O-RAN WG11 Security Specification
Security Test and Certification

O-RAN WG11 Security Specification ORANWG11-6: Security Test Specifications, Certification, and Conformance

Operate security test + certification + conformance per O-RAN WG11 Security Test Specifications and WG11 Test Specifications including Open Test and Integration Center (OTIC) testing. Security test specifications must cover (a) interface security test cases per E2 + A1 + O1 + O2 + Open Fronthaul testing the authentication + confidentiality + integrity + authorisation + replay protection + cryptographic conformance, (b) component security test cases per O-DU + O-CU + O-RU + Near-RT RIC + Non-RT RIC + SMO + O-Cloud with positive and negative test scenarios, (c) negative test cases probing for known attack vectors + fuzzing + protocol abuse + boundary conditions, (d) penetration testing of integrated multi-vendor deployments. Certification must (a) align with O-RAN OTIC certification program + with vendor self-attestation + third-party assessment as deployment risk profile warrants, (b) align with 3GPP SECAM/SCAS certification for shared components, (c) align with national telecom security certification schemes where applicable (UK TSR + EU 5G Cybersecurity Toolbox + US CISA Secure by Design + similar). Conformance evidence must (a) demonstrate adherence to applicable WG11 specifications with traceability per requirement, (b) be maintained through release lifecycle of products + with regression testing on changes, (c) be available for operator audit + regulator inspection + customer due diligence.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 151 controls across 89 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Annex 11 to EU GMP - Computerised Systems · 3 controls

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

  • IEC62304-5.2 Software Requirements Analysis
  • IEC62304-5.3 Software Architectural Design
  • IEC62304-7.2 Risk Control Measures

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 3 controls

  • ISO-15189-5.1 Legal entity
  • ISO-15189-5.4 Structure and authority
  • ISO-15189-6.7 Service agreements

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 3 controls

  • ISO-19650-1-4 Information management concepts
  • ISO-19650-1-7 Common Data Environment (CDE) concept
  • ISO-19650-3-5.3 Trigger events for information exchange

ISO 22320:2018 · 3 controls

  • ISO-22320-5.1 General process requirements
  • ISO-22320-5.3 Incident management structure (command)
  • ISO-22320-5.4 Roles and responsibilities

ISO/IEC 23894:2023 · 3 controls

  • ISO23894-1 Scope of AI Risk Management
  • ISO23894-3 AI-Specific Terminology
  • ISO23894-6.2 Scope, Context and Criteria

ISO/IEC 27004:2016 · 3 controls

  • 27004-3 Terms and definitions
  • 27004-A.2 Patching and Vulnerability Measures
  • 27004-B.1 Example measurement definitions

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 3 controls

  • 27557-1 Scope
  • 27557-3 Terms and definitions
  • 27557-6.2 Scope, context, and criteria for privacy

ISO/IEC 29100:2024 · 3 controls

  • 29100-1 Scope
  • 29100-3 Terms and definitions
  • 29100-4.1 Actors and roles

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

21 CFR Part 58 - Good Laboratory Practice (GLP) · 2 controls

  • 58.1 Scope
  • 58.3 Definitions

Albania Law No. 124/2024 on Personal Data Protection · 2 controls

  • AL-DPA-1 Scope and Definitions
  • AL-DPA-3 Lawful Basis for Processing

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 2 controls

  • AT-DSG-2 Section 2 - Scope and application
  • AT-DSG-8 Section 22 - Functions and powers of the DPA

Automotive SPICE (ASPICE) v4.1 - Process Assessment Model · 2 controls

  • MLE.1 Machine Learning Requirements Analysis
  • MLE.3 Machine Learning Training

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

  • DA-1 Enterprise Data Architecture
  • DIQ-2 Data Quality Management

FedRAMP Rev 5 · 2 controls

  • FEDRAMP-CM-6 Configuration Settings
  • FEDRAMP-CP-9 System Backup

Florida Digital Bill of Rights (FDBR) · 2 controls

  • FDBR-702 Definitions (§501.702)
  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

ICH Q10 - Pharmaceutical Quality System · 2 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 2 controls

  • 60601-1.3 Terminology and definitions
  • 60601-1.4.1 General requirements

ISO 20400:2017 - Sustainable Procurement · 2 controls

  • ISO-20400-4.2 Principles of sustainable procurement
  • ISO-20400-7.2 Integrating sustainability into specifications

ISO 41001:2018 - Facility Management Systems · 2 controls

  • ISO-41001-4.1 Understanding the organization and its context
  • ISO-41001-4.3 Determining the scope of the FM management system

ISO 56002 · 2 controls

  • ISO-56002-4.3 Determining the scope of the innovation management system
  • ISO-56002-8.3.4 Develop solutions

ISO 8000 - Data Quality · 2 controls

  • ISO8000-DQM-02 Data Quality Dimensions
  • ISO8000-MDG-03 Continuous Improvement

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration · 2 controls

  • ISO-17025-5.1 Legal entity
  • ISO-17025-5.4 Personnel for the management system

