ETSI GR ZSM 017 V1.1.1 (2026-01)

Zero-touch network and Service Management (ZSM); Closed-Loop Automation Security aspects

DGR/ZSM-017_CLA_Sec

General Information

• Status: Not Published
• Technical Committee: ZSM - Zero-touch network and Service Management
• Current Stage: 12 - Citation in the OJ (auto-insert)
• Due Date: 25-Jan-2026
• Completion Date: 08-Jan-2026

Standards Content (Sample)

GROUP REPORT
Zero-touch network and Service Management (ZSM);
Closed-Loop Automation Security aspects
Disclaimer
The present document has been produced and approved by the Zero-touch network and Service Management (ZSM) ETSI
Industry Specification Group (ISG) and represents the views of those members who participated in this ISG.
It does not necessarily represent the views of the entire ETSI membership.

2 ETSI GR ZSM 017 V1.1.1 (2026-01)

Reference
DGR/ZSM-017_CLA_Sec
Keywords
automation, closed control loop,
security requirements
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE

Tel.: [phone]  Fax: [phone]

Siret N° 348 623 562 00017 - APE 7112B
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° w061004871

Important notice
The present document can be downloaded from the
ETSI Search & Browse Standards application.
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI
deliverable is the one made publicly available in PDF format on ETSI deliver repository.
Users should be aware that the present document may be revised or have its status changed,
this information is available in the Milestones listing.
If you find errors in the present document, please send your comments to
the relevant service listed under Committee Support Staff.
If you find a security vulnerability in the present document, please report it through our
Coordinated Vulnerability Disclosure (CVD) program.
Notice of disclaimer & limitation of liability
The information provided in the present deliverable is directed solely to professionals who have the appropriate degree of
experience to understand and interpret its content in accordance with generally accepted engineering or
other professional standard and applicable regulations.
No recommendation as to products and services or vendors is made or should be implied.
No representation or warranty is made that this deliverable is technically accurate or sufficient or conforms to any law
and/or governmental rule and/or regulation and further, no representation or warranty is made of merchantability or fitness
for any particular purpose or against infringement of intellectual property rights.
In no event shall ETSI be held liable for loss of profits or any other incidental or consequential damages.

Any software contained in this deliverable is provided "AS IS" with no warranties, express or implied, including but not
limited to, the warranties of merchantability, fitness for a particular purpose and non-infringement of intellectual property
rights and ETSI shall not be held liable in any event for any damages whatsoever (including, without limitation, damages
for loss of profits, business interruption, loss of information, or any other pecuniary loss) arising out of or related to the use
of or inability to use the software.
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and
microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.

