Compliance Crosswalks

Crosswalks mapping regulations (NIS2, UK TSA, FCC CSRIC, ENISA 5G Toolbox, ISO 27001, 3GPP TS 33.501) to concrete GSMA FS.11 / FS.19 / FS.21 signalling controls.

• NIS2 Directive → GSMA FS.11 (SS7 Interconnect Security)
  NIS2 mandates that essential entities implement risk-management measures proportionate to their exposure. For mobile operators the concrete implementation of the "network security"…
• NIS2 Directive → GSMA FS.19 (Diameter Interconnect Security)
  FS.19 is the GSMA baseline for Diameter interconnect security — the Diameter equivalent of FS.11. This crosswalk shows how NIS2 obligations for LTE roaming map to FS.19 controls, a…
• NIS2 Directive → GSMA FS.21 (5G Interconnect Security)
  FS.21 defines the 5G interconnect security baseline. It builds on 3GPP TS 33.501 SEPP requirements and adds operational guidance. This crosswalk maps NIS2 obligations to FS.21 cont…
• UK Telecommunications (Security) Act → GSMA FS.11 / FS.19 / FS.21
  The UK TSA and its Ofcom Code of Practice are prescriptive: each measure must be evidenced. This crosswalk shows how the signalling-plane measures in the Code map onto the GSMA int…
• FCC CSRIC Best Practices → GSMA FS.11
  The FCC does not prescribe SS7 controls directly, but CSRIC (Communications Security, Reliability, and Interoperability Council) has issued detailed best practices for SS7 and Diam…
• ENISA 5G Cybersecurity Toolbox → GSMA FS.21
  The EU 5G Toolbox defines strategic (SM) and technical (TM) measures member states apply to reduce 5G risk. This crosswalk maps the technical measures to GSMA FS.21 where they conc…
• NIS2 Directive → NIST CSF 2.0
  Many multinational operators run their control library on NIST CSF while facing NIS2 obligations in Europe. This crosswalk maps NIS2 Article 21 to CSF 2.0 functions so the same evi…
• ISO/IEC 27001:2022 → GSMA FS.11
  Most operators hold ISO 27001 certification for their ISMS. This crosswalk shows how Annex A controls map to FS.11 signalling security requirements so certification evidence can be…
• 3GPP TS 33.501 → GSMA FS.21
  3GPP TS 33.501 is the normative 5G security architecture. FS.21 is the operator-facing implementation baseline. This crosswalk clarifies which parts of 33.501 FS.21 operationalises…
• India DoT Security Directives → GSMA FS.11 / FS.19
  India's DoT enforces telecom security through licence conditions on the Unified Access Service Licence and the Trusted Telecom Portal. This crosswalk shows how DoT signalling and i…