Maintain the O-RAN threat model and risk management per O-RAN Alliance WG11 Security Threat Model and Risk Assessment specifications. The threat model must (a) enumerate threat actors targeting O-RAN deployments (nation-state attackers + criminal organisations targeting telecom + insiders with operator or vendor access + compromised vendors + supply-chain attackers), (b) catalogue attack surfaces specific to O-RAN architecture (RAN Intelligent Controller (RIC) + xApps/rApps + open interfaces (E2 + A1 + O1 + O2 + Open Fronthaul) + O-Cloud platform + multi-vendor integration boundaries + AI/ML decision points + SMO + management plane), (c) maintain attack scenarios covering rogue xApp / rApp + interface protocol abuse + supply chain compromise + RIC compromise enabling RAN policy manipulation + management interface compromise + Open Fronthaul tap or man-in-the-middle, (d) integrate threat intelligence from sectoral channels (CISA + telecom ISAC + GSMA + national CERT) and from O-RAN security focus groups. Risk management must operate per O-RAN WG11 risk methodology aligned with NIST SP 800-30 + ISO 27005 + 3GPP TS 33.117 + 33.512 + 33.513 SECAM/SCAS profiles where applicable. Security architecture must implement WG11 Security Architecture specification including the high-level reference architecture + security functions placement + trust zones + secure interconnects.
What else in your programme already covers this
This control maps to 138 controls across 67 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis
NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
NIST-CSF-ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources