6G Security Guide: What Standards Bodies Are Planning

6G security is being decided now, in standards meetings, years before any operator switches on a 6G network, and most of the decisions that matter to defenders will be locked in by the end of 2028. This guide sets out what ITU-R and 3GPP have actually agreed so far, with dates, and separates finished work from studies that are still open. It explains which security problems the standards bodies have put on the table (quantum-safe cryptography, AI in the network, sensing privacy, cloud-native cores and non-terrestrial access), what is likely to carry over from 5G, and what operators, enterprises and product teams should do in the next two years. It is written for telecom security engineers, enterprise architects who buy private or sliced mobile connectivity, and security leaders who need a dated, hype-free view. Status is as checked on 26 October 2026; standards timelines move, so treat every date as the plan of record on that day, not a promise.

Key takeaways

• The framework exists, the specifications do not. ITU-R Recommendation M.2160 (the IMT-2030 framework) was approved in November 2023, but 3GPP is still in the 6G study phase in Release 20, and the first normative 6G specifications arrive in Release 21, with the stage 3 freeze planned for December 2028.
• Security is a named capability, not an afterthought. M.2160 lists "security and resilience" among the IMT-2030 capabilities, and 3GPP SA3 runs a dedicated study, FS_6G_SEC, with a draft technical report (TR 33.801-01) due for information in December 2026 and approval in June 2027.
• Post-quantum cryptography is in scope from day one. SA3 has separate Release 20 studies on transitioning to post-quantum cryptography (FS_CryptoPQC) and on AEAD algorithms (FS_AEAD), so 6G is the first mobile generation designed with the quantum threat in view.
• New features bring new attack surface. AI and communication (AIAC) and integrated sensing and communication (ISAC) are two of the six IMT-2030 usage scenarios. Sensing in particular raises privacy questions that 3GPP has only started to scope.
• Most 6G risk will still look like 5G risk. Stolen credentials, exposed management interfaces, roaming abuse and supplier compromise drove recent telecom intrusions. The best preparation for 6G is fixing those in 5G and 5G-Advanced networks now.

Where 6G standardisation stands (October 2026)

Two bodies matter. ITU-R Working Party 5D defines what a 6G system must achieve under the name IMT-2030. 3GPP writes the specifications that vendors build and that will be submitted to ITU-R as a candidate radio interface technology. Regional bodies such as ETSI transpose 3GPP output, and industry groups such as the GSMA handle roaming and operational guidance.

3GPP's own Release 20 page cites the ITU-R plan of technology proposals in early 2029 and full system specifications by mid-2030 at the latest. Commercial 6G launches are therefore unlikely before around 2030, and anyone selling "6G security" products today is selling 5G-Advanced capabilities or research prototypes. That is the honest baseline for any board or procurement conversation.

What IMT-2030 asks of security

M.2160 defines six usage scenarios. Three extend 5G (immersive communication, hyper reliable and low latency communication, massive communication) and three are new (ubiquitous connectivity, AI and communication, integrated sensing and communication). Each changes the threat model in a different way.

M.2160 lists "security and resilience" among the enhanced capabilities, described on the ITU-R page as enhanced protection against cyber threats. The framework sets the goal; it does not specify mechanisms. Those come from 3GPP.

What 3GPP SA3 is studying for 6G

3GPP SA3 is the working group responsible for security and privacy. Release 20 carries four security related 6G studies, listed on 3GPP's Release 20 page:

• FS_6G_SEC, Security for the 6G System: the main study. The draft study item sets four work tasks: security and privacy of the overall 6G system architecture; security and privacy of the 6G RAN architecture including all UE to RAN interactions (with an access stratum checkpoint with RAN groups by June 2026); security and privacy of UE to core network interactions; and core network enhancements, covering transport and application layer endpoint security, internal and external interfaces and end to end roaming security, coordinated with the GSMA.
• FS_CryptoPQC, Transitioning to post-quantum cryptography: how 3GPP protocols move off quantum-vulnerable public key algorithms. This matters for subscriber identifier concealment, certificate based interfaces and roaming security, which all use public key cryptography today.
• FS_AEAD, Supporting AEAD algorithms: authenticated encryption with associated data for 3GPP protection, aligned with how modern protocols such as TLS 1.3 already work.
• FS_6G_LI, Lawful interception for 6G: handled by SA3-LI. Interception capability is a security concern in its own right: the Salt Typhoon intrusions into US telecoms showed what happens when attackers reach the systems that hold this kind of access.

