# Telecommunications Sector Controls Profile (ISO/IEC 27011): [Organization name]

> Sector profile for telecommunications organizations: fixed and mobile
> network operators, internet service providers, carriers, virtual
> network operators, data centre interconnect and managed network
> providers. It records how the sector guidance in ISO/IEC 27011:2024
> (information security controls for telecommunications organizations,
> based on ISO/IEC 27002:2022) is applied inside an ISMS that meets
> ISO/IEC 27001:2022 + Amd 1:2024, mainly through risk treatment (6.1.3)
> and the Statement of Applicability. Replace every `[bracketed]` value
> and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it when the ISMS scope includes providing telecommunications
  networks or services to others: access, core, transport, signalling,
  interconnection, voice, messaging, internet access, or the network and
  service management behind them.
- Fill section 3 (service and network landscape) and section 5 (the
  sector supplement register, from your licensed copy of ISO/IEC 27011)
  first. Sections 6 and 7 connect each telecom topic to Annex A and to
  concrete implementation.
- The main pitfall is writing an enterprise-IT ISMS and leaving the
  network itself out of scope. Auditors and regulators expect the
  production network, its management plane and the customer data it
  generates to be inside the ISMS.
- ISO/IEC 27011 is a guidance standard, developed jointly with ITU-T;
  its twin is ITU-T Recommendation X.1051 (current edition 06/2023). Certification is to ISO/IEC 27001; the
  sector controls enter your SoA as additional controls or as guidance
  on Annex A controls.
- This template does not reproduce the sector control list. It gives a
  register to record the controls from your copy and an original
  mapping of telecom topics to Annex A.
- Related templates: `compliance/statement-of-applicability`,
  `compliance/risk-methodology`, `isms/network-security-standard`,
  `isms/security-monitoring-procedure`, `isms/supplier-security-agreement-27036`,
  `isms/data-centre-colocation-assessment`, `industry/telecom-oda-solution-design`,
  `compliance/nis2-security-measures`, `isms/control-framework-crosswalk`.
-->

## Document control

<!-- Guidance: The owner is usually the CISO or head of network security. The network operations director must approve, because many controls change how the network is built and run. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-109 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@head-of-network-security] |
| Approvers/reviewers | [@ciso], [@network-operations-director], [@data-protection-officer], [@isms-manager] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential: contains network architecture details] |
| Standard and edition | ISO/IEC 27011:2024 (ITU-T X.1051); ISO/IEC 27002:2022; ISO/IEC 27001:2022 + Amd 1:2024 |
| Next scheduled review | YYYY-MM-DD |
| Services in scope | [Mobile / Fixed access / Internet transit / Voice / Messaging / Enterprise connectivity / Data centre interconnect] |
| Network domains in scope | [Access / Transport / Core / Signalling / OSS and BSS / Network management] |
| Regulatory status | [Licensed operator / Registered provider / Not regulated as a provider] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Head of network security (author) | [@head-of-network-security] | [Prepared] | YYYY-MM-DD |
| Network operations director | [@network-operations-director] | [Approved] | YYYY-MM-DD |
| Data protection officer | [@data-protection-officer] | [Reviewed] | YYYY-MM-DD |
| CISO | [@ciso] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@head-of-network-security] | First issue |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

- [1. Purpose and scope](#1-purpose-and-scope)
- [2. ISO/IEC 27011 at a glance](#2-isoiec-27011-at-a-glance)
- [3. Service and network landscape](#3-service-and-network-landscape)
- [4. Applicability decision](#4-applicability-decision)
- [5. Sector supplement register](#5-sector-supplement-register)
- [6. Mapping of telecom topics to Annex A](#6-mapping-of-telecom-topics-to-annex-a)
- [7. Implementation table](#7-implementation-table)
- [8. Implementation notes by domain](#8-implementation-notes-by-domain)
- [9. Worked risk example](#9-worked-risk-example)
- [10. Regulatory examples](#10-regulatory-examples)
- [11. Size tiers](#11-size-tiers)
- [12. Records and evidence](#12-records-and-evidence)
- [13. References](#13-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose and scope

