Trust & Compliance / ACP 240
ACP 240
Share data with allies without giving up control.
ACP 240 is the allied standard for data-centric security, and it specifies the Zero Trust Data Format (ZTDF) — a way to package each file or message with its security labels, access policy and encryption. XQ puts it into practice: data is wrapped in ZTDF / TDF-compliant objects, each partner holds its own key authority, and access is decided per object from identity, clearance and mission attributes.
Built for Allied defense and intelligence organizations · Coalition and joint mission planners · Defense suppliers and integrators building ACP 240 systems
At a glance
PublicationAllied Communications Publication 240
SponsorCCEB — Australia, Canada, New Zealand, UK, US
Data formatZero Trust Data Format (ZTDF), built on TDF
XQ coversZTDF wrapping, ABAC, Multi-KAS keys, audit
Works with Email · File shares · Collaboration tools · AWS GovCloud · Azure Government · Disconnected edge
Share across borders
Labels and policy travel inside each data object, so partners can use it without a shared network.
Keep sovereign keys
Each nation, agency or partner runs its own key access service and never hands over its keys.
Revoke and audit
Withdraw any partner’s access to any object, and log every access across coalition boundaries.
What ACP 240 defines
Allied Communications Publication 240 sets out data-centric security for sharing information among allies: protect the data itself, not just the networks it crosses. It is sponsored by the Combined Communications-Electronics Board (CCEB) of the Five Eyes nations and is being adopted by the U.S. Joint Chiefs of Staff; NATO nations need a separate directive to activate it.
At its core is the Zero Trust Data Format, specified in the publication’s supplements. A ZTDF object cryptographically binds three things to its payload:
- Security metadata, including confidentiality labels and release markings — carried using NATO STANAG 4774 labels and STANAG 4778 metadata binding.
- Key access information that tells an authorized recipient where to obtain the decryption key.
- An access control policy stating the attributes a user must have to open it.
How XQ maps to ACP 240
| ACP 240 capability | How XQ helps |
|---|---|
| ZTDF data objects | Files, messages and records are wrapped in ZTDF / TDF-compliant objects that carry their classification, policy and metadata. |
| Classification and release markings | XQ maps national and alliance classification schemes so policy is enforced consistently when data crosses borders. |
| Attribute-based access control | Decryption happens only when the attributes of the user (identity, role, clearance, nationality), of the data object (its ZTDF classification and releasability labels), of the requested action and of the environment (location, device, mission context) satisfy the object’s policy. |
| Sovereign key management | XQ’s Multi-KAS architecture lets each nation or partner hold its own keys, on its own infrastructure or an external key store. |
| Disconnected operations | Data can be wrapped and policy enforced offline at the tactical edge, then synchronized securely when connectivity returns. |
| Audit and accountability | Every access, grant and revocation is logged across organizational and coalition boundaries. |
Designing a coalition or cross-domain sharing architecture?
Built into mission applications
XQ’s SDKs, APIs and policy enforcement points let developers add ZTDF protection to email, file sharing and legacy or mission-specific applications, so ACP 240 policy is enforced where people already work rather than in a separate portal.
Who ACP 240 applies to
ACP 240 applies first to the defense organizations of the CCEB nations, and to coalition partners and suppliers that exchange sensitive or classified information with them — operational intelligence, mission files, email and collaboration documents that cross command and national boundaries.
Related resources and articles
FAQ
ACP 240, answered directly.
What is ACP 240?
Allied Communications Publication 240 is the allied standard for data-centric security. Sponsored by the Combined Communications-Electronics Board of the Five Eyes nations, it specifies the Zero Trust Data Format so sensitive data can be shared securely across nations and systems.
Is ACP 240 a NATO standard?
No. ACP 240 is a CCEB publication for Australia, Canada, New Zealand, the United Kingdom and the United States. NATO nations need a separate directive to activate it, though ZTDF carries NATO STANAG 4774 labels and STANAG 4778 metadata bindings.
What is the Zero Trust Data Format?
ZTDF packages a file or message with its security labels, key access information and access policy, all cryptographically bound to the encrypted payload. It is built on the open Trusted Data Format (TDF).
How does XQ support ACP 240?
XQ wraps data in ZTDF / TDF-compliant objects, enforces attribute-based access on every decryption, lets each partner keep its own key authority through Multi-KAS, and logs every access across coalition boundaries.
Can ACP 240 protection work offline?
Yes. XQ can wrap data and enforce policy in disconnected, degraded or intermittent environments at the tactical edge, then synchronize keys and policy when connectivity returns.
Can ACP 240 protection be added to existing applications?
Yes. XQ’s SDKs, APIs and policy enforcement points let developers add ZTDF protection to email, file sharing and legacy or mission-specific applications, so policy is enforced where people already work rather than in a separate portal.
Share with allies. Keep control.
Request a briefing on putting ACP 240 and ZTDF into practice for your mission.