Telecom operators run interconnected networks, equipment in other carriers' buildings and lawful obligations around essential communications that a generic ISO/IEC 27001 control set never anticipated. ISO/IEC 27011 fills that gap: it gives guidance for implementing ISO/IEC 27002 information security controls in telecommunications organisations, plus 14 controls marked "TEL" that exist only for telecoms. The current edition is ISO/IEC 27011:2024 (edition 3, published March 2024), developed in common with ITU-T Recommendation X.1051 (06/2023), which ITU publishes as a free PDF. This guide explains scope, the TEL controls, identity and machine credential issues in operator networks, implementation, evidence and mapping to the laws that now bind operators. It is for ISMS managers, network security leads and auditors at mobile, fixed and cable operators, wholesale carriers and their managed service providers.
Key takeaways
- It is sector guidance, not a separate certificate: you certify an ISMS to ISO/IEC 27001 and use 27011 to select and implement controls, citing it in the Statement of Applicability (SoA).
- The 2016 edition is withdrawn: ISO recorded the withdrawal of ISO/IEC 27011:2016 on 28 March 2024 and replaced it with ISO/IEC 27011:2024, aligned to the 2022 control structure.
- The text is free through ITU: ITU-T X.1051 (06/2023) is in force, shares its contents listing with ISO/IEC 27011:2024 and is freely downloadable from ITU, which helps small operators and suppliers.
- Fourteen TEL controls add telecom duties: interconnection, service delivery, spam, DoS and DDoS response, non-disclosure of communications, essential communications, emergency actions, incident coordination, physical sites and carrier authentication.
- Machine credentials run the network: network element accounts, OSS and BSS service accounts, signalling interconnects and lawful intercept systems are where state actors have persisted for years.
What it is and who it applies to
ISO/IEC 27011:2024, "Information security, cybersecurity and privacy protection: Information security controls based on ISO/IEC 27002 for telecommunications organizations", is published by ISO/IEC JTC 1/SC 27 and runs to 28 pages. ISO's abstract says it provides guidelines supporting the implementation of information security controls in telecommunications organisations, so they can meet baseline requirements for confidentiality, integrity, availability and other relevant security properties. It is the third edition, after ISO/IEC 27011:2008 and ISO/IEC 27011:2016 (with corrigendum 1:2018), both now withdrawn.
| Document | Publisher | Status checked 8 November 2026 |
|---|---|---|
| ISO/IEC 27011:2024 (edition 3) | ISO/IEC JTC 1/SC 27 | Published, March 2024 |
| ITU-T X.1051 (06/2023) | ITU-T | In force, approved 13 June 2023; English PDF free |
| ISO/IEC 27011:2016 (edition 2) | ISO/IEC JTC 1/SC 27 | Withdrawn 28 March 2024 |
| ISO/IEC 27011:2008 (edition 1) | ISO/IEC JTC 1/SC 27 | Withdrawn |
It applies to any organisation providing telecommunications services: mobile and fixed network operators, cable and satellite providers, wholesale and transit carriers, and the managed service providers that operate networks for them. It is not a law. In the UK, the binding duties come from the Telecommunications (Security) Act and its code of practice, explained in the UK Telecommunications Security Act Guide; 27011 is a way to organise and evidence controls that support such duties. The Telecoms Security Laws Map covers other jurisdictions.
Where it sits among sector extensions
ISO/IEC 27011 is one of several sector or domain extensions to ISO/IEC 27002. Operators often need more than one, because a telecom group may also run cloud services and process large volumes of personal data.
| Extension | Focus | When a telecom operator also needs it |
|---|---|---|
| ISO/IEC 27011 | Telecommunications organisations | Always, for network and service operations |
| ISO/IEC 27017 | Cloud services | When offering cloud, edge or hosting services; see the ISO/IEC 27017 Cloud Security Controls Guide |
| ISO/IEC 27018 | PII in public cloud | When acting as a public cloud processor of personal data |
| ISO/IEC 27701 | Privacy information management | For subscriber data, location data and call records; see the ISO/IEC 27701 Privacy Information Management Guide |
Decision guidance: where a national law sets telecom security duties, treat the law as the requirement and 27011 as the control catalogue that structures your evidence; where no specific law applies, 27011 inside an ISO/IEC 27001 certificate is the most widely recognised way to show customers and wholesale partners a telecom-appropriate baseline.
Structure and key requirements
The contents follow ISO/IEC 27002:2022 themes, extended with telecom controls numbered after the generic ones: organisational controls 5.1 to 5.45, people controls 6.1 to 6.8, physical controls 7.1 to 7.19 and technological controls 8.1 to 8.35. For the generic controls the standard adds telecom implementation guidance where needed. The TEL controls, as listed in the ITU-T X.1051 contents, are:
| Control | TEL control title | What it means in practice |
|---|---|---|
| 5.38 | Interconnected telecommunications services | Security terms and filtering at interconnects with other carriers, including signalling; see the SS7 and Diameter Signalling Security Guide |
| 5.39 | Security management of telecommunications services delivery | Defined security levels for services delivered to customers, with monitoring |
| 5.40 | Response to spam | Detection and handling of unsolicited messages; see the Scam Prevention in Telecoms Guide |
| 5.41 | Response to DoS/DDoS attacks | Upstream mitigation, scrubbing and customer notification procedures (ATT&CK T1498 Network Denial of Service) |
| 5.42 | Non-disclosure of communications | Protecting the content and existence of customer communications, including from insiders |
| 5.43 | Essential communications | Priority for emergency and other essential communications during incidents |
| 5.44 | Legality of emergency actions | Making sure emergency measures such as blocking or rerouting traffic have a lawful basis |
| 5.45 | Coordination for information security incident management | Incident coordination with other carriers, CSIRTs and authorities |
| 7.15 | Securing communication centres | Physical protection for switching and network operations centres |
| 7.16 | Securing telecommunications equipment room | Access control and monitoring for equipment rooms |
| 7.17 | Securing physically isolated operation areas | Unmanned sites such as masts, cabinets and remote exchanges |
| 7.18 | Equipment sited in other carriers' premises | Co-location controls and access rules agreed with host carriers |
| 7.19 | Equipment sited in user premises | Customer premises equipment protection and remote management |
| 8.35 | Telecommunications carrier identification and authentication by users | Letting users verify they are connected to the genuine carrier, for example network authentication in mobile access |
Annex A adds guidance on network security: measures against network attacks (protection and drawing users' attention) and measures for network congestion (gathering information and countermeasures). The practical descriptions in the right-hand column are NHI Mgmt Group's interpretation of the titles; read the free X.1051 text for the exact guidance. Because the TEL controls are numbered after the generic controls in each theme, an existing 2022 SoA can absorb them as new rows without renumbering anything.
Identity and NHI requirements
An operator network is run mostly by machines talking to machines: routers and switches, radio access and core network functions, OSS and BSS platforms, provisioning systems, signalling gateways and lawful intercept systems. The generic controls 5.16 Identity management, 5.17 Authentication information, 5.18 Access rights, 8.2 Privileged access rights and 8.5 Secure authentication apply to all of them.
- Network element credentials: shared local administrator accounts and SNMP community strings on routers survive for years. Centralise device authentication (TACACS+ or RADIUS), vault the local fallback credentials and rotate them. The Salt Typhoon telecom intrusions mostly began with stolen legitimate credentials (with a Cisco Smart Install flaw likely abused in one case), then harvested SNMP community strings and weak local passwords from device configurations; Cisco Talos saw access kept for more than three years in one instance; see the Salt Typhoon Threat Actor Profile.
- OSS and BSS service accounts: provisioning, mediation and billing integrations hold broad rights across customer and network data. Give each a single purpose, restrict it by source and alert on interactive use.
- Customer facing APIs: account and SIM management APIs are a direct path to customer data and number takeover. The T-Mobile API breach shows how one abused API exposed data on 37 million accounts; strong client authentication, rate limits and data minimisation matter.
- SIM swap and porting: store staff and dealer accounts that can move a number are a high value identity. Apply step-up verification and monitoring, as covered in the SIM Swap Fraud Guide.
- Vendor and managed service access: equipment vendors and outsourced NOCs often hold privileged remote access. Route it through controlled jump hosts with individual accounts, MFA and session recording. The Telecoms Identity Security Guide covers patterns in depth.
Implementation steps
- Get the text: download ITU-T X.1051 (06/2023) free from ITU or buy ISO/IEC 27011:2024, and retire references to the 2016 edition.
- Scope the ISMS around the network: include core, access and transport networks, OSS and BSS, interconnects, co-located equipment, customer premises equipment management and managed service providers.
- Build the asset and identity inventory: network elements, management planes and every account or credential that can change configuration or read traffic.
- Run the risk assessment: include signalling abuse, DDoS, interception, SIM swap, insider disclosure and supply chain compromise of network equipment, and rate impact on essential communications.
- Rebuild the SoA: move to the 2022 control structure and add the 14 TEL controls, with justified exclusions where a control does not apply (for example 7.19 for a pure wholesale carrier). See the ISO 27001 Statement of Applicability Template.
- Prioritise the management plane: separate management networks, centralised device authentication, vaulted break-glass credentials, logging of all configuration changes.
- Test without breaking service: pilot changes such as new access control lists or authentication on a lab or a single region, schedule production changes in maintenance windows and keep tested configuration rollbacks for every element changed.
- Coordinate externally: agree incident coordination (5.45) and DDoS response (5.41) procedures with peers, upstream providers and the national CSIRT, and exercise them.
