NIST’s draft on 5G NAS security gives telecom operators a specific implementation question rather than a broad policy slogan: can existing 5G deployments protect sensitive information in initial Non-Access Stratum messages, and can operators verify that protection in live network conditions? NIST published CSWP 36F on August 6, 2026, with public comments due on September 7, 2026, and described how 5G can support encryption and integrity protection of initial NAS messages, unlike 4G, in its CSWP 36F draft.
The case study is less about whether the capability exists in standards and more about whether operators can deploy it consistently. The research record points to three constraints: Standalone 5G core availability, device and SIM or eSIM compatibility, and operational verification across roaming and legacy interworking scenarios. Those constraints do not make the draft impractical. They do mean adoption will depend on engineering readiness, not only on security intent.
What 5G NAS security Changes In CSWP 36F
5G NAS security In The Initial Registration Path
The technical focus is the initial NAS message path between user equipment and the 5G core. In 5G terminology, NAS signaling carries mobility management and session management information between the device and core network functions. The draft addresses a narrow but sensitive phase: initial messages that can contain subscriber-related information before normal protected signaling is fully established.
Under the standards cited in the research, once a valid 5G NAS security context has been activated through NAS Security Mode Control procedures, user equipment must send initial NAS messages containing sensitive information inside NAS message containers, with integrity protection enforced. After NAS integrity protection is activated, subsequent 5G mobility management NAS signaling messages must be integrity protected, and messages without integrity protection are no longer accepted.
That is the main technical change behind 5G NAS security: protection is not treated as a vague network preference once the security context exists. The system has a defined state in which integrity protection becomes mandatory for later signaling. Encryption and integrity protection are still bounded by whether the device and Access and Mobility Management Function support the relevant procedures, and whether the operator has configured the network to use them.
What The Draft Does Not Prove
The draft should not be read as evidence that every deployed 5G network already protects initial NAS messages in the same way. The research notes identify operator discretion and configuration dependence as adoption variables. A standard can define a capability, while a commercial deployment may limit or defer that capability for compatibility, roaming, or software support reasons.
The null integrity algorithm, 5G-IA0, is also relevant. The research states that this algorithm provides no integrity protection and is allowed only in limited cases, including unauthenticated devices establishing emergency services, certain relay or gateway devices, or cases where context is not established. That distinction matters because an operator audit needs to separate legitimate exceptional cases from misconfiguration.
Adoption Barriers For Telecom Operators
Standalone Core Dependency
Full use of these protections depends on Standalone 5G core networks. The research states that, as of Q2 2025, 89 operators in 48 markets had commercially launched 5G Standalone, while 181 operators in 73 countries were investing through trials or deployments. It also notes that Standalone signal detection remained uneven, including approximately 57% of populated locations in the United States by the end of 2025.
This creates a practical gap between market-level 5G branding and security capability. Non-Standalone 5G networks use a 4G anchor, and that architecture can limit the use of 5G core procedures tied to initial NAS message protection. Operators with mixed Standalone and Non-Standalone footprints may need separate control evidence for each architecture. A blanket statement that a network is “5G” is not enough to prove that 5G NAS security is active where subscribers actually attach.
Device And Roaming Variability
The device ecosystem has widened, but the research indicates that support remains uneven. As of April 2026, approximately 4,256 announced 5G devices existed globally. That number does not mean all deployed handsets, modems, SIMs, eSIM profiles, and firmware builds support the same NAS security behavior. Older handsets and subscriber identity modules can slow activation, particularly where operators need to preserve service continuity.
Roaming raises another adoption issue. Even if the home network supports the relevant procedures, roaming partners, visited network policies, and device behavior can create exceptions that operations teams must document. That does not justify leaving protections disabled by default, but it does explain why adoption is usually a staged engineering program rather than a single configuration change.
Verification And Operations Workload
Testing Scope For Existing Networks
NIST’s NCCoE 5G cybersecurity work is relevant because it uses commercial-grade 5G equipment to develop reference guidance for CSWP 36-series capabilities, including initial NAS message protection, according to the NCCoE 5G cybersecurity project. For operators, reference implementations can reduce ambiguity, but they do not remove the need to test local core software versions, radio access configurations, device populations, and roaming cases.
A defensible verification program would confirm whether initial NAS messages carrying sensitive information are placed in protected containers after the security context exists, whether integrity failures are rejected as expected, and whether exceptions are limited to standards-permitted cases. The research does not provide operator-specific failure rates, so any claim about sector-wide compliance would be unsupported. The safer conclusion is that verification needs to be network-specific.
Configuration Governance
The main operational risk is silent drift. A feature may be supported by equipment, but disabled in a region, left inactive for a roaming profile, or bypassed during a migration. Operators need configuration governance that connects security policy, core network release management, device certification, and field telemetry. In this regard, reviewing related engineering coverage from HW Server can be beneficial when assessing hardware and network support assumptions.
Change control is especially important because telecom environments often contain multiple vendor systems and long-lived device fleets. A software upgrade that changes AMF behavior, a SIM profile update, or a roaming policy change could affect observed protection. The adoption burden is not only initial activation; it is sustaining evidence that the protection remains active across ordinary maintenance.
Security And Privacy Effects

Integrity Protection Limits
Integrity protection helps detect unauthorized modification of NAS signaling after the relevant security state is established. Encryption helps protect sensitive content from disclosure in supported message flows. These are meaningful controls, but they are not complete defenses against every telecom security risk. They do not replace radio access security, core network hardening, subscriber data governance, lawful intercept controls, monitoring, or incident response.
This boundary is central to reading the NIST draft accurately. 5G NAS security addresses a specific signaling exposure. It does not certify the whole mobile network as secure, and it does not prove that every subscriber interaction is encrypted end to end. Operators should describe the control in precise terms so legal, privacy, and executive teams do not overstate its coverage.
Stakeholders Affected
The affected stakeholders include mobile network security teams, core network engineering, device certification groups, roaming operations, privacy counsel, and enterprise customers that rely on mobile connectivity. For regulators and auditors, the value of the draft is that it creates a more testable question: has the operator enabled and verified initial NAS message protection where the architecture and devices support it?
For subscribers, the benefit is indirect but important. Better protection of sensitive signaling information can reduce exposure during early registration flows. The research also notes growing legal, regulatory, and privacy pressure around subscriber protection. The exact regulatory consequences will vary by jurisdiction, so operators should avoid generic compliance claims unless they map the control to specific local requirements.
5G NAS security Operator Readiness
Practical Readiness Checklist
Operators evaluating 5G NAS security should start with evidence they can verify rather than vendor assurances alone. The draft’s value is highest when it becomes part of an audit trail: architecture inventory, device support data, configuration records, exception handling, and regression testing after upgrades.
- Identify where Standalone 5G core is commercially active and where Non-Standalone architecture still limits use of the relevant procedures.
- Confirm AMF and core software support for NAS Security Mode Control and protected initial NAS message handling.
- Segment device, SIM, and eSIM populations by confirmed compatibility rather than announced 5G support alone.
- Document any use of 5G-IA0 and tie it to permitted cases such as emergency service access or missing context.
- Test roaming scenarios separately from domestic attachment because partner network behavior can change protection outcomes.
- Retest after firmware, core software, SIM profile, or roaming policy changes.
The adoption challenge is therefore measurable but not trivial. NIST CSWP 36F gives operators a focused reference point for protecting initial NAS messages, while the network reality involves mixed architectures, diverse devices, and configuration-dependent behavior. The strongest operator response is to treat 5G NAS security as a verifiable control with documented scope, known exceptions, and repeatable testing, rather than as a one-time standards checkbox.











