Operate supply chain security + secure development lifecycle (SDL) + privacy + multi-vendor trust per O-RAN WG11 Security Requirements + Open Fronthaul vendor profile + national telecom security regimes. Supply chain security must (a) qualify O-RAN vendors and suppliers per NIST SP 800-161 SCRM tailored to telecom (vendor cybersecurity maturity + product security incident response + secure development + provenance + SBOM availability + sub-component visibility + national security review where applicable), (b) embed cybersecurity requirements in procurement (RFPs + contracts + acceptance testing + warranty), (c) verify trusted source + tamper-evident packaging + integrity verification of received components + firmware + software, (d) align with national telecom supply chain security regulations (UK TSR + US CISA + EU 5G Toolbox + Japan + Australia + similar). Secure development lifecycle must (a) require vendors to operate SDL per WG11 SDL Requirements + ISO/IEC 27034 + or equivalent including threat modeling + secure coding + security testing + vulnerability disclosure + product security incident response (PSIRT), (b) demonstrate SDL conformance via attestation + third-party assessment + or certification (CC + SOC 2 + ISO 27001 + sectoral), (c) integrate vendor SDL with operator security programme via continuous communication + advisory consumption + joint exercises. Privacy must (a) handle user data per applicable telecom privacy regulation (GDPR + national telecom privacy + lawful intercept + data retention), (b) implement privacy by design across O-RAN components + interfaces, (c) document the privacy posture per deployment with cross-border data transfer considerations + subscriber data minimisation. Multi-vendor interoperability and trust must (a) define trust relationships between vendors in deployment + with documented trust boundaries + cryptographic enforcement, (b) maintain interoperability + security regression testing across vendor versions and releases, (c) coordinate vulnerability response across multi-vendor deployment with integrated communication and patching.
This control maps to 20 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 20 it maps to, and the evidence behind each claim, over MCP and REST.