The present document specifies the security architecture@ procedures and information flows needed to protect the mission critical push to talk (MCPTT) service. The architecture includes mechanisms for authentication@ protection of MCPTT signalling and protection of MCPTT media. Security for both MCPTT group calls and MCPTT private calls operating in on-network and off-network modes of operation is specified. The functional architecture for MCPTT is defined in 3GPP TS 23.179 [2]@ the corresponding service requirements are defined in 3GPP TS 22.179 [3]. The MCPTT service can be used for public safety applications and also for general commercial applications e.g. utility companies and railways. As the security model is based on the public safety environment@ some security features may not be applicable to MCPTT for commercial purposes.