<!-- Guidance: Name the services and network domains covered and the ones left out, with a reason. The boundary must match the ISMS scope (DOC-ISMS-002). An auditor will ask where the network management plane sits. -->

This profile explains how [Organization name] protects the
telecommunications services it provides and the information those
services carry and generate. It:

- describes the services, network domains and facilities in scope
  (section 3);
- records which telecom-specific controls and guidance from
  ISO/IEC 27011:2024 apply and why (sections 4 and 5);
- maps each telecom topic to the ISO/IEC 27001:2022 Annex A controls in
  the Statement of Applicability, DOC-ISMS-011 (section 6);
- assigns owners, status and evidence to each implementation item
  (section 7).

In scope: [the services and domains listed in Document control, the
network operations centre, exchange buildings and points of presence,
radio sites, OSS and BSS platforms, customer data stores].

Out of scope: [corporate IT, covered by the general ISMS policies;
services resold from another operator where that operator runs the
network, covered through supplier controls].

## 2. ISO/IEC 27011 at a glance

<!-- Guidance: Describe the standard in your own words. Keep the licensed copy with the document owner and cite its section numbers in section 5. -->

| Question | Answer for this profile |
|---|---|
| What it is | Sector guidance supporting the implementation of information security controls in telecommunications organizations, built on ISO/IEC 27002:2022 |
| Edition | ISO/IEC 27011:2024 (third edition, published 2024-03-28; replaces the 2016 edition and its 2018 corrigendum) |
| Twin publication | Developed jointly with ITU-T Study Group 17. The ITU-T twin, Recommendation X.1051 (06/2023, in force), has the same title; check that the edition you cite matches your ISO copy |
| Certifiable? | No. Certification is to ISO/IEC 27001:2022 + Amd 1:2024 |
| How it is organised | In line with the four themes of ISO/IEC 27002:2022. It adds telecom guidance to existing controls and a set of telecom-specific extended controls (check your copy for the exact list and numbering) |
| Stated aim | Helps telecom organizations meet baseline requirements for confidentiality, integrity, availability and other relevant security properties (summarised from the public scope) |
| Licensed copy held by | [@head-of-network-security], [document repository path] |

```mermaid
flowchart LR
  A["ISO/IEC 27001:2022 + Amd 1:2024: ISMS requirements"] --> B["Risk assessment and treatment (6.1.2, 6.1.3)"]
  C["ISO/IEC 27002:2022: control guidance"] --> B
  D["ISO/IEC 27011:2024 / ITU-T X.1051: telecom guidance"] --> B
  B --> F["Statement of Applicability DOC-ISMS-011"]
  F --> G["Implementation table, section 7"]
```

## 3. Service and network landscape

<!-- Guidance: List what you run, where it runs and who operates it. Include outsourced network operations: a managed service partner running your core is inside your risk, even if outside your payroll. -->

### 3.1 Domains and facilities

| Domain | Examples | Operated by | Facilities | Critical for |
|---|---|---|---|---|
| Access network | [Radio access, fibre access, cable] | [In-house / Partner] | [Radio sites, street cabinets] | [Service availability] |
| Transport and core *(Example)* | IP/MPLS transport, packet core, IMS voice core | In-house NOC, vendor support | 2 core sites, 14 points of presence | Availability, integrity |
| Signalling and interconnect | [Signalling transfer, roaming hubs, peering, transit] | [In-house / Hub provider] | [Interconnect sites] | [Integrity, fraud prevention] |
| Network management plane | [Element managers, orchestration, NOC tools] | [In-house] | [NOC] | [Integrity, availability] |
| OSS and BSS | [Provisioning, billing, CRM, call detail records] | [In-house / SaaS] | [Data centre / cloud] | [Confidentiality of subscriber data] |
| Customer-facing services | [Self-care portal, SIM management, number porting] | [In-house] | [Cloud] | [Account takeover prevention] |

