Key takeaways
- Modern access control decides who can open a file by reading the label on it. If the label is missing or wrong, the system makes the wrong call automatically, every time.
- DoD’s Zero Trust deadline (end of fiscal 2027), ACP 240, and NATO’s Federated Mission Networking Spiral 5 all assume files carry accurate, machine-readable labels. For coalition networks, reliable labeling is now a condition of participation.
- Most label problems are ordinary: files nobody labeled, markings typed by hand with small errors, labels lost when data is copied or migrated, and labels that can be changed without anyone knowing.
- Fixing this is a program decision, not only a technology purchase. It needs an inventory of what is unlabeled, a labeling tool that gets markings right at creation, and storage that keeps labels attached and records every change.
Every classified or controlled file carries a marking: SECRET, CUI, REL TO USA, GBR, AUS, NOFORN. For decades those markings were instructions for people. Under Zero Trust and coalition data sharing, they become instructions for machines. The system reads the label, compares it to who is asking, and opens the file or keeps it closed, with no person in the loop.
That is a large gain in speed and consistency, and it carries a risk that is easy to miss. The system enforces whatever label it finds. If a file is marked too restrictively, an allied partner who needs it never sees it. If a file was never labeled, it may sit open to everyone who can reach the folder. Neither failure produces an alarm, because from the system’s point of view it did exactly what it was told.
DoD leadership has acknowledged the size of this problem. In 2024, Randy Resnick, director of the Zero Trust Portfolio Management Office, described tagging and labeling as a long-term challenge for the department, according to Defense News. In most programs the obstacle is not the lack of a tool. It is the condition of the labels on the data already in use, and whether new labels stay accurate once they are applied. That condition is what this guide calls metadata hygiene.
What the standards expect
Three sets of requirements meet on this question, and a manager does not need to read the specifications to understand what they ask for.
The DoD Zero Trust Strategy requires components to reach Target Level by the end of fiscal 2027, which began on October 1, 2026. Within the data pillar, three Target Level activities concern labels directly: 4.2.1 sets enterprise tagging standards, 4.3.1 deploys tagging and classification tools, and 4.3.2 begins manual tagging of data.
NATO’s STANAG 4774 and STANAG 4778 make labels work across national systems. STANAG 4774 sets a common format, so a marking means the same thing to every system that reads it. STANAG 4778 sets how the label is attached to the file so that the two cannot drift apart.
ACP 240, an Allied Communication Publication developed under the Combined Communications-Electronics Board, is the coalition standard that brings these together. It has been adopted by the Five Eyes nations and NATO, is being implemented by the U.S. Joint Chiefs of Staff, and relies on STANAG 4774 and 4778 for its labels. It is already in operational use: it governed data sharing across the mission partners in the United Kingdom’s Operation HIGHMAST carrier strike group deployment. NATO Federated Mission Networking Spiral 5 makes ACP 240’s Data-Centric Security Maturity Level 2 a precondition for participation. In practical terms, that level means files are reliably labeled, labels stay attached for the life of the file, and access is decided by the label. Label quality has become an entry requirement for coalition networks.
| Requirement | What it means in practice | What to ask your team |
|---|---|---|
| DoD Zero Trust activities 4.2.1, 4.3.1, 4.3.2 | One labeling standard, tools to apply it, and labels on existing data by the end of FY2027 | Do we have a single labeling standard, and how much of our current data meets it? |
| STANAG 4774 | A common label format every allied system can read | Are our markings machine-readable, or typed by hand? |
| STANAG 4778 | Labels stay attached to the file | Do labels survive copies, backups, and migrations? |
| ACP 240 and FMN Spiral 5 | Coalition sharing decided by labels, with a record of every access | Could we show which partner opened which file, and why they were allowed to? |
Where labels usually go wrong
Files that were never labeled. New files often sit in shared folders for a time before anyone classifies them, and older shares can hold years of material that never was. During that gap, a conventional file server shows the file to anyone with folder access, which is the exposure the label was supposed to prevent.
