# GSMA FS.07 and FS.11 — the SS7 signalling firewall standards

> GSMA FS.07 ("SS7 and Sigtran Network Security") and FS.11 ("SS7 Interconnect Security Monitoring Guidelines") are the two GSMA Permanent Reference Documents that define what a modern SS7 signalling firewall must do. Every operator that wants to be considered for a roaming or A2P agreement with a tier-1 partner must demonstrate FS.07/FS.11 compliance.

- Canonical URL: https://www.broadnet.me/answers/gsma-fs07-fs11-signaling-firewall
- Language: en
- Last reviewed: 2026-05-27
- Publisher: BroadNet (https://www.broadnet.me)

## What FS.07 covers

FS.07 classifies SS7 MAP and CAP messages into three categories. Category 1: messages that should never come from outside the operator's network (e.g. Update-Location from a foreign address claiming to serve the operator's own IMSI range). Category 2: messages that should only come from confirmed roaming partners (e.g. Provide-Subscriber-Info). Category 3: messages that are legitimate from any peer but must be rate-limited and reputation-scored. The firewall enforces drop, rate-limit, or pass per category per peer.

## What FS.11 covers

FS.11 is the monitoring and incident-response companion. It defines what events the firewall must log (every drop with full PDU), what aggregate metrics the SOC must track (per-peer Cat-1/2/3 ratios, anomaly baselines), and what to do when a known-bad pattern is detected (page the SOC, snapshot the PDU stream, notify GSMA T-FCS). FS.11 also defines the cross-operator information-sharing format for fraud intelligence.

## Why the two are paired

FS.07 without FS.11 is a firewall with no audit trail — useless in a regulator's eyes. FS.11 without FS.07 is a SOC with no enforcement. Operators that pass GSMA partner audits implement both, and a tier-1 operator like Etisalat or STC will not sign a new IR.21 roaming agreement until the partner attests to FS.07/FS.11 compliance.

## How BroadNet implements it

BroadNet's signalling firewall ships with the FS.07 category table preloaded and editable per peer. The same engine writes FS.11-compatible event logs to a tamper-evident store (SHA-256 chained, exportable to GSMA T-FCS quarterly report format). We have deployed it across 60+ operators in MENA, Africa, and Asia.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [SS7 MAP — what it is and why messaging still depends on it](https://www.broadnet.me/answers/ss7-map-explained)
- [Diameter S6a — the 4G equivalent of MAP](https://www.broadnet.me/answers/diameter-s6a-explained)
- [What is an SMS firewall?](https://www.broadnet.me/answers/what-is-sms-firewall)
- [SS7 Firewall](https://www.broadnet.me/operators/ss7-firewall)