Implement cryptography + protocol security + PKI per O-RAN WG11 Security Requirements covering TLS + SSH + IPsec + certificate lifecycle. TLS implementation must (a) use TLS 1.2 minimum + TLS 1.3 preferred + with WG11-approved cipher suites + Perfect Forward Secrecy + certificate verification, (b) enforce minimum key sizes per WG11 cryptographic profile (RSA 2048 minimum + ECDSA P-256 minimum + ECDHE for key exchange), (c) implement OCSP stapling + or CRL checking with documented fallback, (d) protect TLS termination points against attack including downgrade + cipher manipulation + protocol negotiation abuse. SSH implementation must (a) use SSHv2 with WG11-approved cipher suites + KEX algorithms + MAC algorithms, (b) enforce strong authentication (certificate-based + or strong key-based + with multi-factor where applicable to administrative access), (c) restrict SSH access via network segregation + jump host + PAM. IPsec implementation must (a) use IKEv2 + with WG11-approved ESP/AH parameters, (b) implement secure tunnel lifecycle including rekeying + DPD + Perfect Forward Secrecy. PKI and certificate lifecycle management must (a) define certificate hierarchy + Certificate Authority (CA) selection (operator-managed CA + or industry-trusted CA) + certificate policy + CPS, (b) implement automated certificate enrollment (CMP + EST + ACME where applicable) + renewal + revocation, (c) maintain key custody + HSM where appropriate + key rotation per WG11 cryptographic lifecycle requirements, (d) integrate with monitoring for certificate expiry + revocation + anomalous issuance.
What else in your programme already covers this
This control maps to 279 controls across 122 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,