5G Security Standards

Technical specifications for securing 5G networks including network slicing and edge computing security.

CategoryTelecommunications
StatusActive
Latest development

Analysis

5G security requirements are primarily defined by 3GPP (e.g., TS 33.501 and related specs), complemented by guidance from bodies such as ENISA, GSMA, ITU‑T and regional regulators (EU toolbox, EECC, national laws). These collectively address core 5G security areas including network slicing, edge/ MEC security, authentication and encryption, interconnect security, and supply‑chain/ vendor risk.ENISA 5G Cybersecurity StandardsSECURITY IN 5G Specifications – ENISATEC/3GPP TS 33.501 “Security architecture and procedures for 5G system”

Key Requirements

Core 5G security architecture (3GPP TS 33.501 and related)

  • Implement 5G security architecture as defined in 3GPP TS 33.501, including Authentication Server Function (AUSF), Unified Data Management (UDM), Security Anchor Function (SEAF), and secure key management.
  • 3GPP TS 33.501 sets out the security architecture and procedures for the 5G system, including entity roles, key hierarchy (K, K_AUSF, K_SEAF, K_AMF, etc.) and overall trust model.TEC/3GPP TS 33.501SECURITY IN 5G Specifications – ENISA
  • ENISA’s analysis identifies TS 33.501 as the central 5G security specification, covering user and signalling data protection, subscriber privacy, and protection of internal interfaces.SECURITY IN 5G Specifications – ENISAENISA 5G Cybersecurity Standards
  • Use strong ciphering and integrity protection for user and signalling data between UE and network.
  • 3GPP requires support for 128‑bit encryption and integrity algorithms (e.g. 128‑NEA1/2 and 128‑NIA1/2) and mandates that confidentiality protection be applied where required by regulation and risk analysis.SECURITY IN 5G Specifications – ENISATEC/3GPP TS 33.501
  • ENISA recommends non‑NULL ciphering and integrity by default and references TS 33.501 clauses specifying minimum algorithm support.SECURITY IN 5G Specifications – ENISA

Internal and inter‑network interface protection (including edge and slicing‑relevant interfaces)

  • Protect gNB internal split interfaces (e.g. F1, E1) using IPsec ESP and certificate‑based IKEv2 authentication.
  • TS 33.501 mandates IPsec for gNB internal interfaces supporting split architecture (F1/E1) and specifies IPsec ESP with IKEv2 certificate‑based authentication.SECURITY IN 5G Specifications – ENISATEC/3GPP TS 33.501
  • ENISA highlights these requirements as critical for edge deployment and disaggregated RAN (relevant to MEC and slicing).SECURITY IN 5G Specifications – ENISA

Network slicing security

  • Provide slice‑specific security policies, isolation and lifecycle controls.
  • 3GPP security specifications (TS 33.501 and related) define security for network slicing, including slice‑specific access control, management plane protection and isolation of resources between slices.TEC/3GPP TS 33.501ITU‑T SG17 5G security overview
  • ITU‑T lists 3GPP TS 33.501 and related TS 33.5xx series as key Recommendations for 5G security, including aspects relevant to slicing such as service‑based architecture security and isolation.ITU‑T SG17 5G security overviewENISA 5G Cybersecurity Standards
  • Align slicing security with national/EU requirements on critical services.
  • The EU 5G security toolbox and ENISA’s guideline under the European Electronic Communications Code (EECC) emphasize security of critical services hosted on 5G slices, including strict vendor risk controls and monitoring.EU Toolbox for 5G SecurityENISA 5G Supplement to EECC Guideline

Edge computing / MEC security

  • Apply data protection and privacy controls for edge‑hosted data and applications.
  • ENISA’s 5G specifications report stresses subscriber privacy, secure storage and processing of subscription credentials, and confidentiality/integrity of user data, which extend to edge processing environments.SECURITY IN 5G Specifications – ENISAENISA 5G Cybersecurity Standards

EU/EECC and national regulatory security measures

  • Implement appropriate technical and organizational security measures under the EECC and national telecom security laws.
  • ENISA’s Guideline on Security Measures under the EECC, supplemented by the 5G technology profile, gives specific expectations for providers of 5G networks and services.ENISA 5G Supplement to EECC GuidelineENISA 5G Cybersecurity Standards
  • The EU 5G toolbox sets coordinated measures including risk assessment, restrictions on high‑risk vendors, and enhanced security requirements for core and critical parts of 5G networks.EU Toolbox for 5G Security

Compliance Challenges

Complexity of 5G security standards and fragmentation

  • Challenge: Navigating multiple overlapping standards (3GPP, ITU‑T, GSMA) and regional requirements (EU toolbox, EECC, national laws).
  • ENISA’s 5G cybersecurity standards report catalogues a large number of 3GPP, ETSI, ITU‑T and GSMA specifications, noting gaps and overlaps, which can complicate implementation.ENISA 5G Cybersecurity StandardsSECURITY IN 5G Specifications – ENISA
  • ITU‑T SG17’s 5G security overview lists numerous Recommendations and technical reports, highlighting the breadth of relevant documents.ITU‑T SG17 5G security overview
  • Example: Operators struggling to align vendor implementations with EU toolbox measures and national restrictions on high‑risk vendors.
  • The EU toolbox describes coordinated measures, including strategic and technical mitigating actions and moves by Member States to restrict certain vendors.EU Toolbox for 5G Security
  • ENISA’s 5G supplement notes that national authorities must ensure providers apply the EECC security measures in a 5G‑specific context, which operators report as resource‑intensive.ENISA 5G Supplement to EECC Guideline

