NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) 4778-3.2: Choose encapsulating, embedded or detached binding and cryptographic protection to the required assurance

3.1 to 3.4: a binding takes the data object and metadata as input and outputs their association; policy or operational need may require cryptographic protection, producing a cryptographic artefact within the binding. Three approaches exist, usable in combination: encapsulating (the binding becomes a new composite object holding data and metadata), embedded (the binding sits inside the data object and references it) and detached (binding kept apart and linked by reference to the data, the metadata, both, or the cryptographic artefact). The set of metadata, data (or references) and any artefact is the Binding Information, whose structured form is called a Binding Data Object (BDO); a dedicated BDO is recommended for each frequently accessed independent data object for efficient lookup, stable BDOs, resilience to denial of service and efficient verification.