### 3.2 Information types with telecom-specific protection needs

| Information | Why it is sensitive | Classification |
|---|---|---|
| Content of communications | Secrecy of communications is protected by law in most jurisdictions | [Restricted] |
| Traffic and location data | Reveals who talked to whom, when and where | [Restricted] |
| Subscriber identity and authentication data | Enables impersonation and SIM fraud | [Restricted] |
| Lawful request records | Confidential by law; disclosure can harm investigations | [Restricted, need to know] |
| Network topology and configuration | Supports targeted attacks on infrastructure | [Confidential] |

## 4. Applicability decision

<!-- Guidance: Decide for each entry in section 5 whether it applies and why. A reseller without its own network will mark many infrastructure items not applicable, but still needs the customer data and supplier items. -->

```mermaid
flowchart TD
  S["Telecom control or guidance item"] --> Q1{"Do we operate the related service, domain or facility?"}
  Q1 -- "No, a partner does" --> SUP["Cover through supplier agreement and monitoring"]
  Q1 -- "No, it does not exist" --> NA["Not applicable: reason in the SoA"]
  Q1 -- "Yes" --> Q2{"Does a risk, law, licence or contract call for it?"}
  Q2 -- "No" --> JUST["Not selected: record the reason, review yearly"]
  Q2 -- "Yes" --> IMP["Select and implement, add to section 7"]
```

Decision record fields: entry ID, decision, reason (risk ID, licence
condition or law from DOC-ISMS-014, contract clause), decision maker,
date.

## 5. Sector supplement register

<!-- Guidance: Fill from your licensed copy of ISO/IEC 27011:2024. Put the standard's own numbers in the "Reference in 27011" column and write labels and descriptions in your own words. Do not paste control text. -->

Two kinds of entries:

- **Telecom-specific extended controls**: controls the sector standard
  adds to the ISO/IEC 27002 set. Record them as additional controls in
  the SoA.
- **Telecom guidance on existing controls**: implementation guidance on
  a control already in Annex A. Record it in that Annex A row.

| Entry ID | Reference in 27011 | Type | Your short label | Related Annex A | Applicable | Section 7 item |
|---|---|---|---|---|---|---|
| TEL-REG-001 *(Example)* | [Control number from your copy] | Extended control | Non-disclosure of communications content and traffic data | A.5.12, A.5.34, A.8.3 | Yes | TEL-IMP-001 |
| TEL-REG-002 *(Example)* | [Control number from your copy] | Extended control | Security of carrier facilities such as exchange buildings and radio sites | A.7.1, A.7.2, A.7.4 | Yes | TEL-IMP-003 |
| TEL-REG-003 *(Example)* | [Number from your copy] | Guidance on existing control | Protection of network management and signalling traffic | A.8.20, A.8.22 | Yes | TEL-IMP-002 |
| TEL-REG-004 *(Example)* | [Number from your copy] | Guidance on existing control | Security in interconnection and roaming agreements | A.5.14, A.5.20 | Yes | TEL-IMP-004 |
| TEL-REG-005 | [Number from your copy] | [Type] | [Your label] | [A.x.y] | [Yes / No] | [TEL-IMP-nnn] |
| TEL-REG-006 | [Number from your copy] | [Type] | [Your label] | [A.x.y] | [Yes / No] | [TEL-IMP-nnn] |

Confirm that each example label matches an entry in your copy before
keeping it, and add one row for every extended control your copy lists.