© ETSI 2026.
All rights reserved.
ETSI
3 ETSI GR ZSM 017 V1.1.1 (2026-01)
Contents
Intellectual Property Rights . 5
Foreword . 5
Modal verbs terminology . 5
Introduction . 5
1 Scope . 7
2 References . 7
2.1 Normative references . 7
2.2 Informative references . 7
3 Definition of terms, symbols and abbreviations . 8
3.1 Terms . 8
3.2 Symbols . 8
3.3 Abbreviations . 8
4 Security threats and risks analysis . 9
4.1 Gap analysis with ETSI GR ZSM 010 . 9
4.1.1 Gap between ETSI GR ZSM 010 and the present document . 9
4.1.2 Relationship between ETSI GR ZSM 010 and the present document . 11
4.2 Threats and risk analysis on implementation of Closed-Loop Automation. 11
4.2.1 Monitoring stage . 11
4.2.2 Analysis stage . 12
4.2.3 Decision stage . 12
4.2.4 Execution stage . 13
4.2.5 Composition of Closed Loops . 14
4.2.6 Threat analysis report. 15
4.3 Threats and risk analysis on coordination/governance of Closed-Loop Automation . 17
4.3.1 Coordination between hierarchical Closed Loops . 17
4.3.2 Coordination between peer Closed Loops . 19
4.3.3 Interaction between Closed Loops and external entities . 20
4.3.3.1 Introduction . 20
4.3.3.2 Interactions based on policies . 21
4.3.3.3 Interactions based on intents . 21
4.3.4 Threat analysis report. 22
5 Potential security solutions . 25
5.1 Closed Loop trust management for coordination between Closed Loops . 25
5.1.1 Issue description . 25
5.1.2 Potential proposed solutions . 26
5.1.2.1 High Level description of the proposed solution . 26
5.1.2.2 Procedures of the proposed solution . 27
5.1.3 Potential requirements on Closed Loop trust management related capability . 28
5.2 Closed Loop access control for coordination between Closed Loops . 29
5.2.1 Issue description . 29
5.2.2 Potential proposed solutions . 29
5.2.2.1 High Level description of the proposed solution . 29
5.2.2.2 Procedures of the proposed solution . 30
5.2.3 Potential requirements on Closed Loop access control management related capability . 31
5.3 Closed Loop security exposure for coordination between Closed Loops . 32
5.3.1 Issue description . 32
5.3.2 Potential proposed solutions . 32
5.3.2.1 High Level description of the proposed solution . 32
5.3.2.2 Procedures of the proposed solution . 33
5.3.3 Potential requirements on Closed Loop security exposure related capability . 34
6 Recommendations . 35
6.1 The summary of the present document . 35
ETSI
4 ETSI GR ZSM 017 V1.1.1 (2026-01)
6.2 Potential future work based on the present document . 35
Annex A: Change history . 36
History . 37

ETSI
5 ETSI GR ZSM 017 V1.1.1 (2026-01)
Intellectual Property Rights
Essential patents
IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The declarations
pertaining to these essential IPRs, if any, are publicly available for ETSI members and non-members, and can be
found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to
ETSI in respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the
ETSI IPR online database.
Pursuant to the ETSI Directives including the ETSI IPR Policy, no investigation regarding the essentiality of IPRs,
including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not
referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become,
essential to the present document.
Trademarks
The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.
ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no
right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does
not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.
DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its
Members. 3GPP™, LTE™ and 5G™ logo are trademarks of ETSI registered for the benefit of its Members and of the
3GPP Organizational Partners. oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and of ®
the oneM2M Partners. GSM and the GSM logo are trademarks registered and owned by the GSM Association.
Foreword
This Group Report (GR) has been produced by ETSI Industry Specification Group (ISG) Zero-touch network and
Service Management (ZSM).
Modal verbs terminology
In the present document "should", "should not", "may", "need not", "will", "will not", "can" and "cannot" are to be
interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.
Introduction
The general ZSM security were studied and provided in ETSI GR ZSM 010 [i.1] and ETSI GS ZSM 014 [i.15], the
autonomous, dynamic, and cross-domain nature of Closed Loops introduces a new and complex threat landscape within
the ZSM framework. The present document covers security threat and risk analytics on the Closed Loop and
Closed-Loop Automation within the ZSM framework, including the implementation of a single Closed Loop and the
coordination/governance between multiple Closed Loops.
Several key security issues are identified according to security risk analytics, and potential solutions were proposed to
mitigate the risks, which include:
• Trust issue of multiple Closed Loops during the coordination and build relationship between Closed Loops
across multiple management domains.
• Access control for the coordination between different Closed Loops provided by multiple domain service
producers of ZSM framework.
ETSI
6 ETSI GR ZSM 017 V1.1.1 (2026-01)
• Leverage Closed Loop security exposure mechanism to secure exposure of the management services between
multiple Closed Loops within the ZSM framework.

