3GPP 5G Security Architecture (TS 33.501)
Security for NAS and AS Protocols

3GPP 5G Security Architecture (TS 33.501) TS33.501-6.6: AS Security

RRC and UP security over air interface including ciphering and integrity protection

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 78 controls across 35 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

FedRAMP Rev 5 · 3 controls

  • FEDRAMP-SC-13 Cryptographic Protection
  • FEDRAMP-SC-28 Protection of Information at Rest
  • FEDRAMP-SC-8 Transmission Confidentiality and Integrity

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

  • AWWA-3.2 Remote Access Security
  • AWWA-3.4 Encryption and Data Protection

FBI CJIS Security Policy · 2 controls

  • CJIS-8 Media Protection
  • CJIS-9 System and Communications Protection

ISO 27799:2025 · 2 controls

  • ISO27799-02 ePHI encryption at rest and in transit
  • ISO27799-16 Transmission security and encryption

ISO/IEC 27043:2015 · 2 controls

  • ISO27043-17 Encryption of data at rest
  • ISO27043-18 Encryption of data in transit

ISO/SAE 21434 · 2 controls

  • ISO21434-17 Encryption of data at rest
  • ISO21434-18 Encryption of data in transit

NIST SP 800-53 Rev 5 · 2 controls

US ITAR and EAR - Export Control and Data Security · 2 controls

  • US-ITAR-EAR-DS-01 Technical Data Protection
  • US-ITAR-EAR-DS-02 Cloud and Storage

APPI · 1 control

  • APPI-A34 Request for Correction, Addition or Deletion

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-17 TLS encryption between email servers (Limited)

BSI IT-Grundschutz · 1 control

  • BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

FFIEC IT Examination Handbook · 1 control

  • FFIEC-09 Encryption and key management

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-9 Cyber security key management

ISO/IEC 27400:2022 · 1 control

  • 27400-6.2 Device Identity and Authentication

NIST SP 800-187 · 1 control

NIST SP 800-190 · 1 control

PCI P2PE · 1 control

  • PCI-P2PE-09 Encryption and key management

PCI PIN Security · 1 control

  • PCI-PIN-09 Encryption and key management

PCI SSF · 1 control

  • PCI-SSF-09 Encryption and key management

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

  • SOC-CY-C2 Encryption and Data Protection

Saudi Arabia PDPL · 1 control

  • SA-PDPL-13 Encryption of personal data

Sigstore - Software Artifact Signing and Verification · 1 control

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-CLD.2 Cloud Security Controls

South Korea ISMS-P · 1 control

  • ISMSP-SYS-02 Encryption Implementation

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

TISAX - Trusted Information Security Assessment Exchange · 1 control

Taiwan PDPA · 1 control

  • TAIWAN-2 Consent, Notice, Sensitive Data

Texas Data Privacy and Security Act (TDPSA) · 1 control

  • TEXASTDPSA-2 Consumer Rights

UK Open Banking Standard · 1 control

  • OB-SEC.2 Transport Layer Security

Uruguay DPL · 1 control

  • URUGUAY-3 Sensitive Data, Health Data, Children

Virginia CDPA · 1 control

  • VIRGINIAVCDPA-2 Consumer Rights

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Security for NAS and AS Protocols

Query this from an agent

The graph holds this control, the 78 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll 3GPP 5G Security Architecture (TS 33.501) controls