CIS Controls for 5G Infrastructure: Telecom Hardening Guide

Why CIS Controls for 5G Infrastructure?

5G networks are not monolithic. They comprise multiple subsystems — the 5G Core (5GC), the Radio Access Network (RAN), the transport network, and the management and orchestration (MANO) layer — each with distinct security requirements. The CIS Controls v8 offer 18 prioritized safeguard categories that map directly to the operational realities of telecom environments:

• Control 1: Inventory and Control of Enterprise Assets — Critical for tracking virtual network functions (VNFs), CNFs, and bare-metal nodes across distributed 5G deployments.
• Control 4: Secure Configuration of Enterprise Assets and Software — Directly applicable to hardening 3GPP-defined Network Functions (AMF, SMF, UPF, NSSF, etc.) against default or weak configurations.
• Control 7: Continuous Vulnerability Management — Essential for scanning both containerized 5G workloads and the underlying host OS.
• Control 12: Network Infrastructure Management — Covers network segmentation, N3/N6/N9 interface security, and SBI (Service-Based Interface) traffic filtering.
• Control 16: Application Software Security — Addresses the secure development lifecycle for 5G network applications and APIs exposed via the SBI.

Applying CIS Controls to a 5G environment requires understanding where the controls overlap with 3GPP security standards (TS 33.501, TS 33.310) and where they extend beyond them — especially in areas like logging, access management, and incident response that 3GPP specifications intentionally leave to operator discretion.

The 5G Threat Landscape: What CIS Controls Must Address

Before mapping controls to specific 5G layers, it is critical to understand the threat model that makes CIS Controls necessary for telecom operators. The following table summarizes the highest-priority threat vectors in 5G infrastructure and the CIS Controls that directly mitigate them:

Mapping CIS Controls to 5G Architecture Layers

Effective hardening requires a layer-specific mapping rather than a blanket application of controls. The following subsections break down the 5G architecture — 5G Core, RAN, transport, management plane, and network slicing — and detail which CIS Controls apply at each layer, with specific implementation guidance.

5G Core Control Plane (AMF, SMF, NSSF, AUSF, NRF, PCF, UDM)

The 5G Core control plane uses a Service-Based Architecture (SBA) where Network Functions (NFs) communicate via HTTP/2 RESTful APIs over the SBI. This is the highest-value attack surface in a 5G network because compromising a single NF can cascade to subscriber data, session management, and authentication.

CIS Control 16 (Application Software Security) is the most critical here. Every NF exposes an API that must be hardened against OWASP Top 10 vulnerabilities, especially broken object-level authorization (BOLA) and excessive data exposure. Operators must implement API gateways with schema validation, rate limiting, and authentication for every SBI endpoint, not just for external NFs.

CIS Control 4 (Secure Configuration) mandates that all NFs be deployed from hardened reference images. Default credentials, unnecessary services, and debug interfaces must be removed. This applies to both vendor-provided NFs and open-source alternatives like Open5GS or free5GC. Configuration baselines should align with 3GPP TS 33.501 Section 6.2 (security of network functions) and NIST SP 800-53 controls for access management.

RAN and Transport Layer (gNB, RU, DU, CU, N3/N9 Interfaces)

The 5G RAN splits the base station into a Radio Unit (RU), Distributed Unit (DU), and Central Unit (CU), communicating over the Fronthaul (RU-DU) and Midhaul (DU-CU) interfaces. The N3 interface between the CU-UP (User Plane) and the UPF (User Plane Function) carries all subscriber data traffic.

CIS Control 12 (Network Infrastructure Management) applies directly to interface segmentation. Operators must segment the N3 and N9 interfaces into dedicated VLANs or VXLANs with strict firewall rules. No management traffic should traverse the same network as user-plane traffic. Additionally, IPSec encryption is mandatory for N3/N9 interfaces per 3GPP TS 33.501, and CIS Control 13 (Network Monitoring and Defense) requires continuous traffic analysis on these interfaces to detect data exfiltration or unusual latency patterns that indicate tunneling.

CIS Control 1 (Inventory and Control of Enterprise Assets) is essential for RAN because gNB equipment is often physically distributed across cell sites. Each RU, DU, and CU must be inventoried by serial number, firmware version, and IP address. Telco asset management tools should automatically discover new gNB components and flag unauthorized devices.

