infodas Data-Centric Security
(DCS).

Data-Centric Security places the data itself at the center of the security architecture. Especially in networked and interoperable environments, controlled and trustworthy data access is becoming a key factor for secure collaboration across security domains. Organizations are developing their architecture in stages — from clear data classification and policy-based access control to cryptographically protected data.

Cross-Domain Solutions (CDS) form the cornerstone of this architecture, ensuring that data-centric security policies are enforced and validated whenever information is transferred between security domains.

infodas. Driving Secure Data Sharing with Data-Centric Security.

infodas.
Enabling secure information sharing through Data-Centric Security.

Secure data.
Trusted collaboration.
Mission success.
Powered by infodas.

As digital operations become increasingly interconnected, mission success depends on the ability to securely share information across organizations, domains, and coalition partners. infodas enables this capability through advanced Data-Centric Security (DCS) solutions that protect mission-critical information wherever it is used, stored, or transmitted.

For more than five decades, infodas has been a trusted cybersecurity partner for defense organizations, government agencies, and critical infrastructure operators. Today, we play a leading role in advancing Data-Centric Security concepts and technologies in close collaboration with NATO, allied nations, and industry partners.

Modern operational environments extend far beyond traditional network boundaries. Sensitive information moves across private and public clouds, tactical networks, mobile platforms, and coalition systems. In these highly dynamic environments, perimeter-based security approaches are no longer sufficient.

infodas helps organizations transition to Zero Trust and Data-Centric Security architectures that keep protection attached directly to the data itself. Through classification-aware security controls, encryption, metadata tagging, and attribute-based access management, information remains protected throughout its entire lifecycle.

This enables organizations to securely share mission-critical data while maintaining full control over who can access it, under which conditions, and for how long.

Turning security policies into operational reality requires uncompromising enforcement. infodas bridges this gap by embedding Data-Centric Security policies directly into the gateway. Rather than relying on dynamic configurations, our solutions deliver deterministic policy enforcement between domains – acting as a trusted guardian of your data.

Organizations can protect sensitive information at domain boundaries while securely sharing mission-critical insights when and where they are needed.

As a recognized market leader in Cross-Domain Solutions (CDS), infodas enables secure information exchange between networks operating at different security classifications. Our solutions ensure that sensitive and classified information can be shared efficiently while maintaining strict compliance with NATO security standards and national regulations.

By combining Cross-Domain Solutions with Data-Centric Security principles, infodas creates trusted environments for secure collaboration across military commands, government agencies, and coalition partners.

At infodas, our mission is to enable secure digital operations without compromising security, interoperability, or mission effectiveness.

By advancing Data-Centric Security standards, delivering trusted Cross-Domain Solutions, and supporting NATO’s vision for secure information sharing, we help allied organizations strengthen cyber resilience, accelerate decision-making, and enable combined joint operations in an increasingly complex threat environment.

Get in touch with our DCS experts.

Contact us!

NATO Data-Centric Security Maturity Model.

A Structured Path to Secure Information Sharing Across NATO and Allied Operations.

The NATO Data-Centric Security (DCS) Maturity Model, defined within ACP-240, provides a strategic framework for protecting information throughout its entire lifecycle. As a key component of NATO’s Data Strategy and Digital Transformation Implementation Strategy, the model enables organizations to move beyond traditional perimeter-based security and adopt a modern, data-centric approach to information protection.

The DCS Maturity Model establishes a clear evolutionary path toward secure, interoperable, and policy-driven information sharing across multi-domain operations, coalition environments, and federated digital ecosystems.

Its core principle is simple: protect data at its source and maintain control over it wherever it travels.

  • DCS-1: Basic Labelling.

    Establishing Data Awareness and Control

    The first maturity level focuses on ensuring that all newly created information is properly labelled with mandatory handling instructions. These labels provide the foundation for all subsequent Data-Centric Security capabilities.

    Organizations implementing DCS-1 assign standardized metadata to data objects, including security classifications, releasability markings, and handling caveats. This creates a consistent understanding of how information must be protected and shared.

    Based on NATO STANAG 4774, DCS-1 introduces standardized confidentiality metadata labels that can be interpreted and enforced across systems and organizational boundaries.

    Key Capabilities:

    • Mandatory data classification and releasability labelling
    • Standardized confidentiality metadata according to STANAG 4774
    • Automated identification of unlabeled information
    • Quarantine and reporting of non-compliant data
    • Foundation for interoperable information sharing

    Business Value:

    DCS-1 creates visibility, accountability, and governance for mission-critical information while establishing the baseline for future Data-Centric Security capabilities.