## 6. Mapping of telecom topics to Annex A

<!-- Guidance: This is the template's own mapping of typical telecom topics, not a table from the standard. Use it to check SoA coverage. -->

| Telecom topic | Primary Annex A controls (short labels) | Notes |
|---|---|---|
| Secrecy of communications | A.5.12 information classification, A.5.34 privacy and PII protection, A.8.3 restricting access to information | Strict need-to-know for content and traffic data; access logged |
| Lawful requests from authorities | A.5.5 contact with authorities, A.5.31 legal, regulatory and contractual requirements | Dedicated, vetted team; dual control; request register |
| Subscriber identity and SIM security | A.5.16 identity lifecycle management, A.5.17 authentication information, A.8.5 secure authentication | Strong checks before SIM swap and number porting |
| Carrier facilities | A.7.1 to A.7.4 perimeters, entry, secure areas, monitoring; A.7.11 supporting utilities | Unattended sites, shared towers, power autonomy |
| Network management plane | A.8.2 privileged access rights, A.8.15 logging, A.8.22 network segregation | Separate management network, privileged access management |
| Signalling and routing integrity | A.8.20 network security, A.8.16 monitoring activities | Signalling firewalls, route origin validation, anomaly detection |
| Interconnection and roaming partners | A.5.14 information transfer, A.5.19 to A.5.22 supplier relationships | Security clauses in interconnect and roaming agreements |
| Network equipment supply chain | A.5.21 ICT supply chain security, A.8.8 technical vulnerability management | Vendor security assurance, software integrity, end-of-support tracking |
| Outsourced network operations | A.5.19, A.5.20, A.5.22 supplier relationships | Managed service contracts with audit and access clauses |
| Availability and resilience | A.5.29 security during disruption, A.5.30 ICT readiness, A.8.14 redundancy, A.8.6 capacity management | Geographic redundancy, DDoS protection, emergency services continuity |
| Incident handling and notification | A.5.24 to A.5.28 incident management | Regulator notification timelines, customer communication |
| Change in a live network | A.8.32 change management, A.8.9 configuration management | Maintenance windows, rollback, golden configurations |
| Time and logging | A.8.15 logging, A.8.17 clock synchronization | Accurate time for call records and forensic timelines |
| Customer portals and APIs | A.8.25 to A.8.29 secure development and testing | Account takeover controls, API rate limiting |

## 7. Implementation table

<!-- Guidance: One row per implementation item, linked to the register entry and a risk ID. Evidence must be a sampleable record. -->

| Item ID | Register entry | What is done | Owner | Status | Due | Evidence |
|---|---|---|---|---|---|---|
| TEL-IMP-001 *(Example)* | TEL-REG-001 | Access to traffic data limited to 9 named analysts, every query logged and reviewed monthly by the DPO | Head of network security | Implemented | 2027-02-28 | Access list, monthly query review record |
| TEL-IMP-002 *(Example)* | TEL-REG-003 | Out-of-band management network for core and transport, privileged sessions through a PAM gateway | NOC manager | Partial | 2027-06-30 | Network diagram v3, PAM session reports |
| TEL-IMP-003 *(Example)* | TEL-REG-002 | Door contacts and remote alarms at all 14 points of presence, quarterly site audit | Facilities | Implemented | 2027-03-31 | Alarm test log, site audit checklist |
| TEL-IMP-004 *(Example)* | TEL-REG-004 | Security annex added to interconnect and roaming agreements at renewal | Commercial and legal | Planned | 2027-12-31 | Agreement register with annex status |
| TEL-IMP-005 *(Example)* | Annex A A.8.5 guidance | SIM swap requires two-factor verification and a waiting period for high-risk changes | Customer operations | Implemented | 2027-01-31 | Process document, fraud dashboard |
| TEL-IMP-006 | [TEL-REG-nnn] | [Action] | [@owner] | [Status] | YYYY-MM-DD | [Record] |

Status summary *(Example)*: 6 rows, of which 3 implemented, 1 partial,
1 planned and 1 blank row awaiting entries.

## 8. Implementation notes by domain

<!-- Guidance: Short, practical notes help engineers apply the controls. Replace the examples with your real practices and keep the notes consistent with the network security standard (DOC-ISMS-063). -->

### 8.1 Access and radio

- Treat every street cabinet and radio site as a potentially exposed
  location: tamper alarms, locked cabinets, no credentials stored on
  site equipment.
- Shared infrastructure (towers, ducts, neutral host sites) needs a
  written split of security duties with the infrastructure owner.

