3GPP 5G Security Architecture (TS 33.501)

International (3GPP)

vRelease 17 (2022)

23 domains

43 controls

3GPP Technical Specification 33.501 defines the security architecture and procedures for 5G systems, including authentication (5G-AKA and EAP-AKA'), key management, security between network functions, user plane integrity protection, and subscriber privacy through SUPI/SUCI encryption to prevent tracking and IMSI catching.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (23)

Access Security

1 controls

Controls in the Access Security domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-9	Security for Non-3GPP Access	Non-3GPP access (untrusted Wi-Fi, wireline) must use N3IWF or TNGF with IKEv2 and IPsec for secure tunneling to the 5G c...

Authentication

1 controls

Controls in the Authentication domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-6.1	Primary Authentication (5G AKA / EAP-AKA')	Mutual authentication between UE and network must use 5G AKA or EAP-AKA' procedures involving the AUSF, UDM, SEAF, and A...

Authentication Procedures

4 controls

Controls in the Authentication Procedures domain of 3GPP 5G Security Architecture (TS 33.501) — 4 controls
Code	Title	Description
TS33.501-6.1	Authentication Framework	Primary authentication and key agreement based on EAP-AKA' and 5G-AKA protocols
TS33.501-6.2	Key Hierarchy and Derivation	Maintain the 5G key hierarchy from K to KAUSF, KSEAF, KAMF, and access stratum keys with documented derivation functions...
TS33.501-6.3	EAP-AKA' Authentication	Authentication procedure using EAP-AKA' protocol for 5G
TS33.501-6.4	NAS Security	Apply integrity and confidentiality protection to NAS signalling between UE and AMF using selected 5G algorithms.

Core Network Security

1 controls

Controls in the Core Network Security domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-8	Security Aspects of UDM/UDR	UDM and UDR store sensitive subscriber data including long-term keys and authentication credentials. Storage must be pro...

Cryptography

1 controls

Controls in the Cryptography domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-Annex-D	Cryptographic Algorithms	Supported algorithms include NEA0/NIA0 (null), 128-NEA1/NIA1 (SNOW 3G), 128-NEA2/NIA2 (AES), 128-NEA3/NIA3 (ZUC). Operat...

General Security Architecture

4 controls

Controls in the General Security Architecture domain of 3GPP 5G Security Architecture (TS 33.501) — 4 controls
Code	Title	Description
TS33.501-4.1	5G Security Architecture Overview	Define the overall 5G security architecture covering UE, RAN, core network, and service-based interfaces with documented...
TS33.501-4.2	Security Feature Groups	Network access security, network domain security, user domain security, application domain security, SBA domain security...
TS33.501-4.3	Security Domains and Stratum	Grouping of network entities for security in home and visited networks and protected communication links
TS33.501-4.4	Network Functions in the Security Architecture	Security roles of AUSF, SEAF, SIDF, and other NFs

Identifiers and Privacy

1 controls

Controls in the Identifiers and Privacy domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-5.1	Subscription Permanent Identifier Protection	The SUPI must never be transmitted in cleartext over the radio interface. SUCI (concealed identifier) must be derived us...

Interworking

1 controls

Controls in the Interworking domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-10	Security for Interworking with EPS	Interworking between 5GS and EPS requires secure mapping of security contexts during handover and idle mode mobility, pr...

Key Management

1 controls

Controls in the Key Management domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-6.2	Key Hierarchy	5G key hierarchy starts from long-term key K stored in USIM and ARPF, deriving CK/IK, KAUSF, KSEAF, KAMF, and subsequent...

Management Security

1 controls

Controls in the Management Security domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-OAM	Management Plane Security	Operations and management interfaces to 5G NFs must be authenticated, encrypted, and logged. Administrative access requi...

Network and Service Security

0 controls

User plane, control plane, and SBA security

Non-3GPP Access Security

3 controls

Controls in the Non-3GPP Access Security domain of 3GPP 5G Security Architecture (TS 33.501) — 3 controls
Code	Title	Description
TS33.501-7.1	Untrusted Non-3GPP Access Security	Security for access to 5G core via untrusted non-3GPP access networks through N3IWF
TS33.501-7.2	Security Visibility and Configurability	Provide operators with visibility into active security parameters and ability to configure algorithm preferences.
TS33.501-7.3	Wireline Access Security	Security for access to 5G core via wireline access networks

Privacy

1 controls

Controls in the Privacy domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-17	Privacy and Pseudonymization	Privacy protections include SUCI concealment, GUTI reallocation, paging strategies that avoid permanent identifier leaka...

Roaming Security

2 controls

Controls in the Roaming Security domain of 3GPP 5G Security Architecture (TS 33.501) — 2 controls
Code	Title	Description
33.501-13.4	SEPP and Inter-PLMN Security (N32)	Security Edge Protection Proxies protect signaling between visited and home PLMNs over N32, using TLS for N32-c and PRIN...
33.501-15	Steering of Roaming Security	Steering of roaming information sent to UE must be protected for authenticity and integrity using SoR-MAC to prevent una...

SBA Security

2 controls

Controls in the SBA Security domain of 3GPP 5G Security Architecture (TS 33.501) — 2 controls
Code	Title	Description
33.501-13.1	Service-Based Architecture Security (TLS)	5G SBI between Network Functions must be protected using TLS 1.2 or higher with mutual authentication via certificates....
33.501-13.2	Network Function Service Authorization (OAuth 2.0)	NF service consumers must obtain access tokens from the NRF to invoke services on NF service producers. Tokens must be v...

Security Architecture

1 controls

Controls in the Security Architecture domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-4.2	Security Domains and Trust Model	5G security architecture defines security domains including UE, access network, serving network, and home network, with...

