Source context: this article examines information published by the source on October 08, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What was published
On October 8, 2026, NIST released two Interagency Reports addressing the security of Open Radio Access Networks (O-RAN) within advanced 5G mobile networks: NIST IR 8625 and NIST IR 8623.
Status and scope
NIST IR 8625 is a final report. NIST IR 8623 is a draft community profile intended for federal agencies deploying O-RAN as part of their IT infrastructure; it is currently open for public comment until November 2, 2026.
What the guidance covers
NIST IR 8625 (RIC Security):
This report focuses on RAN Intelligent Controllers (RICs), which are used to configure, monitor, and control RAN resources. It specifically addresses:
* The security requirements for RICs and their associated specialized applications, known as rApps and xApps.
* Standardized interfaces used by these applications to ensure confidentiality, authorization, and authentication.
* Current security features and the trajectory toward implementing a strict zero trust architecture (ZTA) for RICs and their apps.
NIST IR 8623 (CSF 2.0 Profile):
This draft profile maps O-RAN components that conform to O-RAN ALLIANCE security specifications to specific outcomes within the Cybersecurity Framework (CSF) 2.0. It provides federal agency cybersecurity managers with references to O-RAN ALLIANCE documents and other relevant guidance.
How organizations can use it
Vulnerability management teams and infrastructure owners can utilize these reports to identify critical attack surfaces in an O-RAN environment, specifically the RICs and the interfaces used by rApps and xApps. By referencing the O-RAN ALLIANCE security specifications mentioned in IR 8623, defenders can establish a baseline for what constitutes a secure configuration and map those requirements against CSF 2.0 outcomes to identify gaps in their current deployment.
Decisions and next steps
Security leaders should evaluate their O-RAN architecture against the following checkpoints:
1. Asset Identification: Identify all deployed RICs, rApps, and xApps, and verify if they utilize the standardized interfaces described in IR 8625.
2. Specification Alignment: For federal agencies or those adhering to federal standards, compare current O-RAN component configurations against the O-RAN ALLIANCE security specifications cited in IR 8623.
3. ZTA Gap Analysis: Use the “future directions” section of IR 8625 to determine how far current RIC implementations deviate from a strict zero trust architecture.
Verification of exposure reduction should not rely on version checks alone; instead, defenders should validate that authentication and authorization controls are active and enforced across all rApp/xApp interfaces as specified in the O-RAN ALLIANCE documentation.
Limits and open questions
NIST IR 8625 discusses security requirements and features rather than providing specific patches for known vulnerabilities. Furthermore, NIST IR 8623 is a draft profile and not yet a final regulatory requirement. Adopting these frameworks could reduce the likelihood of exposure but does not guarantee a secure deployment or eliminate all residual risk associated with O-RAN architectures.
Source and editorial note
NIST Publishes Reports on Open Radio Access Network (O-RAN) Security · Source date: October 08, 2026 · Retrieved October 09, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