NATO STANDARD

ACMP-2100

THE CORE SET OF CONFIGURATION

MANAGEMENT CONTRACTUAL
REQUIREMENTS
Edition A Version 2
MARCH 2017

NORTH ATLANTIC TREATY ORGANIZATION

ALLIED CONFIGURATION MANAGEMENT PUBLICATION

Published by the
NATO STANDARDIZATION OFFICE (NSO)
© NATO/OTAN
INTENTIONALLY BLANK
 NORTH ATLANTIC TREATY ORGANIZATION (NATO)

NATO STANDARDIZATION OFFICE (NSO)

NATO LETTER OF PROMULGATION

6 March 2017

1. The enclosed Allied Configuration Management Publication ACMP-2100, THE

CORE SET OF CONFIGURATION MANAGEMENT CONTRACTUAL
REQUIREMENTS, Edition A, Version 2, which has been approved by the nations in
the Life Cycle Management Group (AC/327) , is prornulgated herewith. The
agreement of nations to use this publication is recorded in STANAG 4427.

2. ACMP-2100, Edition A, Version 2 is effective upon receipt and supersedes

ACMP-2100, Edition A, Version 1 which shall be destroyed in accordance with the
local procedure for the destruction of documents.

3. No part of this publication may be reproduced, stored in a retrieval system,

used commercially, adapted, or transmitted in any form or by any means, electronic,
mechanical, photo-copying, recording or otherwise, without the prior permission of
the publisher. With the exception of commercial sales, this does not apply to member
or partner nations, or NATO commands and bodies.

4. This publication shall be handled in accordance with C-M(2002)60.

Edvardas MAZEIKIS
Major General, LTUAF
Director, NATO Standardization Office
RESERVED FOR NATIONAL LETTER OF PROMULGATION
 ACMP-2100

RESERVED FOR NATIONAL LETTER OF PROMULGATION

I Edition A Version 2
 ACMP-2100

INTENTIONALLY BLANK

II Edition A Version 2
 ACMP-2100

RECORD OF RESERVATIONS

CHAPTER RECORD OF RESERVATION BY NATIONS

Note: The reservations listed on this page include only those that were recorded at time of
promulgation and may not be complete. Refer to the NATO Standardization Document
Database for the complete list of existing reservations.

III Edition A Version 2

 ACMP-2100

INTENTIONALLY BLANK

IV Edition A Version 2
 ACMP-2100

RECORD OF SPECIFIC RESERVATIONS

[Nation] [detail of reservation]

Note: The reservations listed on this page include only those that were recorded at time of
promulgation and may not be complete. Refer to the NATO Standardization Document
Database for the complete list of existing reservations.

V Edition A Version 2
 ACMP-2100

INTENTIONALLY BLANK

VI Edition A Version 2
 ACMP-2100

TABLE OF CONTENTS

FOREWORD ........................................................................................................... VIII

CHAPTER 1 GENERAL ......................................................................................... 1

1.1. Purpose ........................................................................................................... 1
1.2 Composition of requirements in ACMP-2100 ................................................... 1
1.3 Applicability ...................................................................................................... 2
1.4 Compliance with this publication ...................................................................... 2

CHAPTER 2 REFERENCES .................................................................................. 3

2.1. Normative references....................................................................................... 3
2.2. Informative references ..................................................................................... 3

CHAPTER 3 TERMS AND DEFINITIONS.............................................................. 5

3.1. ISO 10007 Terms and Definition applies ......................................................... 5
3.2. Additional NATO terms, definitions and notes ................................................. 5

CHAPTER 4 REQUIREMENT FOR CONFORMANCE TO ISO 10007 .................. 7

4.1 Specific changes to the ISO 10007 wording .................................................... 7
4.2 General changes to the ISO 10007 wording .................................................... 7

CHAPTER 5 NATO SPECIFIC REQUIREMENTS ................................................. 9

5.1. Requirements for Sub-suppliers ...................................................................... 9
5.2. Configuration Management Planning ............................................................... 9
5.3. Product Configuration Information ................................................................... 9
5.4. Change Control ................................................................................................ 9

VII Edition A Version 2

 ACMP-2100

FOREWORD

Configuration Management (CM) is a critical process for NATO lifecycle

management. This publication defines the core CM requirements for Suppliers in all
lifecycle stages. It is a NATO adoption of ISO 10007:20031, supplemented by
additional NATO requirements in Chapter 5, and is entirely applicable in all NATO
programmes (thus denoted “core CM requirements”). If the requirements provided in
this publication are found insufficient to meet the actual needs for all Life Cycle
stages of the programme, further CM requirements may be defined and added to the
contract by using the corresponding guidance on CM.

