nd ZUC with 128-bit key support for encryption (ciphering) and authentication (integrity protection). Ciphering is mandatory to be supported for both U-Plane and C-Plane traffic that goes over-the-air. Integrity protection has been introduced as a mandatory feature to be supported for the U-Plane traffic by both gNB and UE in 5G/NR, which is a change from 4G/LTE that only mandated ciphering for the U-Plane. Whilst support is mandatory, feature enablement is optional on a per-operator basis and can be limited to traffic throughputs (rates) to enable implementations on older platforms with limited hardware support. Setup and Configuration. Setting up and configuring a base station by Operation and Maintenance (O&M) systems shall be authenticated and authorized by the small cell SO that attackers shall not be able to modify the settings and software configurations via local or remote access. Certificate enrollment mechanism specified in TS 33.310 for base station should be supported. Communication between the O&M systems and the base station shall be confidentiality, integrity, and replay protected from unauthorized parties. The security associations between the small cell and an entity in the core network or in an O&M domain trusted by the operator shall be supported. These security association establishments shall be mutually authenticated. The security associations shall be realized according to TS 33.210 and TS 33.310. In practice, this defines the requirements for a VPN/IPSec tunnel between the O-RAN components as well as 214 Open Radio Access Network (O-RAN) Systems Architecture and Design between the CU and the Core Network. We discussed some of the high-level performance aspects in the CU System Component. The base station shall be able to ensure that software/data change attempts are authorized. The base station shall use authorized data/software. Sensitive parts of the boot-up process shall be executed with the help of the secure environment. Confidentiality of software transfer towards the small cell shal