Europe is buying. At the Hague Summit in June 2025, NATO allies committed to spend 5% of GDP on defense and security by 2035, with up to 1.5% earmarked to protect critical infrastructure, “unleash innovation, and strengthen our defence industrial base.” The European Commission’s ReArm Europe/Readiness 2030 plan aims to unlock more than €800 billion in defense spending, including €150 billion in joint-procurement loans. A growing share of that money will buy software: command and control, logistics, AI-enabled analysis, and cyber defense.

For a defense independent software vendor (ISV), that demand comes with a catch: accreditation does not travel. An Authority to Operate (ATO) earned in the United States or any particular body-specific scheme carries no formal weight with the UK Ministry of Defence (MOD), a German federal agency, or a NATO body. Each market has its own accreditor, its own classification scheme or approval route, and its own definition of “sovereign.” Vendors that treat every border as a fresh compliance build spend months and serious capital before a single new user logs in.

The frameworks differ, but the questions accreditors ask are converging. This guide explains what the UK, the European Union, and NATO each require, where those requirements overlap, and how an ISV can build its compliance architecture once and deploy it many times.

Sovereignty is the question behind every accreditation

“Sovereignty is not just about where a technology is designed or produced, but more importantly, it is about a nation’s ability to conduct its functions without external interference,” says Second Front CEO Tyler Sweatt. Whatever the framework is called, that is the question UK, EU, and NATO accreditors are asking.

Many vendors reduce sovereignty to data residency: keeping bytes inside a border. Residency is only one test. In practice, accreditors look for four kinds of control, and a gap in any one of them can stall an approval:

• Data sovereignty. Customer content stays under the host nation’s physical or logical control, and so does the metadata: logs, telemetry, identity records, and configurations. Telemetry quietly streaming to a global monitoring service is a common failure point.
• Operational sovereignty. Cleared nationals or residents run and support the system. “Follow-the-sun” support fails this test, because a ticket routed to another time zone can expose systems to uncleared staff abroad. The strongest form is a customer that can run the platform without the vendor’s engineers.
• Legal sovereignty. The operating entity is incorporated in the host jurisdiction, so legal sovereignty depends on the operating entity’s jurisdiction and exposure created by ownership/control of the data. Accreditors increasingly ask whether a parent company’s home-country laws can reach the data anyway.
• Supply chain sovereignty. Nearly every modern system contains non-sovereign components. Accreditors want a clear map of them and a reasoned case for where the risk is acceptable, not a fully domestic bill of materials that almost no one can deliver.

None of this requires software built entirely in one country. The real objective is sovereign freedom of action: the ability to employ a capability when and where it is needed. Designing for all four tests from day one is what lets one architecture satisfy several accreditors.

United Kingdom: from one-time accreditation to evidence-led assurance

The UK no longer accredits defense systems in the traditional sense. In July 2023, the MOD replaced its old accreditation model with Secure by Design, which makes each program team own its cyber risk “from concept to disposal.” For an ISV, that means evidence that keeps flowing long after the contract is signed.

Know your tier. The Government Security Classifications Policy has three tiers: OFFICIAL, SECRET, and TOP SECRET. OFFICIAL covers most public-sector information. OFFICIAL-SENSITIVE is not a separate tier but a marking for OFFICIAL information of interest to threat actors, such as procurement data or logistics planning, and it is where much commercial defense software lands.

Three frameworks shape the evidence:

1. JSP 453. Digital Policies and Standards for Defence is the MOD’s rulebook for digital services. The MOD’s Defence Technology Principles tell teams to follow its security rules alongside seven Secure by Design principles, from context and risk assessment through supply chain, security testing, and through-life management.
2. NCSC principles. The NCSC’s secure design principles ask designers to make compromise difficult, make disruption difficult, make compromise easy to detect, and reduce its impact. Cloud hosting is judged against the NCSC’s 14 Cloud Security Principles, from data-in-transit protection to personnel and supply chain security.
3. Evidence-Led Assurance. The MOD’s Evidence-Led Assurance methodology moves software assurance away from “stage gates, static artefacts, periodic reviews and manual approvals.” Signals from build, test, deployment, and runtime systems become evidence for explicit assertions, and accountable owners decide based on their confidence in that evidence. It does not replace Secure by Design; it is how teams demonstrate it, because, as the paper puts it, “evidence is perishable.”