The draft study item also names topics as inputs rather than formal work tasks: authentication, quantum computer threats and quantum-safe algorithms, cloud and virtualisation of RAN and core functions, AI/ML security, sensing, non-terrestrial networks, network slicing, the service based architecture, non-3GPP access, and user privacy and exposure risks. A separate SA3 contribution proposes a sensing security and privacy area covering detection and tracking of passive objects (humans, vehicles, automated guided vehicles and drones) across several sensing modes, and notes that the existing Release 19 work (TR 33.777) covers only base station monostatic sensing of aerial targets. Its threat analysis is still marked for further study. In plain terms: the 6G security architecture has not been designed yet, and contributions are still open.

What carries over from 5G, and what is genuinely new

6G will not start from zero. The 5G security architecture in 3GPP TS 33.501 introduced a home network controlled authentication model (5G-AKA and EAP-AKA'), concealment of the permanent subscriber identifier (SUPI) as a SUCI using public key encryption, a security edge protection proxy (SEPP) for roaming, and TLS and OAuth 2.0 on the service based core. The 5G Security Guide covers these in depth. See the 5G Security Guide.

Symmetric cryptography is the reassuring part. Shor's algorithm breaks RSA and elliptic curve schemes, not AES-class ciphers, so the long term subscriber key on the SIM and the symmetric key hierarchy are far less exposed than the public key elements. The work is in the public key pieces: SUCI, certificates on network function interfaces, and roaming. For how organisations should approach the transition generally, see the Post-Quantum Cryptography Migration Guide and, for the choice between quantum key distribution and PQC, the QKD vs Post-Quantum Cryptography Guide.

Where identity fits

Every 6G trend multiplies non-human identities. A cloud native core is thousands of network functions calling each other with OAuth 2.0 access tokens and TLS certificates. AI-native RAN adds model pipelines that need credentials to pull training data and push updates. Massive communication adds device credentials by the hundred million. In the Salt Typhoon intrusions, attackers logged in to network devices with legitimate credentials, harvested SNMP community strings and TACACS and RADIUS shared keys, and in one case stayed for more than three years. None of that needed a new radio technology. See the Salt Typhoon telecom intrusions analysis and the Telecoms Identity Security Guide.

• Network function identity: issue short lived certificates and tokens per network function instance, with automated rotation, and inventory them. See the Machine Identity, PKI and Certificate Lifecycle Guide.
• Device identity at scale: plan provisioning, rotation and revocation before launching massive IoT services. See the Identity for IoT Fleets Guide.
• Management plane credentials: operator admin accounts, vendor support accounts and automation service accounts are the real crown jewels and need privileged access controls today.

Decision guidance: what to do before 6G exists

What you should do depends on who you are. Most organisations will consume 6G as a service, so their influence is through procurement and contract terms, not standards meetings.

The common thread is crypto-agility. Equipment bought in 2026 may still be in service when 6G and full PQC migration arrive. See the Crypto-Agility Guide.

A phased preparation plan

1. Baseline today's network (now): inventory network functions, management interfaces, interconnect links and every credential they use. Use the Cryptographic Inventory and CBOM Guide approach to record which algorithms protect which interfaces.
2. Close 5G gaps (2026 to 2027): enforce TLS and token authorisation between core network functions, remove shared and default credentials on network devices, move device management to centralised authentication with MFA, and monitor configuration changes.
3. Track standards with a named owner (continuous): assign someone to follow TR 33.801-01 drafts, FS_CryptoPQC and the ITU-R evaluation process, and to brief architecture boards every quarter.
4. Pilot quantum-safe interfaces (2027 onwards): test hybrid post-quantum key exchange on management and interconnect TLS in a lab, measure handshake size and latency effects, and keep a rollback path to the current configuration.
5. Write 6G security into procurement (2027 to 2028): require Release 21 security feature support, published vulnerability handling, software bill of materials, and PQC roadmaps from suppliers. See the Software Supply Chain Security Guide.
6. Test before launch (2029 onwards): run conformance and adversarial testing on pre-commercial equipment in a separate test network, with go and no-go criteria tied to security findings, and a documented fallback to 5G-Advanced service.