ETSI
7 ETSI GR ZSM 017 V1.1.1 (2026-01)
1 Scope
The present document studies analysis of security risks related to Closed-Loop Automation (CLA) based on ETSI
GS ZSM 009-1 [i.3], part 2 [i.8], part 3 [i.9], ETSI GR ZSM 010 [i.1], ETSI GS ZSM 014 [i.15] and ETSI
GS ZSM 016 [i.12], as well as provides the gap analysis with ETSI GR ZSM 010 [i.1]. Based on the analysis
conducted, the present report proposes new security capabilities for the ZSM framework architecture to support the
mitigation of relevant security risks, especially those applicable to the coordination across Closed Loops from different
management domains under the ZSM framework. Recommendations for future work are included in the present
document.
2 References
2.1 Normative references
Normative references are not applicable in the present document.
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long-term validity.
The following referenced documents may be useful in implementing an ETSI deliverable or add to the reader's
understanding, but are not required for conformance to the present document.
[i.1] ETSI GR ZSM 010: "Zero-touch network and Service Management (ZSM); General Security
Aspects".
[i.2] ETSI GS ZSM 002: "Zero-touch network and Service Management (ZSM); Reference
Architecture".
[i.3] ETSI GS ZSM 009-1: "Zero-touch network and Service Management (ZSM); Closed-Loop
Automation; Part 1: Enablers ".
[i.4] NIST SP 800-30 (Revision 1): "Guide for Conducting Risk Assessments".
[i.5] ISO/IEC 27005:2011: "Information technology - Security techniques - Information security risk
management".
[i.6] Recommendation ITU-T X.805 (10/2003): "Security architecture for systems providing end-to-end
communications".
[i.7] MITRE Common Attack Pattern Enumeration and Classification (CAPEC) project.
[i.8] ETSI GS ZSM 009-2: "Zero-touch network and Service Management (ZSM); Closed-Loop
Automation; Part 2: Solutions for automation of E2E service and network management use cases".
[i.9] ETSI GR ZSM 009-3: "Zero-touch network and Service Management (ZSM); Closed-Loop
Automation; Part 3: Advanced topics".
[i.10] Benzaid C, Taleb T. ZSM security: Threat surface and best practices[J]. IEEE Network, 2020,
34(3): 124-133.
[i.11] ETSI GR ZSM 011 (V2.1.1): "Zero-touch network and Service Management (ZSM); Intent-driven
autonomous networks; Generic aspects".
ETSI
8 ETSI GR ZSM 017 V1.1.1 (2026-01)
[i.12] ETSI GS ZSM 016 (V1.1.1): "Zero-touch network and Service Management (ZSM); Intent-driven
Closed Loops".
[i.13] NIST SP 800-160v1r1: "Engineering Trustworthy Secure Systems".
[i.14] ETSI GR NFV-SEC 007 (V1.1.1): "Network Functions Virtualisation (NFV); Trust; Report on
Attestation Technologies and Practices for Secure Deployments".
[i.15] ETSI GS ZSM 014 (V1.1.1): "Zero-touch network and Service Management (ZSM); ZSM security
aspects".
3 Definition of terms, symbols and abbreviations
3.1 Terms
Void.
3.2 Symbols
Void.
3.3 Abbreviations
For the purposes of the present document, the following abbreviations apply:
AAA Authentication, Authorization and Account/Audit
AI Artificial Intelligence
API Application Programming Interface
APT Advanced Persistent Threat
CAPEC Common Attack Pattern Enumeration and Classification
CDIF Cross-Domain Integration Fabric
CL Closed Loop
CLA Closed-Loop Automation
CLC Closed Loop Coordination
CLG Closed Loop Governance
CLGSP Closed Loop Governance Service Producer
CVE Common Vulnerabilities and Exposures
DDoS Distributed Denial of Service attack
DIF Domain Integration Fabric
DoS Denial of Service
DPI Deep Packet Inspection
E2E End-to-End
E2ES End-to-End Service
IAM Identity and Access Management
IME Intent Management Entities
IPS Intrusion Prevention System
ISO International Organization for Standardization
KPI Key Performance Indicator
LoA Levels of Assurance
M2O-CL Made-to-Order Closed Loop
MD Management Domain
ML Machine Learning
NFV Network Function Virtualisation
OWASP Open Web Application Security Project
RM-CL Ready-Made Closed Loop
SDO Standard Development Organization
SLA Service Level Agreement
SLS Service Level Specification
ETSI
9 ETSI GR ZSM 017 V1.1.1 (2026-01)
TRA Threat and Risk Analysis
UEBA User and Entity Behavior Analytics
VNF Virtual Network Function
4 Security threats and risks analysis
4.1 Gap analysis with ETSI GR ZSM 010
4.1.1 Gap between ETSI GR ZSM 010 and the present document
In ETSI GR ZSM 010 [i.1], general approach was given to security threat and risk analysis for ZSM framework and
some solutions were proposed to mitigate the security risks. According to the defined ZSM threat and risk analysis
