diff --git a/include/lib/extensions/trbe.h b/include/lib/extensions/trbe.h
index 5db331672..2c488e097 100644
--- a/include/lib/extensions/trbe.h
+++ b/include/lib/extensions/trbe.h
@@ -10,9 +10,13 @@
 #include <context.h>
 
 #if ENABLE_TRBE_FOR_NS
+void trbe_disable(cpu_context_t *ctx);
 void trbe_enable(cpu_context_t *ctx);
 void trbe_init_el2_unused(void);
 #else
+static inline void trbe_disable(cpu_context_t *ctx)
+{
+}
 static inline void trbe_enable(cpu_context_t *ctx)
 {
 }
diff --git a/lib/extensions/trbe/trbe.c b/lib/extensions/trbe/trbe.c
index 915773420..8c1c42180 100644
--- a/lib/extensions/trbe/trbe.c
+++ b/lib/extensions/trbe/trbe.c
@@ -39,6 +39,25 @@ void trbe_enable(cpu_context_t *ctx)
 	write_ctx_reg(state, CTX_MDCR_EL3, mdcr_el3_val);
 }
 
+void trbe_disable(cpu_context_t *ctx)
+{
+	el3_state_t *state = get_el3state_ctx(ctx);
+	u_register_t mdcr_el3_val = read_ctx_reg(state, CTX_MDCR_EL3);
+
+	/*
+	 * MDCR_EL3.NSTBE = 0b0
+	 *  Trace Buffer owning Security state is secure state. If FEAT_RME
+	 *  is not implemented, this field is RES0.
+	 *
+	 * MDCR_EL3.NSTB = 0b00
+	 *  Clear these bits to disable access of trace buffer control registers
+	 *  from lower ELs in any security state.
+	 */
+	mdcr_el3_val &= ~(MDCR_NSTB(MDCR_NSTB_EL1));
+	mdcr_el3_val &= ~(MDCR_NSTBE_BIT);
+	write_ctx_reg(state, CTX_MDCR_EL3, mdcr_el3_val);
+}
+
 void trbe_init_el2_unused(void)
 {
 	/*