3GPP TR 33.916 V18 — SECAM Process

Q: What does the Scope section cover in 3GPP TR 33.916 V18 — SECAM Process?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.916 V18 — SECAM Process. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the SECAM Framework Overview section cover in 3GPP TR 33.916 V18 — SECAM Process?

The SECAM Framework Overview section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.916 V18 — SECAM Process. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Evaluation Process section cover in 3GPP TR 33.916 V18 — SECAM Process?

The Evaluation Process section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.916 V18 — SECAM Process. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Accreditation of Test Laboratories section cover in 3GPP TR 33.916 V18 — SECAM Process?

The Accreditation of Test Laboratories section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.916 V18 — SECAM Process. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Relationship to SCAS Documents section cover in 3GPP TR 33.916 V18 — SECAM Process?

The Relationship to SCAS Documents section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.916 V18 — SECAM Process. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TR 33.916

Security Assurance Methodology (SECAM) for 3GPP Network Products

V18.2.0 (2024-06) — Release 18 Methodology

1. Scope

▶

Describes the Security Assurance Methodology (SECAM) — the framework for evaluating security of 3GPP network products. SECAM defines who evaluates, how they evaluate, and what criteria they use.

4. SECAM Framework Overview

▶

┌─────────────────────────────────────────────────────────────┐ │ SECAM Framework │ │ │ │ ┌───────────────┐ ┌───────────────┐ ┌─────────────┐ │ │ │ TR 33.926 │ │ TS 33.117 │ │ TS 33.5xx │ │ │ │ Threat │───►│ General SCAS │───►│ Product │ │ │ │ Analysis │ │ Baseline │ │ Class SCAS │ │ │ └───────────────┘ └───────────────┘ └─────────────┘ │ │ │ │ │ │ │ ▼ ▼ ▼ │ │ ┌─────────────────────────────────────────────────────┐ │ │ │ Evaluation & Testing │ │ │ │ (Performed by accredited test labs) │ │ │ └──────────────────────┬──────────────────────────────┘ │ │ ▼ │ │ ┌─────────────────────────────────────────────────────┐ │ │ │ Security Assurance Report │ │ │ │ (Delivered to operator/vendor) │ │ │ └─────────────────────────────────────────────────────┘ │ └─────────────────────────────────────────────────────────────┘

Component	Document	Role
Threat Analysis	TR 33.926	Identifies threats and critical assets per product class
General SCAS	TS 33.117	Baseline security requirements applicable to ALL product classes
Product SCAS	TS 33.5xx	Per-product-class additional requirements and test cases
Methodology	TR 33.916 (this)	Evaluation process, accreditation, lifecycle

5. Evaluation Process

▶

5.1 Evaluation Steps

Scoping: Vendor identifies product class and applicable SCAS documents
Documentation: Vendor provides Security Target (ST) describing product security features
Testing: Accredited lab executes all applicable test cases from TS 33.117 + TS 33.5xx
Reporting: Lab produces evaluation report with pass/fail per test case
Decision: Evaluation result determines security assurance level

5.2 Evaluation Levels

Level	Description	Effort
Basic	Automated testing per SCAS test procedures	Low
Enhanced	Basic + manual vulnerability assessment + penetration testing	Medium-High

6. Accreditation of Test Laboratories

▶

Test labs must be accredited by GSMA NESAS (Network Equipment Security Assurance Scheme)
Labs must demonstrate competence in telecom security testing
Labs must maintain independence from vendors
Re-accreditation required periodically

NESAS: The GSMA Network Equipment Security Assurance Scheme (NESAS) is the industry program that implements SECAM accreditation and vendor self-assessment.

7. Relationship to SCAS Documents

▶

Product Class	SCAS Document	Baseline
gNB (RAN)	TS 33.512	TS 33.117
UPF / GW	TS 33.513
UDM	TS 33.514
AMF	TS 33.515
AUSF	TS 33.516
SEAF	TS 33.517
SMF	TS 33.518
NEF	TS 33.519
NRF	TS 33.521
SEPP	TS 33.522

8. Product Lifecycle Security

▶

Development: Vendor implements secure development lifecycle (SDL)
Evaluation: Product tested against applicable SCAS before deployment
Deployment: Operator configures per hardening requirements (TS 33.117 §4.3)
Maintenance: Vendor provides vulnerability patches; re-evaluation on major updates
End-of-life: Secure decommissioning with key/data destruction