framework, the generic security threats and risk analysis for ZSM framework from assets perspective has been studied
in ETSI GR ZSM 010 [i.1], including E2E Service management domain, E2E Service management function, E2E
Service management service, etc. Security risks of Closed Loop and Closed-Loop Automation have not been analysed
in detail.
As described in clause 7.1 of ETSI GS ZSM 002 [i.2], Closed Loops are composed of the building blocks defined in
clause 6.1.2 of ETSI GS ZSM 002 [i.2] including management services, management functions, management domains,
etc. Closed Loop is a type of control mechanism (refer to clause 6 of ETSI GS ZSM 009-1 [i.3]) to monitor and regulate
a set of managed entities achieving a specific goal, which is composed by four stages: monitoring, analysis, decision
and execution plus knowledge as its components. Closed-Loop Automation combined Closed Loop stages can be
automatically processed to fulfill the Closed Loop's goal which is realized with the combination and chaining of
management services (data, analytics, policy, orchestration, etc.). According to clause 5.2 [CL-general-5] in ETSI
GS ZSM 009-1 [i.3], Closed Loop in a (E2ES) management domain or across management domains consists of
different stages which are realized by one or more management functions/services across multiple management
domains. In this scenario, the implementation of Closed Loop itself becomes more complex and the security risk
analysis for Closed-Loop Automation will become more complicated. For example, E2E service data collection in E2E
service management domain can be used in the Closed Loop monitoring stage and domain orchestration and control
management services in another management domain may be used in Closed Loop execution stage. New security
challenge will be introduced between two different trustworthiness management domains because the security
capability and assurance of two management domains are different. Further, according to clause 5.2 [CL-general-15] in
ETSI GS ZSM 009-1 [i.3], Closed Loops within the ZSM framework can collect data from multiple available and
applicable data sources, including managed services, managed resources and Closed Loops. In the monitoring stage, it
may collect data that is not within the scope of its authorization or collect too much data not needed for any function,
resulting in data leakage and data privacy security issues.
ETSI
10 ETSI GR ZSM 017 V1.1.1 (2026-01)
Some general requirements about coordination, governance and interaction between Closed Loops (refer to
[CL-general-3], [CL-general-4] and [CL-general-24] in clause 5.2 of ETSI GS ZSM 009-1 [i.3]) have been defined,
Closed Loops stages/Closed Loops can be coordinated, governed and interacted with external entities (other Closed
Loops and ZSM framework consumers) within a single management domain and multiple management domains. Thus,
complex coordination, governance and interactions between Closed Loops across multiple management domains
introduce new security challenges for ZSM framework. When the Closed Loop is in a hierarchical or peer relationship
between service management domain and (E2E) service management domain, if the access policy (data policy and
service policy) is improperly set, there is a security risk of unauthorized access to resources or service of CLs. Further,
the exposure entitlements of CL's management services may change dynamically, if the configurations cannot
dynamically adapt to such changes, it may cause inappropriate external visibility. As described in clauses 8.2.5.2 and
8.2.5.4 of ETSI GS ZSM 009-1 [i.3], some important interaction information (such as details on CL instance attributes
involved in the interactions, action plans, etc.) are used in the Closed Loop Coordination (CLC) functionality. If there is
no proper protection, it will be a security risk that important and sensitive data may be disclosed. Further, if the
information sent or received by CL are stolen and tampered, CL may be unable to achieve the original goal using
inaccurate information. Even worse, attackers may deplete the quantity of the resource available to service legitimate
requests maliciously.
Figure 4.1.1-1: ZSM Closed-Loop Automation security risk analysis
introduced in the present document
Figure 4.1.1-1 depicts the ZSM Closed-Loop Automation security risks analysis introduced in the present document.
The security risk analysis can be performed from the implementation of a Closed Loop (clause 4.2) or from the
coordination/governance between different Closed Loops across multiple management domains (clause 4.3).
To sum up, the present document provides new and specific security threats and risk analysis on Closed Loop and
Closed-Loop Automation, which has not been covered by ETSI GR ZSM 010 [i.1] security study.
ETSI
11 ETSI GR ZSM 017 V1.1.1 (2026-01)
4.1.2 Relationship between ETSI GR ZSM 010 and the present document
The present document refers to the general methodologies, which are adopted in ETSI GR ZSM 010 [i.1], such as NIST
800-30 [i.4], ISO/IEC 27005 [i.5] and Recommendation ITU-T X.805 [i.6] for security Threat and Risk Analysis (TRA)
of ZSM Closed Loop and Closed-Loop Automation. Closed Loops can be identified as assets in the ZSM framework
which are composed of multiple assets including E2E Service management domain, E2E Service management function,
E2E Service management service, Management Service management domain, etc. According to the clause 4.2 in ETSI
GR ZSM 010 [i.1], security threats and risks for some assets have been studied in E2E service point of view including
E2E Service management domain, E2E Service management function, E2E Service management service,
Cross-Domain data service, Integration fabric and Collected data. Apart from security risk analysis for these assets, the
present document analyses the security risk of ZSM Closed Loop and Closed-Loop Automation and focuses on the
Closed Loop specific consequence of incident and potential countermeasures according to MITRE Common Attack
Pattern Enumeration and Classification (CAPEC) [i.7].
The CL stages and functionalities (Closed Loop components) have been mapped to management functions based on the
management services as defined the ETSI GS ZSM 002 [i.2] (refer to clause 7.3 of ETSI GS ZSM 009-1 [i.3]). The
security threat and risk analysis for Closed Loop stages and coordination/governance of Closed-Loop Automation are
performed according to the list of potential Deliberate threat category (refer to clause 4.1.4.1 of ETSI GR ZSM 010
[i.1]).
4.2 Threats and risk analysis on implementation of Closed-Loop
Automation
4.2.1 Monitoring stage
According to clause 7.2.1 and clause 7.2.2 of ETSI GS ZSM 009-1 [i.3], the monitoring stage which is responsible for
transferring, collecting and pre-processing data from managed entities or from external sources, provides information
based on historical and/or streaming real-time data coming from various data sources. It also provides capabilities for
tuning the data sources and data ingestion.
As described in clause 7.3 of ETSI GS ZSM 009-1 [i.3], the monitoring stage is realized, fully or in part, by the (domain
or E2E) data collection management services from deployment view. Domain data collection services include event
notification services, performance measurements streaming service, performance measurements collection service and
log collection service (refer to clause 6.5.2 of ETSI GS ZSM 002 [i.2]). E2E service data collection services include
E2E performance data reporting service (refer to clause 6.6.2 of ETSI GS ZSM 002 [i.2]).
In the monitoring stage, the relevant data (e.g. live performance and fault data of managed entities and managed
services) is collected following the goals assigned to the Closed Loop. Besides, the sensitive information of Closed
Loop (e.g. logs, outcomes derived in each CL stage) is collected for deriving insights of CL in the analysis stage. Since
a large amount of sensitive data in different formats and coming from various sources are collected, stored and
translated, data privacy is a main concern for (domain or E2E) data collection management services used in the
monitoring stage. The confidentiality, integrity and availability of collected data at rest, in transit and in use is defended
against potential data security threat and risk, such as data tampering, data leakage, illegal data acquisition, etc.
The security risks and threats of implementation of Closed Loop and Closed-Loop Automation using data collection
management services above during monitoring stage are analysed as followed:
• Tamper or leak collected data: Data notifications related to faults, performance and security from the
underlying managed entities and consumed managed services are provided in the performance measurements
streaming service and performance measurements collection service. Closed-Loop Automation (CLA) uses
these feedback information data to create automated processes, if the other managed entities or external
attacker without required privilege gain and tamper collected data. On the one hand, the device, system, or
network of Closed Loops within the ZSM framework may be unavailable because leak of sensitive
information may bring disruption to the infrastructure resources and network. On the other hand, incorrect
