- Require operators to document and maintain a description on how the baseline technical network security measures are implemented 33. b) Third party suppliers SM03 Assessing the risk profile of suppliers and applying restrictions for suppliers considered to be high risks-including necessary exclusions to effectively mitigate risksfor key assets SM04 Controlling the use of Managed Service Providers (MSPs) and equipment suppliers’ third line support - Establish a framework with clear criteria, taking into account the risk factors identified in paragraph 2.37 of the EU coordinated risk assessment 34 and adding country-specific information (e.g. threat assessment from national security services, etc.), for national competent authorities and MNOs to: - Perform rigorous assessments of the risk profile of all relevant suppliers at national level and/or EU level (for example jointly with other MS or other MNOs); -Based on the risk profile assessment, apply restrictions- including necessary exclusions to effectively mitigate risks- for key assets defined as critical or sensitive in the EU coordinated risk assessment report (e.g. core network functions, network management and orchestration functions, and access network functions);. - Take steps to ensure that MNOs have adequate controls and processes in place to manage potential residual risks, such as regular supply chain audits and risk assessments, robust risk management, and/or specific requirements for suppliers based on their risk profile. Establish a legal/regulatory framework which places limit on the types of activity and conditions under which MNOs are able to outsource particular functions to Managed Service Providers (MSPs), for both physical and virtual infrastructure, including: - Applying restrictions in particular in sensitive parts of the 5G networks, such as the security and network operations functions and where MSPs are considered to be high risk suppliers within the meaning of SM03; - For functions outsourced to MSPs, impose enhanced security provisions around the access that MSPs are given to perform those functions. R2 R5  Relevant authorities  Operators SA06, SA10 R2 R5  Relevant authorities  Operators SA06, SA10 33 This may include security domains such as, for example, administrative information security, personnel security, security of hardware, software and telecommunications, security of information material and usage, physical security and other. 34 The EU coordinated risk assessment report identifies several risk factors for the assessment of a supplier’s risk profile, notably: the likelihood of the supplier being subject to interference from a non-EU country (this may be facilitated by, but not limited to, the presence of certain factors, which are also listed in the EU coordinated risk assessment report); the supplier’s ability to assure supply; and the overall quality of products and cybersecurity practices of the supplier, including the degree of control over its own supply chain and whether adequate prioritisation is given to security practices. 21