Sovereign operations. UK sovereign cloud offerings built for OFFICIAL-SENSITIVE workloads typically use onshore data centers with Police Assured Secure Facilities (PASF) accreditation, run only by UK citizens resident in the UK who hold Security Check (SC) clearance. Oracle’s UK Sovereign Cloud follows this model. Google’s new Secure Community Cloud, built for the MOD under a £400 million contract awarded in September 2025, runs on air-gapped Google Distributed Cloud and keeps data in UK sovereign territory under MOD control.

Where Second Front fits. Evidence-Led Assurance rewards ISVs whose delivery pipeline produces evidence automatically, and Game Warden already does: hardened containers, continuous vulnerability scanning, software bills of materials, centralized logging, and managed remediation tracking, all in machine-readable form. Second Front is now actively supporting ISVs with both the British Army and the Royal Navy.

The takeaway: in the UK, assurance is becoming a live data feed rather than a document set, and the ISVs whose pipelines generate that evidence will move fastest.

European Union: one market, many accreditors

There is no single EU accreditor for defense software. National security remains a national responsibility, so an ISV selling into Germany, France, or Spain answers to each country’s own authority. What the EU adds is a growing layer of common rules and procurement criteria on top.

National schemes set the bar. Buyers benchmark against Germany’s BSI C5 catalog, France’s ANSSI SecNumCloud qualification, or Spain’s Esquema Nacional de Seguridad (ENS), alongside EU-wide rules such as the NIS2 Directive.

EUCS is still coming. ENISA’s draft EU Cybersecurity Certification Scheme for Cloud Services (EUCS) would give cloud services one certificate, at basic, substantial, or high assurance, recognized across the EU. It stalled after member states split over sovereignty requirements, which were dropped from the draft in March 2024, and the Commission’s January 2026 revision of the Cybersecurity Act aims to restart it by giving ENISA 12 months to prepare each scheme. Until EUCS is final, national schemes such as C5 and SecNumCloud remain core evidence buyers accept.

EU-level rules are tightening:

• The Cyber Resilience Act places security obligations on software sold in the EU. Vulnerability reporting began on 11 September 2026, and full requirements apply from 11 December 2027. Article 2(7) exempts products built exclusively for defense or classified use, but most dual-use commercial software is in scope.
• Sovereignty is becoming a procurement score. The Commission’s Cloud Sovereignty Framework rates cloud offerings against eight sovereignty objectives on a 0–4 scale, and buyers will likely reject offers that miss the minimum on any one. The proposed Cloud and AI Development Act (June 2026) would go further: defense and other sensitive public bodies could use only services independently audited at level 2 or higher, and non-EU providers would need at least level 3.
• Funding rewards European content. Under the €150 billion SAFE loan instrument, at least 65% of component costs must originate in the EU, Ukraine, or eligible EEA-EFTA countries.

Sovereign infrastructure has arrived. The AWS European Sovereign Cloud reached general availability in January 2026 in Brandenburg, Germany. It is separate from AWS’s other Regions, run by German-incorporated entities, and operated exclusively by EU residents, and customers can keep all the metadata they create, from roles and permissions to resource labels, inside the EU. An independently validated Sovereignty Reference Framework (ESC-SRF) gives customers an auditor’s report to hand to their own assessors.

Infrastructure is only half the answer. The application layer, including the delivery pipeline, container hardening, logging, and support access, has to pass the same tests. In December 2025, Second Front announced ten customers prepared to deploy on the AWS European Sovereign Cloud through Game Warden, inheriting controls instead of building a sovereign delivery pipeline from scratch.

Audit is the other half. Second Front has partnered with several independent assessors that perform BSI C5 attestations, for audit support, and already holds a C5 Type 1 attestation. ISVs deploying through Game Warden start with that evidence in hand instead of commissioning it from scratch.

NATO: a shared baseline across 32 allies

NATO is the hardest market to model because it is not one buyer. It is 32 sovereign nations plus Alliance bodies such as the NATO Communications and Information Agency (NCIA) and the Defence Innovation Accelerator for the North Atlantic (DIANA), each with its own security boundaries and procurement rules.