### 8.2 Transport, core and signalling

- Separate customer traffic, signalling and management traffic into
  distinct zones with documented conduits.
- Filter signalling at the network edge and monitor for location
  tracking, interception and fraud patterns.
- Validate route origins with your peers and transit providers and
  monitor for route leaks and hijacks affecting your prefixes.

### 8.3 OSS, BSS and customer data

- Keep content, traffic and location data in segregated stores with
  separate access roles; analytics on such data needs a privacy review
  (`compliance/dpia`).
- Apply retention limits that match the law; do not keep traffic data
  longer than the legal period because storage is cheap.

### 8.4 Supply chain and vendors

- Keep a list of network equipment vendors and managed service partners
  in the supplier register (DOC-ISMS-066) with criticality and
  end-of-support dates.
- Require vendors to notify vulnerabilities and provide signed software;
  test updates in a lab before production.

### 8.5 Resilience and emergency services

- Design for loss of one core site without loss of emergency calling.
- Test failover at least yearly and record results in the ICT readiness
  plan (DOC-ISMS-047).

## 9. Worked risk example

<!-- Guidance: Show one risk end to end using the scale in DOC-ISMS-010 (likelihood 1 to 5 times impact 1 to 5; Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25 (in practice 20 and 25)). -->

| Field | Value |
|---|---|
| Risk ID | R-072 *(Example)* |
| Scenario | Social engineering of the customer care line leads to unauthorised SIM swaps, used to take over customers' bank accounts |
| Inherent likelihood x impact | 4 x 4 = 16, High |
| Treatment | TEL-IMP-005 (two-factor verification, waiting period for high-risk changes), staff training, fraud monitoring |
| Residual likelihood x impact | 2 x 4 = 8, Medium |
| Acceptance | Medium residual risk accepted by the risk owner (head of customer operations) and the department head (chief customer officer), as DOC-ISMS-010 requires for Medium risks (DOC-ISMS-019 record ACC-072 *(Example)*) |
| Review | Quarterly, using fraud dashboard trends |

## 10. Regulatory examples

<!-- Guidance: List only what applies, as recorded in the legal register (DOC-ISMS-014). These are international examples; check the official text and your regulator. This is a documentation format, not legal advice. -->

| Framework | Region | Relevance | Check |
|---|---|---|---|
| Directive (EU) 2022/2555 (NIS2) | EU | Providers of public electronic communications networks or services are in scope as digital infrastructure; risk management measures and incident reporting | National transposition and competent authority |
| Directive 2002/58/EC (ePrivacy) | EU | Confidentiality of communications, traffic and location data | National implementing law |
| Regulation (EU) 2016/679 (GDPR) | EU and EEA | Subscriber personal data, breach notification | Supervisory authority guidance |
| Customer proprietary network information rules (47 U.S.C. 222) | United States | Protection of subscriber network information | Current regulator rules |
| [Telecom licence conditions] | [Country] | [Security, lawful interception, resilience duties] | [Licence text] |

## 11. Size tiers

<!-- Guidance: The fictional settings give a size reference; the telecom role is an example of an organization of that size. Show what changes per tier. -->

| Aspect | Small (under 50 people) | Medium (50 to 500) | Large or multi-site (over 500 or several sites) |
|---|---|---|---|
| Size reference | Quillmere Analytics Ltd, 46 staff (38 employees, 8 contractors), part-time ISMS manager | Quillmere Health Systems, 320 staff, full-time ISMS manager and 3-person security team | Quillmere Group, 2,400 staff, 6 sites in 4 countries, CISO and 14-person security office |
| Typical telecom role *(Example)* | Virtual network operator or small ISP relying on a host network | Regional fibre operator or enterprise connectivity provider | National or multi-country operator with own core and radio network |
| Use of ISO/IEC 27011 | Customer data, lawful requests, supplier controls over the host network | Most entries, own NOC, carrier facility controls | Full register per country, signalling and routing security programme |
| Governance | ISMS manager with legal counsel for lawful requests | Head of network security reporting to the ISMS manager | Network security function in the security office, country security leads |
| Monitoring | Host network reports plus own portal monitoring | NOC with security alerts | 24x7 SOC integrated with the NOC |
| Review cycle | Yearly | Yearly plus after major network change | Yearly per country, rolling group review |