Detection and measurement

6G will be monitored with the same disciplines as 5G: signalling, management plane and identity telemetry. Start collecting what you will need.

• Signalling anomalies: unusual authentication failures, identifier requests and roaming signalling at interconnect points.
• Management plane changes: new local accounts, added SSH keys, changed AAA or TACACS+ servers and access list edits, the exact persistence moves seen in Salt Typhoon. Adversary-in-the-middle (T1557) and network sniffing (T1040) on management traffic are relevant ATT&CK techniques.
• Supplier access: vendor remote sessions, mapped to Trusted Relationship (T1199) abuse.
• AI function behaviour: model versions deployed, who approved them, and drift in decisions such as handover or resource allocation.

Metrics that show readiness:

• Percentage of network function interfaces with a recorded algorithm and key length in the cryptographic inventory.
• Percentage of network device and function credentials that are unique, centrally managed and rotated on schedule.
• Mean time to detect an unauthorised configuration change on core or transport devices.
• Percentage of new network equipment contracts containing crypto-agility and PQC roadmap clauses.
• Number of open SA3 study topics with an internal owner and position.

Common failure patterns

• Treating 6G as a future problem. The architecture is being decided in 2026 to 2028; equipment bought now will interoperate with it. Organisations that wait for launch inherit decisions they had no part in.
• Believing pre-standard claims. Until Release 21 is frozen, "6G-ready security" has no defined meaning. Ask which 3GPP release and specification a claim refers to.
• Ignoring the management plane. Radio security improves every generation; the intrusions that hurt operators came through credentials and device configurations, as the Salt Typhoon case shows.
• Hard-coding cryptography. Equipment and devices with fixed algorithms will block PQC migration for a decade.
• Treating sensing data as telemetry. Radio sensing that detects people is personal data and will fall under privacy law; governance needs to exist before the feature is switched on.
• Letting AI functions run without change control. A model update in the RAN is a software change and needs the same approval, signing and rollback as any other.

Lessons from incidents

No incident has involved 6G, because no 6G network exists. The closest lessons come from telecom intrusions on current networks. The Salt Typhoon intrusions relied on legitimate credentials far more than on vulnerabilities, stole device configurations containing weakly protected passwords and SNMP community strings, captured authentication traffic to harvest shared keys, and moved from one operator's network into another's. Each of those weaknesses (shared secrets set once and never rotated, management access without MFA, missing alerting on identity changes) would survive a move to 6G untouched. See also the Telecom Network Security Guide.

Framework mapping

CIS Controls v8.1 apply mainly through Control 1 (asset inventory), Control 3 safeguard 3.10 (encrypt sensitive data in transit), Control 12 (network infrastructure management) and Control 15 (service provider management).

Practitioner checklist

• Record the current ITU-R and 3GPP milestones (M.2160, Release 20, Release 21 freeze December 2028) in your technology roadmap, with a review date.
• Name an owner to track TR 33.801-01, FS_CryptoPQC and FS_AEAD, and brief architecture boards quarterly.
• Build a cryptographic inventory of RAN, core, transport and management interfaces.
• Remove shared, default and weakly protected credentials from network devices and move admin access to central authentication with MFA.
• Alert on new local accounts, SSH keys and AAA server changes on network equipment.
• Add crypto-agility, PQC roadmap, SBOM and vulnerability handling clauses to network equipment and private network contracts.
• Pilot hybrid post-quantum key exchange on management TLS in a lab with a rollback plan.
• Draft governance rules for sensing and AI functions before they are offered: who can request, what is logged, how long data is kept.

Standards and references

• ITU-R: IMT-2030 (6G) and Recommendation ITU-R M.2160
• 3GPP: Release 20
• 3GPP: Release 21
• 3GPP TSG SA: Draft study item on security for the 6G system (FS_6G_SEC)
• 3GPP SA3: Draft contribution on 6G sensing security and privacy
• NIST: First three finalised post-quantum encryption standards
• NCSC: Timelines for migration to post-quantum cryptography

Related NHI Mgmt Group resources: 5G Security Guide · Telecom Network Security Guide · Telecoms Identity Security Guide · Satellite IoT and Satellite Communications Security Guide · Post-Quantum Cryptography Migration Guide