Management and Orchestration Layer (MANO, OSS/BSS, SMO)

The Management and Orchestration (MANO) layer, including the Service Management and Orchestration (SMO) framework and OSS/BSS systems, has the highest privilege level in a 5G network. It provisions network slices, deploys VNFs/CNFs, and manages lifecycle operations. Unauthorized access here can deactivate entire networks or deploy malicious NFs.

CIS Control 5 (Account Management) and CIS Control 6 (Access Control Management) are paramount. MANO systems must enforce role-based access control (RBAC) with least privilege. Operator personnel should have separate accounts for management plane access vs. data plane access. Multi-factor authentication (MFA) is mandatory for any account that can modify NF configurations or network slices.

CIS Control 8 (Audit Log Management) requires centralized logging of all MANO actions. Every NF deployment, scaling event, configuration change, and API call to the network slice subnet management function (NSSMF) must be logged to a tamper-proof SIEM. For operators managing large 5G deployments, automated compliance assessment against these controls is critical — the CyberSilo CIS Benchmarking Tool supports automated audit log validation and configuration drift detection across MANO interfaces.

Network Slicing and Inter-Slice Security

Network slicing allows operators to create multiple logical networks (e.g., enhanced Mobile Broadband, Ultra-Reliable Low-Latency Communications, massive IoT) over a shared physical infrastructure. Each slice must be isolated to prevent a compromise in one slice from affecting others.

CIS Control 12 (Network Infrastructure Management) expands to include slice isolation policies. Operators should implement per-slice virtual networks with separate UPF instances, dedicated SBI endpoints, and slice-specific firewall policies. The Network Slice Subnet Management Function (NSSMF) must enforce that UPFs and NFs in one slice cannot communicate with NFs in another slice without explicit inter-slice authorization.

CIS Control 4 (Secure Configuration) applies to slice templates. A "golden" slice configuration baseline must be defined and enforced by automation. Any deviation — an NF in a slice with an open management port, for example — should trigger a compliance alert. The European Telecommunications Standards Institute (ETSI) NFV Security Guide and GSMA FS.34 Network Slicing Security Recommendations both emphasize this approach.

5G CIS Benchmark Implementation Guide: A Step-by-Step Process

Implementing CIS Controls across a 5G environment requires a phased approach that does not disrupt operational network functions. The following process is designed for telecom operators and managed security providers who need to harden existing 5G deployments or verify the security posture of new infrastructure.

Automated Compliance Assessment for 5G CIS Controls

Manual assessment of CIS Controls across hundreds or thousands of NFs, containers, and network nodes is impractical for any operator running production 5G infrastructure. Automated tools are essential for achieving continuous compliance, especially given the dynamic nature of cloud-native 5G deployments where new CNFs are deployed and scaled daily.

An effective automation platform for 5G CIS assessment must support:

• Multi-layer scanning: The tool must scan the host OS (Linux), container runtime (Docker/containerd), Kubernetes orchestration layer, and the 5G NF application itself. Each layer has distinct CIS Benchmarks.
• Custom benchmark creation: While the CIS Benchmarks for Linux and Kubernetes are standard, 3GPP-specific security requirements are not yet formalized as CIS Benchmarks. The tool should allow operators to create custom control rules based on 3GPP TS 33.501, GSMA FS.34, or NIST 800-53.
• Drift detection across distributed deployments: A 5G network may have NFs running in a central data center, edge data centers, and virtualized RAN nodes at cell sites. The compliance tool must aggregate results from all locations into a single dashboard.
• Remediation orchestration: When a control fails — for example, an AMF NF with TLS 1.2 enabled instead of TLS 1.3 — the tool should either remediate directly or trigger an automated workflow in the MANO layer.

The CyberSilo CIS Benchmarking Tool meets these requirements for 5G environments. It provides pre-built benchmarks for Linux, Kubernetes, Docker, and major database/application platforms, plus the flexibility to add custom rules for 3GPP-defined NFs. Its distributed scanning architecture means that a single console can assess compliance across core data centers, edge nodes, and gNB sites, with results aggregated into a single hardening score per network slice or per NF type.