  • DCS-2: Enhanced Labelling and Access Control.

    Enforcing Policy-Based Access Decisions

    At the second maturity level, organizations move beyond simple data classification and begin enforcing access decisions directly based on metadata and user attributes.

    This stage introduces Attribute-Based Access Control (ABAC) through Confidentiality Metadata-Based Access Control (CMBAC). Access requests are evaluated by comparing the security attributes of a user, device, or process against the metadata attached to the requested information.

    Instead of relying solely on network location or predefined trust zones, access is dynamically granted based on policy-driven security decisions.

    The implementation of DCS-2 is supported through the eXtensible Markup Language Security Policy Information File (XMLSPIF), enabling standardized policy exchange and enforcement across organizations.

    Key Capabilities:

    • Attribute-Based Access Control (ABAC)
    • Confidentiality Metadata-Based Access Control (CMBAC)
    • Dynamic authorization decisions based on security attributes
    • Policy-driven access enforcement
    • XMLSPIF-based security policy management
    • Improved interoperability across coalition environments

    Business Value:

    DCS-2 enables organizations to securely share information while maintaining fine-grained control over who can access specific data, under which conditions, and for which mission purposes.

  • DCS-3: Cryptographic Protection.

    Protecting Data Beyond the Perimeter

    The highest maturity level introduces persistent cryptographic protection directly at the data layer.

    At DCS-3, information is transformed into secure, encrypted Data-Centric Security objects. Security metadata is cryptographically bound to the data, and content is protected through end-to-end encryption and digital signing mechanisms.

    This approach ensures that information remains protected even when traditional security controls fail. If network boundaries are bypassed, devices are compromised, or files are copied to unauthorized locations, the data remains inaccessible to unauthorized users.

    Key Capabilities:

    • End-to-end encryption
    • Cryptographic metadata binding
    • Digital signing and integrity protection
    • Persistent protection throughout the data lifecycle
    • Secure data exchange across domains and organizations
    • Protection independent of infrastructure or network boundaries

    Business Value:

    DCS-3 delivers the highest level of information assurance by ensuring that security remains attached to the data itself, regardless of where it travels or how it is accessed.

Supporting NATO’s Digital Transformation.

The NATO Data-Centric Security Maturity Model is a foundational element of the Alliance’s transition toward a secure, federated digital ecosystem.

By implementing DCS capabilities, organizations can move from isolated and static information environments toward dynamic, interoperable architectures that support secure collaboration across military commands, government agencies, coalition partners, and mission networks. This transformation enables a shift from restrictive “need-to-know” models toward secure “need-to-share” information exchange, improving operational effectiveness while maintaining robust information protection.

How infodas supports DCS implementation.

infodas supports organizations transitioning to Zero Trust and Data-Centric Security architectures by enforcing security policies at domain boundaries. Its solutions validate classification-aware security labels, enable assisted metadata tagging, and ensure data protection during cross-domain information exchange.

Frequently asked questions about DCS.

Data-Centric Security does not primarily protect networks or systems, but rather the data itself. Protective measures are implemented directly on the data object – for example, through classification, security labels, policies, and cryptographic controls. As a result, security rules remain effective even when data crosses systems, security domains, or organizational boundaries. Unlike traditional perimeter-based approaches, this protection does not end at the network.

DCS typically uses Attribute-Based Access Control (ABAC). In this approach, access is determined not only by a user’s role, but also by contextual information such as data classification, device, location, or security level. Security labels are linked to the data, and policies define permitted usage. Enforcement points automatically enforce these rules as soon as data is accessed.

Implementation typically takes place in phases. A common starting point is a pilot project involving selected data flows. First, sensitive data is identified and classified; then, security labels are defined, and initial policies are created. Next, enforcement points are activated, and data flows are connected in a controlled manner. Monitoring, audit events, and governance processes ensure smooth operation and enable future scaling.

Governance is critical to ensuring that DCS functions effectively over the long term. Organizations must define which data classifications exist, which policies apply, and who manages them. Equally important are audit and reporting mechanisms that provide a clear record of who accessed which data and when. This not only supports compliance but also significantly improves the response to security incidents.

If systems or accounts are compromised, this does not automatically mean that attackers have access to actionable data. Since protective measures are applied directly to the data, access restrictions and cryptographic protection remain effective even outside the original infrastructure. This significantly reduces the potential damage caused by a security incident.

Open questions?

Contact our experts to schedule a personal consultation.

Contact.

News.

More news

Let’s get in touch!

Contact our cybersecurity experts. Together we will find a customized solution to protect your highly sensitive data.

Contact.