Network slicing and multi‑tenant complexity

  • Challenge: Ensuring strong isolation and customized security for multiple slices serving diverse tenants and verticals.
  • ENISA and GSMA documents describe network slicing as enabling multi‑tenant environments with varying requirements, which increases attack surfaces and complexity.ENISA 5G Cybersecurity StandardsGSMA 5G Security Guide FS.40 v2.0
  • ITU‑T SG17 notes that 5G security must cover service‑based architecture and slicing, making policy management and assurance more difficult.ITU‑T SG17 5G security overview
  • Example: Industry reports highlight challenges in implementing secure slices for critical infrastructures (e.g., utilities, transport) with strict SLAs and security baselines.
  • ENISA points out that slices supporting critical services require reinforced security and monitoring, including higher assurance for components and configurations.ENISA 5G Supplement to EECC GuidelineENISA 5G Cybersecurity Standards

Edge/MEC deployment and operational security

  • Challenge: Securing distributed edge nodes with limited physical protection and complex operational models.
  • ENISA highlights edge computing as a security concern due to distributed locations and exposure to physical tampering and local attacks.ENISA 5G Cybersecurity Standards
  • GSMA’s 5G Security Guide discusses MEC integration and the need to secure applications, APIs, and data flows at the edge.GSMA 5G Security Guide FS.40 v2.0
  • Example: Operators deploying MEC for video analytics or industrial IoT face challenges in enforcing unified security policies and monitoring across many micro‑sites.
  • ENISA notes that security measures must be enforced consistently across all parts of the 5G infrastructure, including edge sites, which adds operational burden.ENISA 5G Supplement to EECC GuidelineSECURITY IN 5G Specifications – ENISA

Supply‑chain and vendor risk

  • Challenge: Managing vendor‑related risks, especially for RAN and core components, under national and EU restrictions.
  • The EU toolbox calls out supplier risk as central to 5G security, recommending controls and restrictions on high‑risk vendors.EU Toolbox for 5G Security
  • ENISA’s 5G supplement expects national authorities to evaluate providers’ supply‑chain risk management for 5G security measures.ENISA 5G Supplement to EECC Guideline
  • Example: Several EU Member States have introduced measures to limit or phase out certain vendors from core or critical 5G parts, requiring complex migration and compliance programmes.
  • EU toolbox documentation describes Member State actions based on risk assessments and coordinated EU guidance.EU Toolbox for 5G Security
  • GSMA industry papers referenced in FS.40 note national regulatory moves such as the UK Telecommunications (Security) Bill affecting operator deployment choices.GSMA 5G Security Guide FS.40 v2.0

Implementation Best Practices

Governance and mapping to standards and regulations

  • Map your 5G security controls to 3GPP TS 33.501 and related specs, EU toolbox measures, and national EECC‑based requirements.
  • ENISA’s 5G cybersecurity standards report provides a mapping of standards to security domains, useful for aligning

Recent developments

  • — NIST released the final six publications in its “Applying 5G Cybersecurity and Privacy Capabilities” series, giving operators practical guidance on SUCI protection, hardware-enabled integrity, temporary identity reallocation, no SUPI-based paging, and 5G network security design principles.[8] (source)
  • — Industry-facing reaction is reflected in NIST’s final 5G white papers, which package implementation guidance for operators and vendors rather than just high-level policy. This suggests the market is moving from standards discussion toward deployment-oriented security practices.[8] (source)
  • — NIST opened public comment on a draft executive summary for SP 1800-33 Volume A, which recommends configuring standardized 5G cybersecurity and privacy features and designing cloud stacks to support those capabilities. The comment period ran through 2025-04-16, indicating active standards-development work in 5G security.[6] (source)
  • — The draft NIST guidance focuses on enabling optional 3GPP-defined security and privacy features, signaling an industry push to harden commercial 5G implementations without changing the core 5G architecture. That framing indicates broad vendor/operator alignment around standardized controls.[6] (source)
  • — NIST asked for comments on draft materials in its 5G cybersecurity and privacy series, including guidance on SUCI protection for subscriber identifiers. The draft review period was open until 2024-09-16, showing continued U.S. policy and standards attention on 5G privacy controls.[3] (source)
  • — NIST’s SUCI-focused draft series shows continued attention to subscriber privacy, a major 5G industry concern because identity exposure can undermine user trust and regulatory compliance. The comment process indicates active stakeholder engagement on these controls.[3] (source)
  • — GSMA updated its 5G security guidance to emphasize stricter use of temporary identifiers, removal of weaker cryptographic algorithms, and reduced paging-based subscriber tracking risk. The document also notes that the EU 5G cybersecurity certification scheme builds on the EU toolbox for 5G security.[7] (source)
  • — GSMA’s update reflects industry concern about subscriber tracing and weak crypto in 5G deployments, and it highlights mitigations such as 5G-GUTI-based paging and removal of deprecated algorithms. It also connects 5G security work to EU certification efforts.[7] (source)
  • — CISA and NSA published guidance on 5G network slicing security considerations for design, deployment, and maintenance. The guidance was developed through the Enduring Security Framework and targets threats to 5G standalone network slicing.[1] (source)
  • — CISA/NSA’s network slicing guidance is important for operators adopting 5G standalone architectures, because slicing creates new security boundaries and operational complexity. The publication points to a growing industry need for hardened deployment and maintenance practices.[1] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates