NIST - National Institute of Standards and Technology

09/24/2026 | Press release | Distributed by Public on 09/25/2026 03:24

Open Radio Access Network (O-RAN) Near-Real Time RAN Intelligent Controller (RIC) Security

Published
September 24, 2026

Author(s)

Scott Rose, Oliver Borchert, Simeon Wuthier, Douglas Montgomery

Abstract

Radio Access Networks (RANs) are used to connect mobile network customer devices to the core network and the internet. Open RAN (ORAN) is an effort to have a standardized set of components and interfaces for the RAN so that a mobile network operator can deploy and operate a network composed of (potentially) multiple vendor components. ORAN also seeks to specify the RAN control plane as a set of services. This allows ORAN network management functions to be operated on any virtualization platform as a service-based architecture. This also allows for the use of specialized software components to provide additional features, automation or management through a new element called the RAN Intelligent Controller (RIC). This move from legacy RANs to service-based RAN with a RIC introduces new security threats and a call for using zero trust architecture for ORAN. This report discusses the status of zero trust in ORAN and further considerations for realizing a zero trust for ORAN.
Citation
NIST Interagency/Internal Report (NISTIR) - 8625
Report Number
8625
Pub Type
NIST Pubs

Keywords

ORAN, Open RAN, RAN Intelligent Controller (RIC), rApp, xApp, zero trust.

Citation

Rose, S. , Borchert, O. , Wuthier, S. and Montgomery, D. (2026), Open Radio Access Network (O-RAN) Near-Real Time RAN Intelligent Controller (RIC) Security, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.8625, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=962765 (Accessed September 25, 2026)
Additional citation formats

Issues

If you have any questions about this publication or are having problems accessing it, please contact [email protected].

NIST - National Institute of Standards and Technology published this content on September 24, 2026, and is solely responsible for the information contained herein. Distributed via Public Technologies (PUBT), unedited and unaltered, on September 25, 2026 at 09:24 UTC. If you believe the information included in the content is inaccurate or outdated and requires editing or removal, please contact us at [email protected]