NIS2 Directive → GSMA FS.11 (SS7 Interconnect Security)
NIS2 mandates that essential entities implement risk-management measures proportionate to their exposure. For mobile operators the concrete implementation of the "network security" clause is the GSMA FS.11 baseline for SS7 interconnect. This crosswalk maps NIS2 Article 21 categories to specific FS.11 controls.
Scope: Covers SS7 (MAP/CAP) interconnect only. Diameter/SEPP crosswalks are separate.
| Category | NIS2 Directive | GSMA FS.11 (SS7 Interconnect Security) | Notes |
|---|---|---|---|
| Risk analysis policy | NIS2 Art.21(2)(a) | FS.11 §3 – Threat model | FS.11 categorises SS7 messages by risk tier (Cat 1/2/3). |
| Incident handling | NIS2 Art.21(2)(b) | FS.11 §7 – Monitoring & reporting | Requires signalling monitoring able to detect Cat-2/3 anomalies. |
| Business continuity | NIS2 Art.21(2)(c) | FS.11 Annex A – Firewall bypass | Redundant SS7 firewalls at all STP peering points. |
| Supply-chain security | NIS2 Art.21(2)(d) | FS.11 §5 – Roaming partner assessment | Applies to IPX carriers and hub roaming aggregators. |
| Network security | NIS2 Art.21(2)(e) | FS.11 §4 – Message filtering rules | Filter Cat-1 at all borders; velocity-check Cat-2. |
| Vulnerability handling | NIS2 Art.21(2)(f) | FS.11 §6 – Testing | Recommends annual SS7 penetration testing. |
| Cryptography | NIS2 Art.21(2)(h) | FS.11 §4.6 – MAPsec (informative) | MAPsec is rarely deployed; TLS on SIGTRAN is the practical control. |
| Access control (MFA) | NIS2 Art.21(2)(j) | FS.11 §8 – Firewall admin access | MFA for firewall rule changes; separate operator and admin roles. |
Gaps
- FS.11 does not cover Diameter or 5G SBI — pair with FS.19 and FS.21 for full-stack coverage.
- NIS2 supply-chain expectations exceed FS.11 §5 — combine with GSMA IR.77 for IPX due diligence.
- FS.11 is a baseline, not a certification — NIS2 auditors may require FS.11 plus evidence of continuous monitoring.
Key takeaways
- FS.11 satisfies the "network security" NIS2 clause for SS7, but not the full Article 21.
- Diameter and 5G interconnect need separate crosswalks (FS.19 / FS.21).
- Incident notification timelines (NIS2: 24h early warning) drive signalling monitoring requirements.