9.1 PSAP Cybersecurity Frameworks: NENA NG-SEC & NIST CSF

9.1 PSAP Cybersecurity Frameworks: NENA NG-SEC & NIST CSF

Quick Answer: The public safety communications cyber threat landscape has transformed radically with the migration from legacy, air-gapped circuit-switched networks to IP-based Next Generation 9-1-1 (NG911) Emergency Services IP Networks (ESInets) and integrated Computer Aided Dispatch (CAD) systems. Securing this expanded attack surface requires applying NENA's NG-SEC standard (NENA-STA-040) and related NG9-1-1 security guidance alongside the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover). A robust defense-in-depth model demands strict network segmentation, perimeter Border Control Functions (BCFs), least privilege role-based access, behavioral endpoint detection and response (EDR), continuous vulnerability scanning, and staged patch management. Authentication across ESInets relies on the i3 public safety PKI anchored by the PSAP Credentialing Agency (PCA), using X.509 certificates and mutual Transport Layer Security (mTLS) to validate devices, services, and agencies.

---

1. The Modern Public Safety Cyber Threat Surface & IP Convergence

Historically, emergency communications centers (ECCs) and Public Safety Answering Points (PSAPs) operated in relative isolation from commercial cyber threats. Legacy Enhanced 9-1-1 (E9-1-1) networks relied on dedicated, point-to-point Time Division Multiplexing (TDM) circuits, Centralized Automatic Message Accounting (CAMA) analog trunks, and Signaling System No. 7 (SS7) closed networks managed by incumbent local exchange carriers (ILECs). This architecture benefited from "security through obscurity"—an attacker could not easily compromise a 9-1-1 tandem switch or selective router via the public internet because no IP pathway existed.

LEGACY E9-1-1 ENVIRONMENT                      NEXT GENERATION 9-1-1 (NG911) ENVIRONMENT
[Dedicated Copper / TDM Trunks]                [Emergency Services IP Network (ESInet)]
              │                                                  │
              ▼                                                  ├─► SIP / RTP Voice & Video
   [Selective Router Tandem]                                     ├─► HELD / LOST / PIDF-LO Location
              │                                                  ├─► CAD-to-CAD Interfaces
              ▼                                                  ├─► GIS Web Map Services
     [Dedicated CAMA Trunk]                                      ├─► Citizen Media (Photos/Video)
              │                                                  └─► IoT / Telematics Ingestion
              ▼                                                                  │
   [Isolated PSAP CPE Console]                                                   ▼
 (Closed Circuit / Air-Gapped)                                    [Border Control Function (BCF)]
                                                                                 │
                                                                                 ▼
                                                                     [PSAP IP Network & Next-Gen CAD]

The nationwide deployment of Next Generation 9-1-1 (NG911) has completely dissolved this physical isolation. NG911 replaces dedicated analog circuits with high-speed, packet-switched Emergency Services IP Networks (ESInets) that utilize open, commercial internet protocols defined by the Internet Engineering Task Force (IETF) and NENA i3 standards:

• Session Initiation Protocol (SIP): Used for session establishment, signaling, and call teardown across originating service providers (OSPs) and ESInets.
• Real-Time Transport Protocol (RTP / SRTP): Transports streaming voice, high-definition audio, and real-time citizen video.
• HTTP-Enabled Location Delivery (HELD) & Presence Information Data Format Location Object (PIDF-LO): Carries XML-encoded geodetic and civic location data over standard web transport.
• CAD-to-CAD & GIS Web Interfaces: Interconnects municipal dispatch centers, state law enforcement switches, and cloud-hosted Geographic Information System (GIS) spatial layers.
• Direct Citizen Media & IoT Ingestion: Enables telecommunicators to receive photos, streaming video, automated crash notifications (AACN/telematics), and sensor data directly from consumer smartphones and connected devices.

While these capabilities revolutionize emergency response, they expose public safety infrastructure to the entire taxonomy of modern cyber threats. An unauthenticated SIP flood can overwhelm an emergency ingress gateway; a weaponized attachment or malicious URL disguised as citizen video can compromise a call-taking workstation; and unpatched vulnerabilities in commercial off-the-shelf (COTS) operating systems can provide adversaries with lateral footholds into Computer Aided Dispatch (CAD) and mobile data networks.

---

2. NENA NG9-1-1 Security Documents: NG-SEC & NENA-INF-015

NENA addresses these IP-centric threats in two companion documents. The NG-SEC standard (NENA-STA-040.2-2024, which replaced NENA 75-001) sets security requirements for NG9-1-1 entities, and the NENA-INF-015.1-2016 NG9-1-1 Security Information Document (now archived) explains the threats and design considerations behind them. Together they guide the engineering of secure ESInets, Next Generation Core Services (NGCS), and PSAP local environments.