## 12. Records and evidence

<!-- Guidance: Name the records that prove the profile operates and map them in isms/control-evidence-matrix. Auditors sample one record per row. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| Sector supplement register and SoA rows | Applicability decisions | ISMS manager | [ISMS repository] | [Life of the ISMS plus 3 years] |
| Traffic data access list and query review | Secrecy of communications controls operate | DPO | [Restricted repository] | [Example: 3 years] |
| Lawful request register | Requests handled under dual control | Legal | [Restricted register] | [As required by law] |
| Privileged session reports for the management plane | A.8.2 and A.8.15 | NOC manager | [PAM tool] | [Example: 1 year] |
| Site alarm tests and audit checklists | Carrier facility controls | Facilities | [Facilities system] | [Example: 3 years] |
| Interconnect and roaming agreement register | Security annexes in place | Commercial | [Contract system] | [Contract term plus 6 years] |
| Failover test reports | Resilience and emergency services | NOC manager | DOC-ISMS-047 folder | [Example: 3 years] |
| Regulator incident notifications | Notification duties met | CISO | DOC-ISMS-021 | [Example: 6 years] |

Link each record to its control in `isms/control-evidence-matrix`
(DOC-ISMS-033).

## 13. References

<!-- Guidance: Keep editions current. When ISO/IEC 27002 changes, check for a new edition of ISO/IEC 27011 and ITU-T X.1051. -->

| Reference | Edition and status | Use |
|---|---|---|
| ISO/IEC 27011:2024 (ITU-T X.1051), information security controls for telecommunications organizations | Current (https://www.iso.org/standard/80584.html) | Sector controls and guidance |
| ISO/IEC 27001:2022 + Amd 1:2024 | Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html) | ISMS requirements, clause 6.1.3, Annex A |
| ISO/IEC 27002:2022 | Current (https://www.iso.org/standard/75652.html) | Control guidance the sector standard builds on |
| ISO/IEC 27033-1:2015 | Current (https://www.iso.org/standard/63461.html) | Network security concepts |
| ISO/IEC 27035-1:2023 | Current (https://www.iso.org/standard/78973.html) | Incident management principles |
| Directive (EU) 2022/2555 (NIS2) | OJ L 333, 27.12.2022 (https://eur-lex.europa.eu/eli/dir/2022/2555/oj) | Digital infrastructure obligations |
| Related templates | `compliance/statement-of-applicability`, `compliance/risk-methodology`, `compliance/legal-register`, `compliance/dpia`, `isms/network-security-standard`, `isms/security-monitoring-procedure`, `isms/supplier-register`, `isms/supplier-security-agreement-27036`, `isms/data-centre-colocation-assessment`, `isms/ict-readiness-business-continuity-plan`, `isms/control-framework-crosswalk`, `isms/control-evidence-matrix`, `industry/telecom-oda-solution-design`, `compliance/nis2-security-measures` | Linked documents |

## Standard and licence note

Structure aligned with ISO/IEC 27011:2024 (ITU-T X.1051) and ISO/IEC
27001:2022 + Amd 1:2024 (clause 6.1.3 and Annex A). The register,
mapping, notes and examples are original. No text, control wording,
tables or definitions from ISO, IEC or ITU-T publications are
reproduced; the scope summary is a short paraphrase of the public
catalogue description. You need your own licensed copy of
ISO/IEC 27011 to fill section 5. Check the current editions before use.
Official ISO text, purchase or licensed access:
https://www.iso.org/standard/80584.html and
https://www.iso.org/standard/82875.html. Regulatory summaries are short
paraphrases; this is a documentation format, not legal advice.

Template licence: MIT.