FS.31 Baseline Security Controls v5.0

The latest changes include the following:

1. Provision of a new table in section 1.3 suggesting how completion of an assessment checklist could be assigned across personnel and/or teams
2. Recognition that team structures, and the allocation of responsibilities, can vary from one network operator to another
3. Change to the solution description, point 9, for control NFVI-VS-002
4. Change to the solution description, point 7, for control CC-007
5. Promotion of Mobile Edge Computing Platform Controls to section 2.2.10
6. Change to the solution description, point 3, for control NO-010

The checklist and dashboard to help operators assess and record the degree to which the controls have been implemented, and the maturity of their implementation, have been restored to Annex C. This is designed to provide a high-level illustration, domain by domain, for senior management of the operator’s security posture. We hope you find this helpful as work is ongoing within FSAG to enhance further the value of the controls document and the checklist and how these important resources can be fully leveraged.

FS.31 is a living document and work is already advanced on another significant update that will be captured in another substantive change request, CR1006. I am grateful to the FSAG members that contributed to CR1005 and to those that are currently working on CR1006. If you wish to get involved in the ongoing work to ensure FS.31 is the best resource it can be for GSMA members, and/or if you have a contribution you would like to make to enhance the controls, just let me know and I will do what is necessary to facilitate that.