performance data can affect insights from monitoring data, leading to deviations or inability to achieve the
goals of Closed-Loop Automation.
ETSI
12 ETSI GR ZSM 017 V1.1.1 (2026-01)
• Tamper log: Logs about system running, operation and security events are collected in the log collection
service to enable health, security and performance monitoring of managed entities in the CL. If the logs are
tampered with, the attack behaviors cannot be detected in a timely manner. When the logs including abnormal
state changes information reported in the monitoring stage, the CLA may take wrong actions based on the
tampered log.
• Authentication abuse or bypass: An attacker without authorized access to managed entities steals information
about key performance indicators or resources to control the management domains including E2E management
services. The attacker can perform the excessive consumption of resources, disrupting the process of CLA and
causing the significant deviations or faults of the goal of CLA.
4.2.2 Analysis stage
As described in clause 7.2.1 of ETSI GS ZSM 009-1 [i.3], the analysis stage is responsible for deriving insights from
available data from the monitoring stage as well as historical data. It also provides capabilities for tuning the analytics
models and starting/terminating the analytics processes. Historical and real-time analytics insights deriving in the
analysis stage are provided to the decision stage.
As described in clause 7.3 of ETSI GS ZSM 009-1 [i.3], the analysis stage is realized, fully or in part, by the (domain or
E2E) analytics management services from deployment view. Domain analytics management services include analytics
services, domain condition detection service and data optimization services (refer to clause 6.5.3 of ETSI
GS ZSM 002 [i.2]). E2E service analytics management services include analytics services, E2E service quality
management service and E2E service condition detection service (refer to clause 6.6.3 of ETSI GS ZSM 002 [i.2]).
In the analysis stage, domain analytics services provide domain-specific insights and predictions based on data collected
by domain data collection services and other data. Since information of insights and predictions (e.g. analysis results,
performance evaluation) have a significant impact for the decision stage, integrity and confidentiality of the information
should be protected for the analysis stage to ensure the authenticity of information provided by (domain or E2E) data
analytics services for the Closed Loop.
The security risks and threats of implementation of Closed Loop and Closed-Loop Automation using domain analytics
management services above during analysis stage are analysed as followed:
• Tamper analysis results: Analytics services provide the anomaly detection service capabilities to detect
anomalous conditions of CL using the collected fault, performance, usage and configuration data about the
managed entity, manage (create, read, update, delete, list) analysis results, and analyse incident patterns and
root cause to produce insights. When the abnormal analysis results are tampered with, it causes the managed
services that subscribe to message notifications to receive incorrect results. The wrong results cannot trigger
domain intelligence in decision stage to make appropriate decisions, causing deviations or faults of the goal of
CLA.
• Tamper monitor condition: Domain condition detection service receives a set of conditions which can be
defined on a case-by-case basis to be monitored continuously, and manage the conditions associated with a
domain service model. The activation or deactivation of detection of conditions is specific to the network
service instance and can be done per condition. An adversary tampers monitor condition, which impacts the
analytics result in the analysis stage of CL. Besides, abnormal events (e.g. exceeding the threshold of the
network resource utilization) cannot be reported to the CL, misleading the CL reaction (e.g. insufficient
resources to execute Closed Loop in reality). Even worse, the operation of the entire Closed Loop is affected.
4.2.3 Decision stage
The decision stage which is responsible for deriving workflows from insights provided by the analysis stage, governs
the behaviour of the system and decides which actions should be taken in face of issues detected in the analysis stage
(refer to clause 7.2.1 of ETSI GS ZSM 009-1 [i.3]). In this stage, it provides action plans in form of workflows to
managed entities, tune decision modules according to analysis insights.
