Operate supply chain security + secure development lifecycle (SDL) + privacy + multi-vendor trust per O-RAN WG11 Security Requirements + Open Fronthaul vendor profile + national telecom security regimes. Supply chain security must (a) qualify O-RAN vendors and suppliers per NIST SP 800-161 SCRM tailored to telecom (vendor cybersecurity maturity + product security incident response + secure development + provenance + SBOM availability + sub-component visibility + national security review where applicable), (b) embed cybersecurity requirements in procurement (RFPs + contracts + acceptance testing + warranty), (c) verify trusted source + tamper-evident packaging + integrity verification of received components + firmware + software, (d) align with national telecom supply chain security regulations (UK TSR + US CISA + EU 5G Toolbox + Japan + Australia + similar). Secure development lifecycle must (a) require vendors to operate SDL per WG11 SDL Requirements + ISO/IEC 27034 + or equivalent including threat modeling + secure coding + security testing + vulnerability disclosure + product security incident response (PSIRT), (b) demonstrate SDL conformance via attestation + third-party assessment + or certification (CC + SOC 2 + ISO 27001 + sectoral), (c) integrate vendor SDL with operator security programme via continuous communication + advisory consumption + joint exercises. Privacy must (a) handle user data per applicable telecom privacy regulation (GDPR + national telecom privacy + lawful intercept + data retention), (b) implement privacy by design across O-RAN components + interfaces, (c) document the privacy posture per deployment with cross-border data transfer considerations + subscriber data minimisation. Multi-vendor interoperability and trust must (a) define trust relationships between vendors in deployment + with documented trust boundaries + cryptographic enforcement, (b) maintain interoperability + security regression testing across vendor versions and releases, (c) coordinate vulnerability response across multi-vendor deployment with integrated communication and patching.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.