The central message is that security cannot be an afterthought bolted onto an operational network; it must be architected into every hardware node, software layer, and administrative procedure. The guidance covers protective measures across several operational domains:

[External IP World / OSP Traffic] ──► [Border Control Function (BCF)]
                                                  │
                       ┌──────────────────────────┴──────────────────────────┐
                       ▼                                                     ▼
            [Session Border Controller]                            [Next-Gen Firewall / IDS]
            - SIP header sanitization                              - Deep packet inspection
            - Rogue RTP packet dropping                            - Stateful access control
            - Malformed PIDF-LO filtering                          - DDoS volumetric scrubbing
                       │                                                     │
                       └──────────────────────────┬──────────────────────────┘
                                                  │ (Clean, Authenticated Traffic)
                                                  ▼
                               [Secure ESInet Core (NGCS)]
                               [ECRF / LVF / ESRP / PRF]
                                                  │
                                                  ▼
                                    [PSAP Local Secure Boundary]

Protection of Next Generation Core Services (NGCS)

NGCS functional elements—including the Emergency Call Routing Function (ECRF), Location Validation Function (LVF), Emergency Service Routing Proxy (ESRP), and Policy Routing Function (PRF)—are critical infrastructure nodes. NENA security guidance calls for:

• DNS & ECRF/LVF Integrity: Implementing Domain Name System Security Extensions (DNSSEC) to prevent DNS spoofing and cache poisoning that could misroute 9-1-1 calls to illegitimate answering points.
• Traffic Sanitization: Strict XML schema validation on all incoming HELD and PIDF-LO location documents to prevent buffer overflow attacks or XML external entity (XXE) injection attacks.
• Core Service Isolation: Restricting NGCS access exclusively to authorized, cryptographically identified nodes via private IP addressing and access control lists (ACLs).

The Border Control Function (BCF)

At the perimeter of every ESInet and every PSAP ingress sits the Border Control Function (BCF). Defined in the NENA i3 standard (NENA-STA-010) and addressed in NENA security guidance, the BCF serves as the critical security DMZ gateway separating untrusted external networks (originating service providers, public internet interfaces, external agency CAD links) from trusted public safety systems. The BCF integrates:

1. Next-Generation Firewall (NGFW): Enforces stateful packet inspection, protocol compliance, and port/IP access control.
2. Session Border Controller (SBC): Terminates external SIP/RTP media streams, inspects SIP message headers for protocol violations, normalizes signaling syntax, mitigates telephony denial-of-service (TDoS) floods, and transcodes audio streams.
3. Intrusion Detection and Prevention Systems (IDS/IPS): Performs deep packet inspection (DPI) in real time to detect known exploit signatures, abnormal traffic bursts, and unauthorized port reconnaissance.

---

3. The NIST Cybersecurity Framework (NIST CSF 2.0) in Public Safety

While NENA's NG-SEC documents address 9-1-1-specific systems and protocols, the overarching strategic governance of emergency communications cybersecurity is anchored in the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

In early 2024, NIST formally released NIST CSF 2.0, updating the historic five-function model by introducing Govern (GV) as a core, cross-cutting function. For Emergency Number Professionals (ENPs), mastering the six core functions of NIST CSF 2.0 is essential for developing defensible cybersecurity policies, managing agency risk, and achieving accreditation.

                              ┌────────────────────────┐
                              │      GOVERN (GV)       │
                              │ Strategy, Oversight,   │
                              │ Supply Chain Risk, C-Suite│
                              └───────────┬────────────┘
                                          │
         ┌────────────────┬───────────────┴───────────────┬────────────────┐
         ▼                ▼                               ▼                ▼
   IDENTIFY (ID)    PROTECT (PR)                     DETECT (DE)      RESPOND (RS)
   Asset Tracking,  Access Control,                  Continuous Mon., Incident Plan,
   Risk Assessment  Data Encryption,                 SIEM & EDR       Containment,
   Vulnerabilities  Network Zoning                   Telemetry        Mitigation
                                          │
                                          ▼
                                     RECOVER (RC)
                                     Resilience Plan,
                                     COOP Activation,
                                     Immutable Backups