Small provider or national operator
A regional ISP or MVNO can use the free X.1051 text as its control catalogue, focus on management plane security, DDoS arrangements with its upstream and customer account protection, and inherit physical controls from host carriers through contracts (7.18). A national operator needs a dedicated network security function, signalling firewalls, a formal lawful intercept security regime and continuous monitoring of network element integrity, often driven by statutory duties.
Evidence and assessment
| Evidence | What an auditor checks | Metric to track |
|---|---|---|
| Scope and network asset inventory | Core, access, OSS and BSS, interconnects and co-located equipment included | Percentage of network elements in inventory with owner and software version |
| SoA with TEL controls | All 14 TEL controls addressed, exclusions justified | Open SoA gaps |
| Device authentication and credential records | Central authentication, vaulted local accounts, rotation evidence | Percentage of network elements using central authentication; shared local credentials older than 90 days |
| Interconnect agreements and filtering rules | Security terms with peers, signalling filtering in place | Blocked malicious signalling messages per month |
| DDoS and incident exercises | Procedures tested with upstreams and peers | Time to mitigate in exercises |
| Privileged session logs | Vendor and NOC sessions recorded and reviewed | Percentage of privileged sessions recorded |
Mapping to other frameworks
| Topic | ISO/IEC 27011:2024 control | ISO/IEC 27001:2022 Annex A | NIST CSF 2.0 |
|---|---|---|---|
| Identity and credentials for network elements | 5.16, 5.17, 8.5 | A.5.16, A.5.17, A.8.5 | PR.AA-01 |
| Privileged and vendor access | 5.18, 8.2 | A.5.18, A.8.2 | PR.AA-05 |
| Interconnection with other carriers | 5.38 TEL | A.5.19 to A.5.22 (nearest) | GV.SC-05 |
| DoS and DDoS response | 5.41 TEL | A.5.24, A.8.20 | DE.CM-01, RS.MA-01 |
| Incident coordination | 5.45 TEL | A.5.5, A.5.24 | RS.MA-01 |
| Physical sites and co-location | 7.15 to 7.19 TEL | A.7.1 to A.7.4 | PR.AA-06 |
| Configuration of network elements | 8.9 | A.8.9 | PR.PS-01 |
For architecture-level controls see the Telecom Network Security Guide and, for 5G, the 5G Security Guide.
Common pitfalls
- Citing the withdrawn edition: SoAs built on ISO/IEC 27011:2016 and the 2013 numbering need rebuilding for the 2024 structure.
- Leaving out the TEL controls: using only generic Annex A misses interconnection, essential communications and co-location duties that auditors and regulators expect.
- Treating the management plane as internal: shared device passwords and flat management networks let one stolen credential reach the whole network.
- Weak dealer and store access: SIM swap and porting fraud usually run through legitimate staff or dealer accounts, not technical exploits.
- DDoS plans never tested with upstreams: procedures written but not exercised fail on the day.
- Co-location left to the host: equipment in another carrier's building (7.18) is still your asset; without agreed access lists, escort rules and visit logs you cannot show who touched it.
- Lawful intercept systems outside the ISMS: these systems hold the most sensitive data an operator has, and their administrator and mediation accounts need the strictest privileged access controls, separation of duties and audit, in line with the non-disclosure duty in 5.42.
- Emergency actions without legal review: blocking or rerouting traffic without a documented lawful basis can breach the duty that 5.44 addresses.
Practitioner checklist
- Download ITU-T X.1051 or buy ISO/IEC 27011:2024 and retire the 2016 edition.
- Scope the ISMS to include interconnects, co-located and customer premises equipment.
- Add all 14 TEL controls to the SoA with justified exclusions.
- Move network element authentication to a central service and vault local accounts.
- Inventory OSS, BSS and API service accounts with named owners.
- Put vendor and outsourced NOC access behind recorded, MFA protected jump hosts.
- Apply step-up checks and monitoring to SIM swap and number porting.
- Exercise DDoS and incident coordination with peers and upstreams every year.
- Map 27011 controls to your national telecom security duties.
- Bring lawful intercept and co-located equipment explicitly into ISMS scope, with access records and privileged session review for both.
Standards and references
- ISO: ISO/IEC 27011:2024 Information security controls based on ISO/IEC 27002 for telecommunications organizations
- ITU-T: Recommendation X.1051 (06/2023)
- ITU-T: X.1051 (06/2023) table of contents
- ISO: ISO/IEC 27011:2016 (withdrawn)
- ISO: ISO/IEC 27002:2022 Information security controls
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: UK Telecommunications Security Act Guide · Telecoms Identity Security Guide · Telecom Network Security Guide · ISO 27002 Controls Guide. This guide summarises ISO/IEC 27011 and ITU-T X.1051 as listed at 8 November 2026 and is not legal advice.