This publication has been developed to provide Acquirers with means to contractually
invoke core Configuration Management requirements within NATO multinational joint
projects and National programmes during the product Life Cycle.

CM helps to assure that the product design will be consistent with the Acquirer’s
requirements and that product and system interfaces remain compatible; including
spares, test equipment, tools, ancillaries and supporting documentation. Effective CM
provides a framework to ensure that all users are kept informed of currently
approved/released configuration information.

Configuration management documents the product’s configuration. It provides

identification and traceability, the status of achievement of its physical and functional
requirements, and access to accurate information in all stages of the Life Cycle.

Configuration baselines are established by defining materiel, both functionally and

physically, by means of drawings, specifications and other relevant data and
documentation.

The term “product” in this publication should be interpreted as applicable to the

generic product categories; e.g., documents, facilities, firmware, hardware, software,
tools, materials, processes, services, systems.

Configuration Management (CM)2 applies appropriate processes and tools to

establish and maintain consistency between the product and the product
requirements and attributes defined in product configuration information. A
disciplined CM process ensures that products conform to their requirements and are
identified and documented in sufficient detail to support the product Life Cycle. CM
assures accurate product configuration information and enables product
interchangeability and safe product operation and maintenance to be achieved.

1 Whenever “ISO 10007” is used in this publication text, it refers to ISO 10007:2003.
2 Source: GEIA-HB-649

VIII Edition A Version 2

 ACMP-2100

CHAPTER 1 GENERAL

ACMP-2100 contains the NATO core set of contractual requirements for

Configuration Management. A system needs to be established, documented, applied,
maintained, assessed and improved, and/or evaluated, in accordance with
requirements contained in the subsequent sections.

1.1. Purpose

1. This publication contains the set of core CM requirements, which if applied

appropriately, can provide confidence in the Supplier’s capability to deliver products
that conform to Acquirer’s contract requirements.

2. The responsibilities and authorities for CM are at first outlined, before

describing the configuration management process that includes configuration
management planning, configuration identification, change control, configuration
status accounting and configuration audit.

1.2 Composition of requirements in ACMP-2100

1. The NATO requirement for an ISO 10007 based CM process and any
applicable changes or deletions of ISO content is defined in Chapter 4 of this
publication:

a. “Specific Change”: a change to one or more words, a sentence and/or

section of the ISO 10007 text (shown with italic letters).

b. “General Change”: a replacement of one or more words throughout the

ISO 10007 to turn the text into contractual requirement(s).

2. Additional NATO specific requirements are defined in Chapter 5 of this

publication.

1 Edition A Version 2
 ACMP-2100

1.3 Applicability

1. This publication is primarily intended for use in a contract between two or more
parties.

2. When referenced in a contract, this publication shall apply to all of the

processes necessary for the Supplier to fulfil the contractual requirements.

3. This publication may also be used internally by a Supplier or a potential Supplier

to cover the Configuration Management aspects of the Management System (MS).

4. Where identified by the Acquirer, this publication can be used in conjunction

with other appropriate standards to manage processes of the MS.

5. Order of precedence
If inconsistencies exist between the contract requirements and this publication, the
contract requirements shall prevail. In the event of a conflict between the text of this
publication and the references cited herein, the text of this document takes
precedence. Nothing in this document, however, supersedes applicable laws and
regulations unless a specific exemption has been obtained.

1.4 Compliance with this publication

1. Compliance with this publication for a contract is defined as the fulfilment of

the requirements of Chapters 4 and 5.

2. In this publication, NOTEs are not contractual requirements.

2 Edition A Version 2
 ACMP-2100

CHAPTER 2 REFERENCES

2.1. Normative references

The following referenced documents are indispensable for the application of this
publication. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.

