3GPP TS 33.501 · 5G Security · Evidence & Implementation Kit
Implement 5G security to 3GPP TS 33.501, without turning the specification into controls yourself.
Every part of the 5G security architecture handed to you as an adopt-ready control, from primary authentication and subscriber privacy through NAS and AS security to the service based architecture and the SEPP, with the evidence an assessor examines.
5G-security-ready in a weekend, not a quarter.
Here is the honest situation. 5G security is a step change from 4G, and 3GPP TS 33.501 is the specification behind it: primary authentication with 5G AKA, subscriber privacy that conceals the SUPI as a SUCI to defeat IMSI catchers, user plane integrity protection new in 5G, and a service based architecture secured with TLS, OAuth 2.0 and the SEPP for roaming. Turning that specification into implemented, evidenced controls across your network is real work, and a network function without mutual TLS or a SUPI sent in the clear is exactly where 5G security is weakened.
This Kit removes that translation. It is every part of TS 33.501 written as an adopt-ready control you personalize in a weekend, with the evidence an assessor examines.
What you get, the moment you buy
36
The 5G architecture as adopt-ready controls. Every part of TS 33.501, from primary authentication and subscriber privacy through NAS and AS security, the service based architecture and roaming, written so you personalize and apply it.
36
Evidence-they-examine checklists. For each control, exactly what an assessor examines, plus where 5G security is weakened, so you close the gap first.
1
5G Security Control Matrix, pre-built. Every control in a working spreadsheet, ready to record status and evidence location across the network.
1
Gap & Readiness Assessment. Score each control and the workbook returns your 5G security readiness as a single percentage, and exactly what to fix next.
Grounded in 3GPP TS 33.501, with primary authentication (5G AKA), SUPI and SUCI subscriber privacy, user plane integrity protection, the service based architecture security (TLS, OAuth 2.0, SEPP) and roaming N32 security called out. Editable Word and Excel files.
Concealing the SUPI is what kills the IMSI catcher
In 4G, a phone broadcast its permanent identifier, and IMSI catchers exploited it. 5G conceals the SUPI as an encrypted SUCI. This Kit builds that concealment and the home-network de-concealment correctly, so the privacy attack that plagued earlier networks is closed.
What one control looks like
This is concealing the subscriber identifier as a SUCI, the privacy foundation of 5G. All 36 are built to this depth.
5GS-13 Conceal the SUPI as a SUCI over the radio interface SUBSCRIBER PRIVACY
Implement this control
[Operator] shall ensure the UE never sends the Subscription Permanent Identifier in cleartext over the radio interface and instead transmits the Subscription Concealed Identifier computed by encrypting the subscriber identifier part with the home network public key, so that a passive or active interceptor cannot recover the permanent identity from the air interface.
Engineering note.
SUPI concealment via SUCI is the headline privacy improvement of 5G and directly counters IMSI catchers.
Evidence an assessor examines
- Radio interface captures confirming only SUCI is sent, never a cleartext SUPI
- USIM configuration enabling SUCI computation on the device
- Conformance test report for subscriber identity concealment
- IMSI catcher resilience test results
Common finding they raise: Devices or configurations that fall back to cleartext permanent identifiers reopen the classic IMSI catcher exposure.
Why this is not another template pack
- The evidence is the point. A security procedure you cannot evidence is a claim. This tells you exactly what an assessor examines and where 5G security is weakened, for every part.
- The 5G-specific protections built in. 5G AKA, SUPI concealment, user plane integrity and the SEPP for roaming are written into the controls, the protections that distinguish 5G from 4G.
- Built on a mapped compliance corpus, not one person's opinion, from a graph of thousands of controls across standards.
- It compounds. TS 33.501 aligns with the broader 3GPP security specifications and telecom regulatory expectations, so this feeds your wider network security program.
Who buys this
Mobile network operators and their vendors implementing 5G security, the security architects and engineers who own it, and consultants standing up a 5G security program. Whether it is a first deployment or a security uplift, you save weeks and walk in with the architecture and evidence structured.
By the end of the weekend you will have
✓ An adopt-ready control for all 36 items
✓ A completed 5G security control matrix
✓ The evidence an assessor examines
✓ Your authentication and subscriber privacy defined
✓ A readiness percentage and a fix list
✓ The 5G security weaknesses designed out
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
Does it cover subscriber privacy? Yes. Concealing the SUPI as a SUCI and the home-network de-concealment are their own control group, because it defeats IMSI catchers.
Does it cover the service based architecture? Yes. TLS between network functions, OAuth 2.0 authorization and the SEPP for roaming are a full control group.
Does it cover user plane integrity? Yes, the user plane integrity protection new in 5G is built as a control.
What if it is not for me? A 30-day money-back guarantee.
Do not turn a telecom specification into controls by hand.
Every part of TS 33.501 is fast to adopt with the Kit. It is instant, and it is guaranteed.
Add it to your cart and secure your 5G network this weekend.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com
