O-RAN WG11 Security Specification
Threat Model and Risk Management

O-RAN WG11 Security Specification 1: O-RAN Threat Model, Risk Management, and Security Architecture

Maintain the O-RAN threat model and risk management per O-RAN Alliance WG11 Security Threat Model and Risk Assessment specifications. The threat model must (a) enumerate threat actors targeting O-RAN deployments (nation-state attackers + criminal organisations targeting telecom + insiders with operator or vendor access + compromised vendors + supply-chain attackers), (b) catalogue attack surfaces specific to O-RAN architecture (RAN Intelligent Controller (RIC) + xApps/rApps + open interfaces (E2 + A1 + O1 + O2 + Open Fronthaul) + O-Cloud platform + multi-vendor integration boundaries + AI/ML decision points + SMO + management plane), (c) maintain attack scenarios covering rogue xApp / rApp + interface protocol abuse + supply chain compromise + RIC compromise enabling RAN policy manipulation + management interface compromise + Open Fronthaul tap or man-in-the-middle, (d) integrate threat intelligence from sectoral channels (CISA + telecom ISAC + GSMA + national CERT) and from O-RAN security focus groups. Risk management must operate per O-RAN WG11 risk methodology aligned with NIST SP 800-30 + ISO 27005 + 3GPP TS 33.117 + 33.512 + 33.513 SECAM/SCAS profiles where applicable. Security architecture must implement WG11 Security Architecture specification including the high-level reference architecture + security functions placement + trust zones + secure interconnects.

What else in your programme already covers this

This control maps to 138 controls across 67 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

  • NIST-CSF-DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis
  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
  • NIST-CSF-ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources

NIST SP 800-53 Rev 5 · 5 controls

ISO/IEC 29147:2018 · 4 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement
  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

ISO 27005 · 3 controls

ISO 31000 · 3 controls

ISO/IEC 23894:2023 · 3 controls

ISO/IEC 30111:2019 · 3 controls

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

BSI IT-Grundschutz · 2 controls

  • BSI-14 Vulnerability scanning and management
  • BSI-16 Threat intelligence integration
  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

ISO/IEC 27003:2017 · 2 controls

ISO/IEC 27011:2024 · 2 controls

  • NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)
  • 3.16 System and Services Acquisition
  • 3.17 Supply Chain Risk Management
  • OCCHS-3 Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols
  • OCCHS-7 Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning

OECD AI Principles · 2 controls

  • OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection
  • OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation
  • DSOMM-1 Culture, Organization, Education, and Governance
  • DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling

South Korea ISMS-P · 2 controls

API 1164 · 1 control

  • API1164-21 TSA Pipeline Security Directive Alignment
  • CPG-5.A Vulnerability Disclosure Program
  • CJIS-19 Supply Chain Risk Management

IEC 62443 · 1 control

  • IEC62443-21 Supply chain risk management for critical components

ISO 22320:2018 · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27019 · 1 control

  • ISO27019-21 Supply chain risk management for critical components

ISO 27043 · 1 control

ISO/IEC 27400:2022 · 1 control

  • 27400-5.1 IoT Security and Privacy Governance

ISO/IEC 29134:2023 · 1 control

  • 29134-9.2 Report findings and recommendations

ISO/SAE 21434 · 1 control

NIST SP 1800-32 · 1 control

NIST SP 800-190 · 1 control

  • OECDAI24-3 Frontier Model Risk Management, Capability Disclosure, and Independent Evaluation

OWASP ASVS · 1 control

OWASP MASVS · 1 control

  • OWASPMASVS-6 MASVS-CODE: Code Quality, Build Settings, and Updates

OWASP Top 10:2025 · 1 control

  • OPENBANK-4 Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence
  • PSPF24-1 Security Culture, Governance, Risk Management
  • AIGF-1.1 Risk Management and Internal Controls
  • UNGPBHR-2 Pillar II: Corporate Responsibility to Respect Human Rights

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 138 it maps to, and the evidence behind each claim, over MCP and REST.