1. ISO 9000 Quality management systems

– Fundamentals and vocabulary

2. ISO 10007:2003 Quality management system

– Guidelines for configuration management

2.2. Informative references

1. STANAG 4427 Configuration Management in System Life

Cycle Management

2. ANSI/EIA-649 Configuration Management Standard

3. MIL-HDBK-61 Military Handbook, Configuration Management

Guidance

4. DEF STAN 05-57 Configuration Management of Defence

Material

5. prEN 9223 part Programme Management – Configuration

Management
100 through 105

3 Edition A Version 2
 ACMP-2100

INTENTIONALLY BLANK

4 Edition A Version 2
 ACMP-2100

CHAPTER 3 TERMS AND DEFINITIONS

3.1. ISO 10007 Terms and Definition applies

3.2. Additional NATO terms, definitions and notes

1. Concession
NOTE A:
Concessions are not to be confused with approved alternates or substitutes, which are in the
configuration baseline.

2. Dispositioning Authority
NOTE A:
NATO considers the Dispositioning Authority to be a person who may be supported by a CCB, which is
not mandatory unless stated in the contract.

3. Acquirer
A governmental or NATO organization that defines the requirements for the delivery of a
product by a supplier and enters into a contractual relationship with that supplier.

Note:
The acquirer is often known by a variety of names like owner, buyer, stakeholder,
requirer, project management office, purchaser, customer, etc.

4. Product
Examples: document; facility; firmware; hardware; software; tool; material; process;
service; system.

5. Release
A configuration management action whereby a particular version of a product or product
configuration information is made available for a specific purpose.

6. Supplier
An organization that acts in a contract as the provider of products to the acquirer.

Notes:
The supplier is often known by a variety of names like contractor, producer, seller, or
vendor.
Sometimes the acquirer and the supplier are part of the same organization.

5 Edition A Version 2
 ACMP-2100

INTENTIONALLY BLANK

6 Edition A Version 2
 ACMP-2100

CHAPTER 4 REQUIREMENT FOR CONFORMANCE TO ISO 10007

A Configuration Management system shall be established, documented, applied,

maintained, assessed and improved, and/or evaluated, in accordance with ISO
10007, incorporating the following changes to the ISO 10007.

4.1 Specific changes to the ISO 10007 wording

Changes shown with italic letters.

ISO 10007 paragraph 5.2 Configuration management planning

- Change last line to:
Annex A of ISO 10007 describes a potential structure and content for a
configuration management plan, and is only informative.

ISO 10007 paragraph 5.3.2 Product configuration information

- Change first paragraph to:
Product configuration information comprises both product definition and
product operational information. This typically includes requirements,
specifications, design drawings, parts lists, software documents and listings,
models, markings, audit information, effectivity, test specifications,
maintenance and operating handbooks.

4.2 General changes to the ISO 10007 wording

Whenever the ISO 10007 uses the word “should” or “may” in section 4 and 5,
it is to be read as “shall”, and compliance by the Supplier is mandatory, unless
otherwise determined by the Acquirer.

Whenever the ISO 10007 uses the phrase “Life Cycle of the product”, it is to
be read “contract”.

7 Edition A Version 2
 ACMP-2100

INTENTIONALLY BLANK

8 Edition A Version 2
 ACMP-2100

CHAPTER 5 NATO SPECIFIC REQUIREMENTS

5.1. Requirements for Sub-suppliers

1. The Supplier shall consign the applicable contractual configuration

management requirements to its Sub-suppliers by referencing the stated contractual
requirement.

2. The supplier shall ensure that the procedures and processes required to fulfil
contract requirements are fully implemented at the sub-suppliers facilities.

5.2. Configuration Management Planning

1. The Supplier shall provide access to the Configuration Management Plan

(CMP) to the Acquirer.

2. The Acquirer reserves the right to reject the CMP.

3. The Supplier shall define the CM organization and its relation to the overall
organization in the CMP.

5.3. Product Configuration Information

1. As a minimum, for each CI, the Supplier shall develop and maintain
configuration information.

2. As a minimum the Supplier shall include the NCAGE in the information related
to the CI(s).

3. The Supplier shall only use configuration information that has been formally
released.

4. Configuration Information shall take into account any access limitations; as a

minimum, Security classifications and proprietary license constraints.

5.4. Change Control

1. The Supplier assumes total risk for the implementation of changes

incorporated prior to approval by the Dispositioning Authority.

9 Edition A Version 2
ACMP-2100(A)(2)