A new report from the US National Institute of Standards and Technology examines how zero-trust security can be applied to the near-real-time RAN Intelligent Controller, a software component that helps automate Open RAN mobile networks.
Published on 24 September and highlighted by NIST in October 2026, the report focuses on a part of the network designed to host applications that optimise radio performance. That flexibility can improve operations, but it also creates new interfaces, dependencies and trust decisions that defenders must manage.
What is Open RAN?
The radio access network connects phones and other devices to a mobile operator’s core network. In traditional deployments, many radio and control components are supplied as an integrated system. Open RAN introduces more standardised interfaces and allows functions from different suppliers to work together.
It also relies heavily on virtualisation and software-based services. This can broaden competition and make networks easier to update, but a more modular design increases the number of connections that must be authenticated, monitored and secured.
What does the near-real-time controller do?
The near-real-time RAN Intelligent Controller, usually shortened to near-RT RIC, provides a platform for applications that analyse network conditions and adjust behaviour on short timescales. Those applications can help manage traffic, radio resources and performance.
Because the controller can influence operational decisions, it is a valuable target. A compromised application, weak interface or excessive permission could affect more than a single server. Security has to cover the controller, the applications running on it and the data moving between network functions.
Why is zero trust relevant?
Zero trust starts from the idea that location inside a network is not proof that a user, application or device should be trusted. Access should be explicitly authorised, limited to what is needed and reassessed using current identity and risk information.
For an Open RAN controller, that can mean strong identities for services, tightly scoped permissions, protected communications, continuous logging and isolation between applications. The goal is not to add one “zero-trust product”, but to design each interaction so that a single failure does not silently grant broad control.
What risks does an open architecture introduce?
Open interfaces can improve interoperability while also giving attackers more defined surfaces to study. Third-party applications may have different development practices, supply-chain controls and update cycles. Virtualised components can share infrastructure, increasing the importance of isolation and configuration management.
None of this means an open system is inherently less secure. It means security assumptions must be visible and testable. Proprietary integration can hide complexity; openness can expose it, provided operators use that visibility to validate components and monitor behaviour.
What should operators and suppliers do?
Operators should map the identities, permissions and data flows associated with the controller before deploying applications at scale. Suppliers should support secure onboarding, signed software, granular authorisation, useful audit records and rapid revocation when a component is no longer trusted.
Testing also needs to include failure and recovery, not only normal performance. Teams should know how a suspicious application is isolated, how configuration is restored and whether essential radio functions continue safely during an incident.
Why does the report matter now?
Mobile networks are becoming more software-driven while carrying increasingly critical services. Security choices made during early Open RAN deployments may be difficult to retrofit after ecosystems and operational habits are established.
NIST’s contribution is therefore best read as a design reference, not a claim that every network should be configured identically. The report gives operators and vendors a common vocabulary for asking which components are trusted, on what evidence and for how long.
Reporting basis
This article is based on NIST’s publication page for Open Radio Access Network Near-Real-Time RAN Intelligent Controller Security Considerations and the report’s permanent NIST DOI record. Ferdiox has summarised the document in plain language.
Featured image: Dušan veverkolog via Unsplash.