Telecommunications Sector Controls Profile Template (ISO/IEC 27011)

Telecommunications Sector Controls Profile (ISO/IEC 27011): [Organization name]

Sector profile for telecommunications organizations: fixed and mobile network operators, internet service providers, carriers, virtual network operators, data centre interconnect and managed network providers. It records how the sector guidance in ISO/IEC 27011:2024 (information security controls for telecommunications organizations, based on ISO/IEC 27002:2022) is applied inside an ISMS that meets ISO/IEC 27001:2022 + Amd 1:2024, mainly through risk treatment (6.1.3) and the Statement of Applicability. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

• 1. Purpose and scope
• 2. ISO/IEC 27011 at a glance
• 3. Service and network landscape
• 4. Applicability decision
• 5. Sector supplement register
• 6. Mapping of telecom topics to Annex A
• 7. Implementation table
• 8. Implementation notes by domain
• 9. Worked risk example
• 10. Regulatory examples
• 11. Size tiers
• 12. Records and evidence
• 13. References
• Standard and licence note

1. Purpose and scope

This profile explains how [Organization name] protects the telecommunications services it provides and the information those services carry and generate. It:

• describes the services, network domains and facilities in scope (section 3);
• records which telecom-specific controls and guidance from ISO/IEC 27011:2024 apply and why (sections 4 and 5);
• maps each telecom topic to the ISO/IEC 27001:2022 Annex A controls in the Statement of Applicability, DOC-ISMS-011 (section 6);
• assigns owners, status and evidence to each implementation item (section 7).

In scope: [the services and domains listed in Document control, the network operations centre, exchange buildings and points of presence, radio sites, OSS and BSS platforms, customer data stores].

Out of scope: [corporate IT, covered by the general ISMS policies; services resold from another operator where that operator runs the network, covered through supplier controls].

2. ISO/IEC 27011 at a glance

3. Service and network landscape

3.1 Domains and facilities

3.2 Information types with telecom-specific protection needs

4. Applicability decision

Decision record fields: entry ID, decision, reason (risk ID, licence condition or law from DOC-ISMS-014, contract clause), decision maker, date.

5. Sector supplement register

Two kinds of entries:

• Telecom-specific extended controls: controls the sector standard adds to the ISO/IEC 27002 set. Record them as additional controls in the SoA.
• Telecom guidance on existing controls: implementation guidance on a control already in Annex A. Record it in that Annex A row.

Confirm that each example label matches an entry in your copy before keeping it, and add one row for every extended control your copy lists.

6. Mapping of telecom topics to Annex A

7. Implementation table

Status summary (Example): 6 rows, of which 3 implemented, 1 partial, 1 planned and 1 blank row awaiting entries.

8. Implementation notes by domain

8.1 Access and radio

• Treat every street cabinet and radio site as a potentially exposed location: tamper alarms, locked cabinets, no credentials stored on site equipment.
• Shared infrastructure (towers, ducts, neutral host sites) needs a written split of security duties with the infrastructure owner.

8.2 Transport, core and signalling

• Separate customer traffic, signalling and management traffic into distinct zones with documented conduits.
• Filter signalling at the network edge and monitor for location tracking, interception and fraud patterns.
• Validate route origins with your peers and transit providers and monitor for route leaks and hijacks affecting your prefixes.

8.3 OSS, BSS and customer data

• Keep content, traffic and location data in segregated stores with separate access roles; analytics on such data needs a privacy review (compliance/dpia).
• Apply retention limits that match the law; do not keep traffic data longer than the legal period because storage is cheap.

8.4 Supply chain and vendors

• Keep a list of network equipment vendors and managed service partners in the supplier register (DOC-ISMS-066) with criticality and end-of-support dates.
• Require vendors to notify vulnerabilities and provide signed software; test updates in a lab before production.

8.5 Resilience and emergency services

• Design for loss of one core site without loss of emergency calling.
• Test failover at least yearly and record results in the ICT readiness plan (DOC-ISMS-047).

9. Worked risk example

10. Regulatory examples

11. Size tiers

12. Records and evidence

Link each record to its control in isms/control-evidence-matrix (DOC-ISMS-033).

13. References

Standard and licence note

Structure aligned with ISO/IEC 27011:2024 (ITU-T X.1051) and ISO/IEC 27001:2022 + Amd 1:2024 (clause 6.1.3 and Annex A). The register, mapping, notes and examples are original. No text, control wording, tables or definitions from ISO, IEC or ITU-T publications are reproduced; the scope summary is a short paraphrase of the public catalogue description. You need your own licensed copy of ISO/IEC 27011 to fill section 5. Check the current editions before use. Official ISO text, purchase or licensed access: https://www.iso.org/standard/80584.html and https://www.iso.org/standard/82875.html. Regulatory summaries are short paraphrases; this is a documentation format, not legal advice.

Template licence: MIT.