Accreditation is delegated. For NATO RESTRICTED, the Alliance’s lowest classification level, NATO delegates accreditation to a member nation or to the NCIA as host. NATO’s D32 directive sets the technical requirements for handling that information in the public cloud. Historically, each nation assessed a cloud on its own before workloads could move, so a vendor serving five allies could face five reviews.

That is starting to change. In September 2026, AWS became the first cloud provider approved for NATO RESTRICTED workloads across all member nations. AWS documented its compliance with D32, Spain’s National Cryptologic Centre (CCN) evaluated it, and NATO published the approval to every ally. Built on the AWS Trusted Secure Enclave, Sensitive Edition (TSE-SE) architecture, it covers all 15 AWS Regions in member nations.

National accreditation still applies, but allies now start from a common, pre-assessed baseline. That baseline does not accredit the software running on it, though; the application layer still needs its own path.

That is where delivery experience counts. In May 2026, DIANA granted Second Front an ATO for NATO UNCLASSIFIED, and Game Warden deployed a DIANA-built learning management system, including data and user migration, into DIANA’s cloud in 17 days. “Speed matters when delivering digital capability across the Alliance,” said Martin Langran, DIANA’s Head of Security. Second Front is building on that work to support ISVs moving into NATO RESTRICTED environments on the new baseline.

Three markets at a glance

The three markets ask similar questions through different authorities.

Six steps to build once and deploy many times

The ISVs that scale fastest across allied markets treat accreditation as architecture, not paperwork. Six practices make the difference:

1. Pin down the classification tier or approval route first. For each market, identify the tier your software will touch: OFFICIAL-SENSITIVE, NATO RESTRICTED, a national scheme or approval route such as C5. This dictates hosting, personnel, and evidence, so determine information assurance requirements before a pilot turns into a contract.
2. Build a reusable control baseline, with hosting and operational access configured for each target deployment. Keep metadata, logs, and telemetry in-country, and let only cleared local staff touch production. Do that and you pass most sovereignty tests at once; retrofitting after an accreditor finds the gap costs far more.
3. Separate the application from the platform. Accreditors assess the whole stack, but you don’t have to build all of it. Inheriting hosting, network, identity, and pipeline controls from a pre-accredited platform leaves you accountable mainly for your application’s own controls.
4. Produce evidence continuously, then map it. Most frameworks ask overlapping questions in different formats, and the UK now wants the answers live. Generate evidence from your pipeline, including scans, test results, SBOMs, and runtime monitoring, then map it to each framework instead of rewriting it.
5. Get your own house in order. Platform inheritance doesn’t cover company-level obligations. If your product sells in the EU, Cyber Resilience Act vulnerability reporting already applies, and full requirements, including CE marking, follow in December 2027.
6. Invest locally. Sovereign operations need cleared people in-country, and European funding increasingly rewards European content. A local team or partner shortens every accreditation conversation.

Inherit, don’t rebuild

The UK, the EU, and NATO will keep their own accreditors, and they should: sovereignty is the point. But the perimeter around allied defense software is standardizing, not softening, and pre-assessed baselines like the AWS European Sovereign Cloud and the NATO-wide RESTRICTED approval mean the hardest infrastructure work is increasingly done once, for everyone.

The remaining work sits in the delivery layer, and that is what 2F Game Warden provides. Game Warden lets ISVs reuse platform controls and deployment evidence across supported environments, providing a pre-accredited path that carries the hosting, pipeline, and operational controls each market demands, so moving from one accreditation to the next doesn’t mean starting over. Second Front leads this work from the Netherlands and the United Kingdom.

“We’re investing in the UK and Europe because strengthening sovereign digital capability, including the software engineering and cybersecurity jobs and the skills to support them, is essential to ensuring security and deterrence across our allies,” says Enrique Oti, Second Front’s Chief Strategy Officer.

Learn more about scaling across allied markets in our upcoming Inside the ATO webinar, Sovereign tech, Allied scale. Or talk with our team about mapping your deployment path across the UK, the EU, and NATO onto Game Warden.