As described in clause 7.3 of ETSI GS ZSM 009-1 [i.3], the decision stage is realized, fully or in part, by the (domain or
E2E) intelligence management services from deployment view. Domain intelligence management services include AI
model management service, deployed AI model assessment service, AI training data management service, knowledge
base service and health issue reporting service (refer to clause 6.5.4 of ETSI GS ZSM 002 [i.2]). E2E intelligence
management services include AI model management service, deployed AI model assessment service, AI training data
management service, E2E health issue reporting service (refer to clause 6.6.4 of ETSI GS ZSM 002 [i.2]).
ETSI
13 ETSI GR ZSM 017 V1.1.1 (2026-01)
In the decision stage, intelligence services enable decision supporting, decision making and action planning via training
AI models. The confidentiality of the AI model is one main concern for the Closed-Loop Automation. Besides, data
security and privacy particularly for training data is another main concern in the decision stage.
The security risk and threats of implementation of Closed Loop and Closed-Loop Automation during the decision stage
using (domain or E2E) intelligence management services are analysed as followed:
• AI models stolen: The AI model management service enables to manage AI models, an AI model can be
updated on the basis of new input data periodically or at any time. An attacker steals AI models for the Closed-
Loop Automation, rebuilds or copies the AI model, discovers the structure, function, and composition of the
CL by using a variety of analysis techniques to determine how Closed-Loop Automation was constructed or
operated. The vulnerabilities of constructions or operations can be exploited by the adversary to compromise
the function and associated systems of the Closed-Loop Automation.
• Tamper evaluation results of AI model: Deployed AI model assessment service provides the result of the AI
model assessment process, which is used to decide on the most appropriate actions to perform on the deployed
AI model such as retrain, reconfigure, upgrade, replace, pause and terminate. Tampering the evaluation results
can affect the operational decisions of AI models, leading to inaccurate matching between the model and
reality and deviations in achieving Closed-Loop Automation goals.
• Tamper training data: The decision stage manages the training data used to train AI models. An adversary
implants malicious samples or modify the training data that is required to train or re-train the AI models,
resulting in incorrect predictions or decisions of the AI model in the future. The model is deviated from the
representation of real data, bringing security issues in the deployment and operation of Closed-Loop
Automation.
• Leakage of knowledge base: The knowledge base may contain problem causes derived from historical,
operational and configurational data, as well as conclusions drawn from analysis of combinations of problem
causes. If the information leaked, attackers may exploit information of known problems collected in the
knowledge base to attack the process of Closed-Loop Automation, which may lead to the unavailability of
associated service and its resources.
4.2.4 Execution stage
The execution stage is responsible for executing workflows towards managed entities within the ZSM framework.
Execution occurs when the decision stage determines that an action is required (refer to clause 7.2.1 of ETSI
GS ZSM 009-1 [i.3]). In this stage, it executes the workflows towards the managed entities. Optionally, it also provides
information about historical and/or more recent actions that have been executed.
As described in clause 7.3 of ETSI GS ZSM 009-1 [i.3], the execution stage is realized, fully or in part, by the domain
orchestration and control management services, when the CL is deployed within a management domain. Domain
orchestration management services include domain orchestration service, feasibility check service, Managed services
catalogue management service, testing service, domain inventory information service, domain inventory management
service and domain topology information service (refer to clause 6.5.5 of ETSI GS ZSM 002 [i.2]). Domain control
management services include resource configuration management service, resource lifecycle management services and
configuration data generation service (refer to clause 6.5.6 of ETSI GS ZSM 002 [i.2]).
As described in clause 7.3 of ETSI GS ZSM 009-1 [i.3], since the E2E management domain does not interact directly
with managed resources and thus does not specify Control management services, when the Closed Loop is deployed