The Six Core Functions Applied to Public Safety

1. Govern (GV): Establishing and monitoring the agency's cybersecurity risk management strategy, organizational roles, policies, legal/regulatory mandates (including FBI CJIS compliance), and supply-chain risk governance. In an ECC, Govern establishes executive accountability, directs funding toward critical cyber defenses, and mandates vendor risk assessments for CAD and radio providers.
2. Identify (ID): Understanding the cybersecurity risk to systems, assets, data, and capabilities. For a PSAP, this involves maintaining an exhaustive inventory of all physical hardware (call-handling consoles, CAD servers, logging recorders, administrative PCs), software applications, network interfaces, and third-party data connections, paired with regular risk assessments.
3. Protect (PR): Implementing safeguards to ensure delivery of mission-critical emergency services. Key protective controls include identity management, credentialing, multi-factor authentication (MFA), role-based access control (RBAC), data encryption (at rest and in transit), network segmentation, and recurring staff cybersecurity awareness training.
4. Detect (DE): Developing and implementing appropriate activities to identify the occurrence of a cybersecurity event. Public safety detection relies on continuous telemetry monitoring, centralized Security Information and Event Management (SIEM) log aggregation, and behavioral Endpoint Detection and Response (EDR) agents across all dispatch consoles.
5. Respond (RS): Taking action regarding a detected cybersecurity incident. ECC response includes activating the Computer Security Incident Response Plan (CSIRP), isolating infected network segments, redirecting 9-1-1 calls to backup facilities, mitigating vulnerabilities, and executing coordinated notifications to state authorities, CISA, and the FBI.
6. Recover (RC): Maintaining plans for resilience and restoring any capabilities or services impaired by a cyber incident. Recovery centers on restoring CAD and telephony systems from immutable, validated backups, executing Continuity of Operations (COOP) plans, and conducting structured post-incident lessons-learned reviews.

---

4. Defense-in-Depth Architecture for Emergency Communications

No single security technology can protect a modern emergency communications center. Public safety networks must be engineered under the principle of defense-in-depth—a multi-layered security architecture where the failure of one defensive barrier is mitigated by subsequent protective layers.

[Layer 1: Perimeter & Edge Defense] ──► BCF / SBC / Next-Gen Firewall / Anti-DDoS Scrubbing
        │
        ▼
[Layer 2: Network Segmentation]     ──► Micro-segmented VLANs / DMZs / CAD vs. Admin vs. ESInet
        │
        ▼
[Layer 3: Access Control & Identity] ──► Least Privilege (PoLP) / Multi-Factor Auth / RBAC
        │
        ▼
[Layer 4: Endpoint Defense]         ──► Behavioral EDR / Application Whitelisting / Host Hardening
        │
        ▼
[Layer 5: Vulnerability Management] ──► Continuous Scanning / Staged Patch Testing / Zero-Day Drills
        │
        ▼
[Layer 6: Data Resilience]          ──► 3-2-1 Air-Gapped Immutable Backups / Bare-Metal Restore

1. Perimeter Protection & Edge Filtering

At the network edge, Border Control Functions and carrier-grade DDoS mitigation appliances scrub incoming traffic. Session Border Controllers drop unauthenticated SIP requests and malformed RTP packets before they reach internal call-handling Customer Premises Equipment (CPE).

2. Network Segmentation & Micro-Segmentation

A cardinal rule of public safety network engineering is the total isolation of operational dispatch networks from municipal enterprise IT networks:

• ESInet / NGCS Zone: Restricted exclusively to authenticated 9-1-1 signaling, audio, and location payloads.
• CAD / Operations LAN: Houses CAD application servers, database clusters, and dispatch consoles. Must be separated from general municipal traffic via internal stateful firewalls.
• Land Mobile Radio (LMR) Dispatch Network: Connects IP-based radio dispatch consoles to radio core controllers, voting receivers, and donor repeaters over dedicated, prioritized VLANs.
• Administrative Network: General office computers, email, and web browsing. Under no circumstances may an administrative municipal PC share an unsegmented broadcast domain with a CAD workstation.
• Demilitarized Zones (DMZs): Broker external data exchanges, such as CAD-to-CAD feeds with external ambulance contractors or public GIS web mapping services.

3. Least Privilege Access Control (PoLP)

The Principle of Least Privilege (PoLP) dictates that users, software processes, and devices are granted only the minimum system access necessary to perform their legitimate operational duties:

• Telecommunicators must operate on locked-down dispatch consoles using standard, non-privileged user accounts. Local administrator privileges must be stripped from all console workstations to prevent the unauthorized execution of arbitrary scripts or malware installers.
• System administrators must utilize dedicated, named administrative accounts rather than shared "admin" or "root" logins. Administrative privileges must require multi-factor authentication and be invoked only when performing maintenance.

4. Endpoint Detection and Response (EDR)

Legacy signature-based anti-virus software is completely inadequate against modern polymorphic malware, fileless attacks, and ransomware. Public safety endpoints must deploy Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) agents. EDR agents continuously monitor kernel-level process executions, memory space, and network behaviors. When an EDR agent detects ransomware behavior—such as rapid bulk file encryption or unauthorized attempts to clear Windows shadow copies—it automatically terminates the offending process and isolates the compromised workstation from the network while alerting the security operations center (SOC).