ISO/IEC 25012:2008 - Data Quality Model · 2 controls

  • ISO-25012-5.2 Defining data quality measures
  • ISO-25012-5.3 Planning and performing data quality evaluations

ISO/IEC 27011:2024 · 2 controls

  • 27011-1 Scope
  • 27011-3 Terms and definitions

ISO/IEC 27014:2020 · 2 controls

  • 27014-1 Scope
  • 27014-3 Terms and definitions

ISO/IEC 29147:2018 · 2 controls

  • 29147-3 Terms and definitions
  • 29147-9.2 Contact mechanisms and scope

ISO/IEC 30111:2019 · 2 controls

  • 30111-3 Terms and definitions
  • 30111-5.1 Organizational policy

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 2 controls

  • STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure
  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
  • NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Nebraska Data Privacy Act · 2 controls

  • NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation

OWASP DevSecOps Maturity Model (DSOMM) · 2 controls

  • DSOMM-1 Culture, Organization, Education, and Governance
  • DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication
  • ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO
  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

Science Based Targets Initiative (SBTi) - Net-Zero Standard · 2 controls

  • C1 Organizational Boundary
  • C3 Scope 1 and 2 Coverage

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

  • CFR211-A-3 Section 211.3 - Definitions

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.1 Resources, Roles, Responsibility, and Authority

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

  • AWWA-1.1 Security Policy and Governance

Azerbaijan Law on Personal Data (2010) · 1 control

  • AZ-DPA-2 Article 2 - Basic Concepts

Barbados Data Protection Act 2019 · 1 control

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-6.B Supply Chain Incident Reporting

COBIT 2019 · 1 control

  • COBIT-BAI02 Managed requirements definition

Connecticut Data Privacy Act (CTDPA) · 1 control

  • CTDPA-1 Definitions

DFARS 252.204-7012 - Safeguarding Covered Defense Information · 1 control

  • 7012(a) Definitions

FFIEC IT Examination Handbook · 1 control

  • FFIEC-05 Roles and responsibilities definition

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)

FedRAMP High · 1 control

  • CA-9 Internal System Connections

FedRAMP Moderate · 1 control

  • CA-9 Internal System Connections

French Sapin II Law (Law No. 2016-1691) · 1 control

  • Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-1 Objectives, Powers and Responsibilities of the Supervisor

IATA Operational Safety Audit (IOSA) Standards Manual · 1 control

  • IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-2 Glossary of terms

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3) · 1 control

  • ISO-14064-1-5.1 Organizational boundaries

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

  • ISO-26262-3-5 Item definition

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PI-01 Personnel Security Screening

ISO/IEC 23837:2023 · 1 control

  • 23837-1.1 Scope

ISO/IEC 27003:2017 · 1 control

  • ISO27003-4.3 Determining the scope of the information security management system

ISO/IEC 27007:2020 · 1 control

  • 27007-5.2 Audit Programme Objectives

ISO/IEC 27031:2011 · 1 control

  • 27031-5.1 IRBC Policy

ISO/IEC 27043:2015 · 1 control

  • ISO27043-04 Roles and responsibilities definition

ISO/IEC 27050-1:2019 · 1 control

  • 27050-1.4 Terms and definitions

ISO/IEC 27400:2022 · 1 control

  • 27400-3 Terms and definitions

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 1 control

  • 29115-3 Terms and definitions

ISO/IEC 29134:2023 · 1 control

  • 29134-3 Terms and definitions

ISO/SAE 21434 · 1 control

  • ISO21434-04 Roles and responsibilities definition

Illinois Biometric Information Privacy Act (BIPA) · 1 control

  • BIPA-SEC5-1 Biometric Identifier Definition

Kuwait National Cybersecurity Framework · 1 control

NIST SP 800-190 · 1 control

OCC Heightened Standards (12 CFR Part 30, Appendix D) · 1 control

  • OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards

OWASP ASVS · 1 control

  • OWASPASVS-1 Architecture, Design and Threat Modelling (V1)

OWASP MASVS · 1 control

OWASP Top 10:2025 · 1 control

Open Banking Security · 1 control

  • OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX

PCI DSS 4.0 · 1 control

  • 2.2.2 2.2.2 Vendor default accounts managed

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Regulation on the European Health Data Space (EHDS) · 1 control

  • EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29)

SWIFT CSCF · 1 control

  • SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1)

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-RES.2 Disaster Recovery

South Korea ISMS-P · 1 control

  • ISMSP-SYS-04 Vulnerability Management

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

  • KISO-1.3 Definitions

South Korea PIPA · 1 control

  • PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

  • FADP-5 Definitions (Article 5)

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

UK Open Banking Standard · 1 control

  • OB-OPS.2 Performance Standards

US Foreign Corrupt Practices Act (FCPA) · 1 control

  • 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 1 control

  • USMCADIGITAL-1 Cross-Border Data Flows and Localisation

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content)

W3C Verifiable Credentials (VC) Data Model 2.0 · 1 control

  • W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 151 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll O-RAN WG11 Security Specification controls