Markings typed by hand. A single slash where a double slash belongs, a caveat abbreviated three different ways, or a header nobody updated after an edit. A person reads past these. A machine either rejects the file or misreads it.
Labels lost along the way. Some copy, archive, and backup tools carry the file but not its label. The document arrives intact; its classification does not.
Labels applied too broadly. One label on an entire folder of mixed material is wrong for most of what is inside. Documents have their own rule: one NOFORN paragraph makes the whole document NOFORN, and manual processes miss that more often than programs expect.
Labels that can be changed quietly. If a label can be lowered without leaving a record, a downgrade looks like a correct label the next time someone asks for the file.
What a sound cleanup program looks like
Start by measuring the problem. Ask for a report, not a spreadsheet project: how many files carry no label, how many carry labels a machine cannot read, and where labels disagree with the program or folder they belong to. That number sets the size of the effort and gives leadership a baseline to track against the FY2027 deadline.
Then fix labels at the source. A labeling tool that builds markings from a central policy, and only offers each author the markings their role and clearance allow, stops new errors from being created. Next, make sure the storage keeps labels attached through copies, backups, and replication, and does not show a new file to others until it has been labeled. Finally, treat any change to a label as a security event that is recorded, and keep a record of every access decision. That record is the evidence auditors, inspectors general, and coalition partners will ask for.
How RackTop and Janusnet approach it
RackTop has partnered with Janusnet on this problem. Janusnet’s Janusseal works inside Microsoft Word, Excel, PowerPoint, Outlook, and File Explorer. It guides authors to the correct marking, applies the visible banner and paragraph markings, works out the overall classification of the document, and writes a STANAG 4774/4778 label into the file.
When that file is saved to RackTop BrickStor SP, the storage keeps the label attached to the file, including in snapshots and replicated copies, and records any change to it. Before a file opens, BrickStor SP checks the folder permissions and then compares the label against the person asking: their clearance, their nationality, and any special access the file requires. A file with no label is visible only to the person who created it until it is classified. A file a user is not cleared to see does not appear in their folder at all, so a partner cannot learn that it exists by trying to open it. Because a cleared insider can still misuse access, BrickStor SP also watches for unusual patterns, such as one account suddenly reading hundreds of files, and every action is written to an audit log that cannot be altered.
This works alongside, not instead of, the Zero Trust Data Format, the encrypted wrapper ACP 240 specifies for files that leave a controlled network. That wrapper suits data crossing a boundary. It is a poor fit for a document being edited by a team or a large imagery set being reviewed, which is where storage-level enforcement does the work. Neither replaces the judgment of the people who decide what a document is. Good hygiene is what lets the systems carry out that judgment reliably.
Frequently asked questions
- Metadata hygiene means keeping the security labels on data present, accurate, consistently formatted, and attached to the files they describe. It includes finding unlabeled files, standardizing how markings are written, making sure labels survive copies and migrations, and recording every change to a label. Automated access control depends on it, because the system trusts whatever label it reads.
- STANAG 4774 sets a common, machine-readable format for classification and releasability labels, so every allied system interprets a marking the same way. STANAG 4778 sets how that label is attached to a file so the two stay together and the label cannot be separated from the content it describes.
- It is the level in the ACP 240 maturity model at which files are reliably labeled, labels stay attached for the life of the file, and access is decided at the data itself using each user’s attributes, such as clearance and nationality. NATO Federated Mission Networking Spiral 5 makes it a precondition for participation. Higher levels add encrypted wrappers that carry the access policy with the file.
- No. ACP 240 specifies the Zero Trust Data Format for files that leave a controlled environment. For files in daily use inside the environment, labels kept attached by the storage and checked on every access meet the same intent without wrapping and unwrapping the file each time it is saved. The two approaches use the same labels and work together.
- Activities 4.2.1, 4.3.1, and 4.3.2 in the DoD Zero Trust roadmap set labeling standards, deploy labeling tools, and begin labeling existing data, all due at Target Level by the end of fiscal 2027. Much of the data in scope is documents on shared drives, so the storage serving those files has to keep labels attached and enforce them.
Sources
Go deeper