CIS Controls vs. 3GPP Security Specifications: Where They Overlap and Diverge

Operators often ask whether CIS Controls replace or supplement 3GPP-defined security requirements. The answer is that they serve complementary roles. 3GPP TS 33.501 specifies security mechanisms at the protocol and interface level — what encryption algorithms to use, how authentication tokens are generated, and how the SEPP protects inter-PLMN communications. CIS Controls focus on operational security practices: inventory management, configuration hardening, access control, and continuous monitoring.

The table below highlights where the two frameworks overlap and where CIS Controls extend beyond 3GPP specifications:

The key takeaway: 3GPP specifications define the "what" of 5G security at the protocol level, while CIS Controls define the "how" of operational security management. Both are necessary for a comprehensive 5G security posture.

CIS Implementation Groups for 5G: Prioritizing Controls by Risk Tier

CIS Controls v8 is organized into three Implementation Groups (IGs) based on the organization's risk profile and resources. For 5G infrastructure, these groups translate naturally into prioritization tiers that operators can use to phase their hardening efforts:

• IG1 (Basic Cyber Hygiene) — Essential for all 5G deployments: Controls 1, 2, 4, 5, 6, 7, 8, 12, 13, 14, 15, 16. These cover fundamental inventory, configuration, access control, vulnerability management, and logging. Every 5G operator, regardless of size, should implement IG1 controls before deploying any production traffic.
• IG2 (Enhanced Security) — Required for multi-operator or regulated 5G: Adds Controls 3 (Data Protection), 9 (Email and Web Protections), 10 (Malware Defenses), 11 (Recovery Planning), 17 (Incident Response Management). This tier applies to operators serving government, financial, or healthcare subscribers, or those participating in multi-operator network sharing agreements.
• IG3 (Advanced Security) — For critical national infrastructure and defense 5G: Adds Control 18 (Penetration Testing). Operators deploying 5G for critical infrastructure, defense, or emergency services must implement full red-team testing and advanced threat detection.

Most operators should target IG1 as a minimum for all 5G infrastructure, then progress to IG2 for network slices handling sensitive data (e.g., enterprise network slices under GSMA FS.34). IG3 is appropriate for 5G networks supporting national security or emergency communications.

Common Pitfalls When Applying CIS Controls to 5G

Telecom operators frequently encounter specific challenges when translating CIS Controls to their 5G environments. Awareness of these mistakes can save significant time and reduce security gaps:

Pitfall 1: Applying only to the management plane. Many operators harden their OSS/BSS and MANO systems while leaving the 5G Core control plane NFs with vendor-default configurations. A hardened MANO is useless if the SMF or AMF are running with default credentials and open debug ports. CIS Control 4 must be applied to every NF, not just to management systems.

Pitfall 2: Ignoring container-specific controls. Cloud-native 5G deployments use containerized NFs that inherit vulnerabilities from base images, runtime misconfigurations, and overly permissive Kubernetes RBAC. Operators who apply CIS Benchmarks only to the host OS but not to the container runtime (Control 4 for containers) or Kubernetes (Control 12 for orchestration) leave major gaps.

Pitfall 3: Treating all network slices identically. A massive IoT slice has different security requirements than an ultra-reliable low-latency communications (URLLC) slice supporting industrial automation. CIS Control 12 segmentation policies should be tailored per slice type, not applied as a one-size-fits-all firewall rule set.

Pitfall 4: Overlooking inter-PLMN interfaces. The SEPP and N32 interface are the boundary between a home network and visited networks. A misconfigured SEPP can allow a compromised roaming partner to inject malicious traffic into the home network. CIS Control 4 and Control 12 must explicitly cover SEPP configuration, including N32 security policy, certificate validation, and connection filtering.

The Future of CIS Benchmarks for 5G

As of early 2025, the Center for Internet Security (CIS) has not yet published a dedicated CIS Benchmark for 5G Core Network Functions. However, the industry is moving toward formalized benchmarks for telecom infrastructure. The Open Network Automation Platform (ONAP), Linux Foundation Networking, and GSMA are all contributing to reference security configurations that could form the basis of future CIS Benchmarks.

In the interim, operators should use a combination of existing CIS Benchmarks plus custom controls mapped to 3GPP TS 33.501 and GSMA FS.34. Platforms like the CyberSilo CIS Benchmarking Tool allow operators to build, test, and enforce custom benchmarks today, with the flexibility to adopt official CIS Benchmarks as they become available for 5G-specific components.