Open Radio Access Network (O-RAN) Near-Real Time RAN Intelligent Controller (RIC) Security

Published

September 24, 2026

Author(s)

Scott Rose, Oliver Borchert, Simeon Wuthier, Douglas Montgomery

Abstract

Radio Access Networks (RANs) are used to connect mobile network customer devices to the core network and the internet. Open RAN (ORAN) is an effort to have a standardized set of components and interfaces for the RAN so that a mobile network operator can deploy and operate a network composed of (potentially) multiple vendor components. ORAN also seeks to specify the RAN control plane as a set of services. This allows ORAN network management functions to be operated on any virtualization platform as a service-based architecture. This also allows for the use of specialized software components to provide additional features, automation or management through a new element called the RAN Intelligent Controller (RIC). This move from legacy RANs to service-based RAN with a RIC introduces new security threats and a call for using zero trust architecture for ORAN. This report discusses the status of zero trust in ORAN and further considerations for realizing a zero trust for ORAN.

Citation

NIST Interagency/Internal Report (NISTIR) - 8625

Report Number

8625

NIST Pub Series

NIST Interagency/Internal Report (NISTIR)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.IR.8625

Local Download

Keywords

ORAN, Open RAN, RAN Intelligent Controller (RIC), rApp, xApp, zero trust.

Citation

Rose, S. , Borchert, O. , Wuthier, S. and Montgomery, D. (2026), Open Radio Access Network (O-RAN) Near-Real Time RAN Intelligent Controller (RIC) Security, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.8625, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=962765 (Accessed September 25, 2026)

Additional citation formats