FCC CSRIC Best Practices → GSMA FS.11
The FCC does not prescribe SS7 controls directly, but CSRIC (Communications Security, Reliability, and Interoperability Council) has issued detailed best practices for SS7 and Diameter security. These practices align closely with GSMA FS.11.
Scope: CSRIC VI Working Group 10 recommendations on legacy signalling.
| Category | FCC CSRIC Best Practices | GSMA FS.11 | Notes |
|---|---|---|---|
| Threat awareness | CSRIC WG10 BP-01 | FS.11 §3 | Both start from the same category-based threat model. |
| Filtering | CSRIC WG10 BP-04/05 | FS.11 §4 | Cat-1 drop, Cat-2 velocity, Cat-3 plausibility. |
| Monitoring | CSRIC WG10 BP-07 | FS.11 §7 | CSRIC emphasises sharing indicators via ISACs. |
| Roaming partners | CSRIC WG10 BP-09 | FS.11 §5 | Both require formal roaming-partner risk assessments. |
Gaps
- CSRIC is voluntary; FS.11 is required by GSMA membership. Enforcement mechanisms differ sharply.
- STIR/SHAKEN sits in a separate CSRIC track (WG6) and has no GSMA equivalent.
Key takeaways
- US operators implementing FS.11 satisfy nearly all CSRIC WG10 signalling BPs.
- CSRIC compliance is voluntary — evidence is not audited outside major incidents.
- STIR/SHAKEN is a separate obligation and not covered by FS.11.