5. Vulnerability Scanning & Patch Management Lifecycle

Public safety agencies operate under a continuous tension between 24/7/365 system uptime and the necessity of applying security patches. Unpatched vulnerabilities represent the primary entry point for automated exploits. A defensible patch management lifecycle requires:

• Routine Credentialed Scanning: Monthly automated vulnerability scans across all servers, switches, and workstations to identify Common Vulnerabilities and Exposures (CVEs).
• Sandbox / Staging Environment: Patches and operating system updates must never be applied directly to production CAD or call-handling systems. Updates must be tested in an offline staging lab to verify compatibility with mission-critical dispatch software.
• Emergency Out-of-Band Patching: Establishing formal protocols to test and deploy critical emergency patches within 24 to 72 hours when active, weaponized zero-day exploits threaten public safety infrastructure.

6. Immutable Off-Site Backups

When sophisticated ransomware compromises an enterprise, attackers actively seek out and destroy online backup catalogs to force extortion payments. To guarantee disaster recovery, ECCs must enforce the 3-2-1 backup strategy:

• Maintain at least 3 copies of all critical data (including CAD databases, GIS layers, call audio recordings, and system configuration files).
• Store backups on at least 2 different storage media types (e.g., local high-speed SAN and off-site cloud repository).
• Keep at least 1 copy completely off-site and immutable.
• Immutability (Write-Once-Read-Many / WORM): Immutable backups use cryptographic write locks preventing data from being altered, encrypted, or deleted by any user or ransomware payload for a predetermined retention period. Backups must undergo quarterly automated restoration drills to verify bare-metal recovery capabilities.

---

5. The i3 Public Safety PKI & the PSAP Credentialing Agency (PCA)

In an open IP environment, how does a PSAP know that an incoming call, CAD-to-CAD message, or GIS update really comes from an authorized public safety entity? NENA i3 answers with a public safety Public Key Infrastructure (PKI) whose root of trust is the PSAP Credentialing Agency (PCA) (the ENP Body of Knowledge lists it as the PSAP Credentialing Authority).

                   ┌─────────────────────────────────────────┐
                   │ PSAP Credentialing Agency (PCA) Root    │
                   └────────────────────┬────────────────────┘
                                        │ (signs)
         ┌──────────────────────────────┴──────────────────────────────┐
         ▼                                                             ▼
[Authorized Intermediate CA]                               [Authorized Intermediate CA]
         │                                                             │
         ▼ (issues agency / element certs)                             ▼ (issues provider certs)
[PSAP Border Control Function]                           [Originating Service Provider SBC]
         │                                                             │
         └─────────────────── Mutual TLS (mTLS) ───────────────────────┘

How the PKI Works

• Certificates for entities and elements: Agencies, PSAP systems, functional elements (BCF, ESRP, ECRF, LIS, logging), and service providers hold X.509 certificates that chain back to the PCA.
• Revocation: Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP) let systems check whether a credential has been withdrawn.
• Identity for authorization: Certificates identify who is making a request, so policy can decide, for example, whether a requester may dereference location or retrieve additional data.

Mutual TLS (mTLS)

Standard web browsing uses one-way TLS: the client checks the server's certificate, but the server does not verify the client. NG9-1-1 connections between trusted entities use mutual TLS:

1. The client presents its X.509 certificate to the server.
2. The server presents its certificate to the client.
3. Each side validates the other's certificate chain to the PCA root and checks revocation status.
4. Only then is encrypted traffic exchanged.

Mutual authentication sharply reduces spoofing, unauthorized connections, and man-in-the-middle interception across the ESInet, but it is one layer of defense in depth, not a guarantee. Stolen credentials, compromised endpoints, and malicious calls arriving from legitimate originating networks still require monitoring at the BCF and elsewhere.

---

6. Operational Traps & ENP Exam Watch

• NIST CSF 2.0 Introduces "Govern": Earlier editions of the NIST CSF contained five functions (Identify, Protect, Detect, Respond, Recover). NIST CSF 2.0 elevated Govern (GV) as the sixth, overarching core function establishing risk strategy, supply chain management, and oversight. Questions regarding CSF structure frequently test this distinction.
• Air-Gapped Myth: Never assume a modern PSAP is "air-gapped." The moment an agency connects its CAD to state criminal databases, deploys wireless MDTs, allows vendor remote support, or ingests citizen text-to-911, physical air-gapping is broken. Defense-in-depth and network micro-segmentation must replace reliance on false air-gap assumptions.
• Patching vs. Operational Availability: Emergency communications systems cannot simply enable "automatic overnight reboots" for operating system updates. All security patches must be staged, tested against CAD/CPE software stacks in a sandbox, and applied during controlled, scheduled maintenance windows with redundant failovers in place.
• One-Way TLS vs. Mutual TLS (mTLS): Remember that standard TLS only authenticates the server to the client. NG9-1-1 connections between trusted entities use mTLS, where both endpoints present and validate X.509 certificates that chain to the PCA before exchanging traffic.