Security for NAS and AS Protocols

4 controls

Controls in the Security for NAS and AS Protocols domain of 3GPP 5G Security Architecture (TS 33.501) — 4 controls
Code	Title	Description
TS33.501-6.5	AS Security and PDCP Protection	Protect access stratum traffic via PDCP layer integrity and ciphering for user plane and RRC signalling.
TS33.501-6.6	AS Security	RRC and UP security over air interface including ciphering and integrity protection
TS33.501-6.7	Security Key Hierarchy	Key derivation hierarchy from KAUSF to KgNB, KNAS and lower-level keys
TS33.501-6.8	Security in Handover	Maintain security context during intra and inter system handovers with proper key refresh and vertical key derivation.

Security for Specific Services

4 controls

Controls in the Security for Specific Services domain of 3GPP 5G Security Architecture (TS 33.501) — 4 controls
Code	Title	Description
TS33.501-14.1	Security for Network Slicing	Security considerations and requirements for network slicing
TS33.501-14.2	Security for Edge Computing	Security for Multi-access Edge Computing in the 5G system
TS33.501-14.3	Security for URLLC Services	Security considerations for Ultra-Reliable Low-Latency Communication services
TS33.501-14.4	Security for IAB	Security for Integrated Access and Backhaul nodes

Service Based Architecture Security

4 controls

Controls in the Service Based Architecture Security domain of 3GPP 5G Security Architecture (TS 33.501) — 4 controls
Code	Title	Description
TS33.501-13.1	NF Registration and Discovery Security	Security for NF registration, discovery and authorization using NRF
TS33.501-13.2	NF Service Authorization	Use OAuth 2.0 client credentials grant for NF to NF service authorization with NRF as authorization server.
TS33.501-13.3	N32 Interconnect Security	Secure inter PLMN N32 interface using SEPP with application layer protection (PRINS) or TLS, including topology hiding.
TS33.501-13.4	OAuth 2.0 Authorization Framework	NF service consumer authorization using OAuth 2.0 tokens issued by NRF

Service Security

1 controls

Controls in the Service Security domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-11	Security Aspects of IMS	5G IMS services use SIP signaling with security mechanisms including IMS AKA, IPsec, and TLS to protect signaling and me...

Signaling Security

3 controls

Controls in the Signaling Security domain of 3GPP 5G Security Architecture (TS 33.501) — 3 controls
Code	Title	Description
33.501-6.4	NAS Security	NAS signaling between UE and AMF must be integrity protected and confidentiality protected using NAS keys derived from K...
33.501-6.5	AS Security (RRC and User Plane)	Access Stratum security protects RRC signaling and user plane between UE and gNB using AS keys derived from KgNB, with P...
33.501-6.7	Security Mode Command Procedures	SMC procedures activate NAS and AS security. The network selects algorithms based on UE security capabilities, with bidd...

Slicing

1 controls

Controls in the Slicing domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-14	Network Slicing Security	Network slice isolation must prevent cross-slice information leakage and ensure that authentication, authorization, and...

User Plane

1 controls

Controls in the User Plane domain of 3GPP 5G Security Architecture (TS 33.501) — 1 controls
Code	Title	Description
33.501-16	Security for User Plane Integrity Protection	User plane integrity protection may be enabled per-DRB based on SMF policy and UE/gNB capability. Full-rate UP integrity...

Your Compliance Coverage

If you comply with 3GPP 5G Security Architecture (TS 33.501), you already cover:

NIST SP 800-53 Rev 5

88%

38 controls mapped

Compare →

NIST SP 800-187

51%

22 controls mapped

Compare →

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

12%

5 controls mapped

Compare →

+ 60 more: Azure Security Benchmark (12%), AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) (12%)

See all 63 mapped frameworks ↓

Maps to 63 other frameworks

43 total controls

NIST SP 800-53 Rev 5

38 source controls mapped|17 target controls covered

88%

NIST SP 800-187

22 source controls mapped|7 target controls covered

51%

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

5 source controls mapped|5 target controls covered

12%

Azure Security Benchmark

5 source controls mapped|3 target controls covered

12%

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

5 source controls mapped|5 target controls covered

12%

BSI IT-Grundschutz

5 source controls mapped|3 target controls covered

12%

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

5 source controls mapped|9 target controls covered

12%

ISO 27018

5 source controls mapped|3 target controls covered

12%

ISO 27017

5 source controls mapped|3 target controls covered

12%

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

5 source controls mapped|5 target controls covered

12%

ISO/SAE 21434

5 source controls mapped|6 target controls covered

12%

ASD Strategies to Mitigate Cyber Security Incidents

5 source controls mapped|4 target controls covered

12%

ISO 13485

5 source controls mapped|5 target controls covered

12%

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

5 source controls mapped|6 target controls covered

12%

ISO/IEC 27400:2022

5 source controls mapped|2 target controls covered

12%

AWS Well-Architected Security Pillar

5 source controls mapped|3 target controls covered

12%

ISO 27799

5 source controls mapped|4 target controls covered

12%

ISO 27043

5 source controls mapped|6 target controls covered

12%

NIST SP 800-190

5 source controls mapped|3 target controls covered

12%

IEC 62351 - Power Systems Communication Security

4 source controls mapped|2 target controls covered

ISO/IEC 27011:2024

3 source controls mapped|2 target controls covered

SSAE 18 - Attestation Standards (SOC Reporting)

3 source controls mapped|2 target controls covered

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary

3 source controls mapped|4 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

3 source controls mapped|1 target controls covered

NIST Cybersecurity Framework 2.0

3 source controls mapped|3 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

3 source controls mapped|4 target controls covered

ISO 19011

3 source controls mapped|4 target controls covered

MARS-E - Minimum Acceptable Risk Standards for Exchanges

3 source controls mapped|2 target controls covered

ISO/IEC 27006:2024