Export controls and sanctions	Controlled technology and trade compliance	Cross-border transfer of controlled goods, software, source code, cryptography, technical data, remote support and know-how.	Classification, licensing, end-use and end-user checks, sanctions screening and controlled technical-data transfers.	Cross-border

§ 3Germany

Germany: additional requirements.

BSI IT-GrundschutzA detailed German security baseline that can complement ISO 27001 through structured security concepts, protection-need assessment and risk treatment.
VS-NfDWork involving VS-NUR FÜR DEN DIENSTGEBRAUCH may require controlled handling processes, need-to-know access, secure IT environments and contractual requirements that flow down to subcontractors.
Industrial securityGerman defence work can involve personnel, physical, organisational and information-security requirements under national industrial-security arrangements.

The applicable conditions must be confirmed with the contracting authority and the competent national authority before classified information is handled.

§ 4Approach

How requirements are determined.

Identify the organisation and its operating countries.
Review customer, contract and programme obligations.
Determine the classification regime and handling requirements.
Categorise products as defence-only, dual-use or commercial.
Assess supply-chain, hosting and cross-border delivery exposure.
Map applicable controls, evidence and remediation actions.

An effective defence compliance programme maps each requirement to a contract, a system boundary, a control owner and an auditable evidence record.

§ 5Baseline

What a practical baseline looks like.

Organisation and technology

Governance and ISMS
Asset and information classification
Identity, endpoint and network security
Secure software development and configuration control
Vulnerability management and incident response

Supply chain and evidence

Supplier and subcontractor assurance
Business continuity and resilience
Quality assurance and engineering traceability
Classified-information handling where required
Export-control and privacy governance

Controls become more stringent when classified information, restricted programmes, critical systems or cross-border controlled technology are involved.

§ 6Contact

Questions on defence regulation? Get in touch.

For a professional exchange on frameworks, contractual obligations and evidence in the defence sector, in English or German.

meyering@zoxai.de LinkedIn