- The rule requires operators, suppliers and corporate users to analyse and manage the risks of 5G networks.
- The government may declare high-risk suppliers and set minimum periods for replacing their equipment.
- Non-compliance can lead to penalties, with the General Telecommunications Act regime as the reference.
The BOE of Wednesday 30 March 2022 published Royal Decree-Law 7/2022 of 29 March, on requirements to guarantee the security of fifth-generation electronic communications networks and services. It takes effect on 31 March, although several of its obligations, including the risk management duties of operators and suppliers, will apply from 30 April.
The rule is aimed at 5G network operators, their suppliers and corporate users who hold rights over the radio spectrum for private networks or self-provision. It was among the initiatives in the 2022 Annual Regulatory Plan and now arrives through the urgent route of a decree-law, amid growing European concern over the security of critical infrastructure. This makes cybersecurity and the supply chain a matter for management and not only for technical departments.
Obligations by type of player
Operators must carry out a risk analysis of their networks, with a detailed study of critical elements, including core functions and control and management systems, and repeat it every two years. They must also guarantee network integrity, use certified products, undergo a security audit at their own cost and control their supply chain.
Suppliers must provide their own analysis when requested, and those classified as high or medium risk must submit it within six months and every two years. They must also apply security-by-design standards, strengthen patch management and certify their products. Corporate users will also provide their analysis when the authority asks, and public administrations may not use high- or medium-risk equipment.
High-risk suppliers
The Council of Ministers may classify a supplier as high risk, following a report from the National Security Council and after a hearing of 15 working days. The assessment will take into account technical guarantees and exposure to external interference, such as links to foreign governments. The period for replacing their equipment will be set by the decision and cannot be shorter than one year.
Holders of critical elements must have at least two different suppliers that do not belong to the same corporate group, must not use high-risk equipment in those elements and must locate them in national territory. The transitional provision allows five years for the core and control systems and two years for the access network in sensitive locations. Suppliers that serve only private networks are regarded as medium risk.
What to review
Companies that operate or plan to deploy a private 5G network, for example in ports, factories or logistics centres, should check with their supplier what risk analysis it can provide and what certifications it holds. Operators and holders of critical elements must prepare their supplier diversification strategy, which they will have to submit within six months.
The penalty regime distinguishes between minor, serious and very serious infringements; failure by holders of critical elements to diversify and not to use high-risk equipment is classified as very serious. Once the government approves the National 5G Security Scheme, due within six months, criteria and deadlines will be specified. Your adviser can help you interpret how it affects you. Although many of these obligations fall on large operators, their effects will reach suppliers, integrators and industrial customers that depend on them.
The security of 5G networks becomes a legal obligation with deadlines, and not merely a technical recommendation.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