within the E2E service management domain, the execution stage is realized, fully or in part, by the E2E orchestration
management services only. E2E orchestration management services include E2E service orchestration service,
feasibility check service, managed services catalogue management service, E2E testing service, E2E services inventory
information service, E2E services inventory management service and E2E services topology information service (refer
to clause 6.6.5 of ETSI GS ZSM 002 [i.2]).
NOTE 1: The execution stage is realized by one or more management services of (E2E) orchestration management
services, which is depending on the preferences and implementation of the ZSM framework owner.
In the execution stage, resource security control becomes a key consideration because the managed resources are used
to achieve the goal of Closed Loop in the orchestration and control management services. Some key resource
information that involves the entire network (e.g. domain inventory, service models, network topology) in the
Closed Loop should be protected.
ETSI
14 ETSI GR ZSM 017 V1.1.1 (2026-01)
The security risks and threats of implementation of Closed Loop and Closed-Loop Automation using domain
orchestration and control management services above during execution stage are analysed as followed:
• Resource leak exposure: Domain orchestration services consume control services to configure and modify
infrastructure resources or consumed services. If resource leak is exposed then it may be exploited by
adversary in the execution stage of Closed Loop, it leads to the malicious execution or depletion of
infrastructure resources.
• Tamper inventory: The domain inventory includes available infrastructure resources as well as available
(instantiated and active) managed services managed by the management domain. Each change to the inventory
is triggered as a side effect of a control or orchestration service invocation on the managed entities of the
domain. The domain inventory is maliciously tampered with, causing incapability/wrong-capability of the
associated resources used in the Closed-Loop Automation.
NOTE 2: As described in clause 6.5.5.2.5 of ETSI GS ZSM 002 [i.2], the information of domain inventory can be
provided at different abstraction levels to support different use cases: Information of domain inventory
used for end-to-end management is abstract while information used for the domain specific management
is more detailed.
• Tamper catalogue: Service models are contained in the catalogue, including sensitive information (e.g.
supported coverage areas, supported Service Level Specification (SLS) levels, service templates). Some
information of the service models is tampered with or malicious information is inserted into the catalogue,
resulting in incorrect data or services used during the Closed Loop execution stage and affecting the inability
to achieve the goals of the Closed-Loop Automation.
NOTE 3: As described in clause 6.5.5.2.1 of ETSI GS ZSM 002 [i.2], the domain service model is maintained in
the managed services catalogue of the domain. An explicit domain service model may provide a complete
description of all necessary infrastructure resources and consumed services, their topology, their
configuration, their policies and their location in the network, etc.
• Domain topology information theft and utilization: Domain orchestration services utilize topology information
(e.g. resources, resources utilization level, services, physical/virtualized nodes, physical and/or virtual
links/network connections) to maintain the network services and virtualized resources managed by the
management domain. In a Closed Loop, relevant configuration operations can be updated and performed in the
execution stage in a timely manner based on topology information. The topology information is stolen and
exploited by an adversary, leading to incorrect resource configuration or execution of incorrect operations
managed by the Closed Loop. Further, it brings interruption and unavailability of associated services in the
domain.
4.2.5 Composition of Closed Loops
As described in ETSI GS ZSM 009-1 [i.3], CL stage is the logical role to be played while the CL component is the
entity identified to play the particular role(s). As described in clause 7.4 of ETSI GS ZSM 009-1 [i.3], two different
types of Closed Loops including Made-to-Order Closed Loops (M2O-CL) and Ready-Made Closed Loops (RM-CL) are
supported in the ZSM framework. The main differences from these two types of Closed Loops are composition of
capabilities. M2O-CLs are assembled
...