incident management procedures for key network and information systems. TM02 Ensuring and evaluating the implementation of security measures in existing 5G standards Ensure that MNOs and their suppliers implement the existing security measures in the relevant 5G technology standards (e.g. 3GPP)and use it as a minimum security baseline for MNOs, so as to ensure that also the optional parts of these standards, relevant for security, are adequately implemented R1 R2 R3 R6 R7 R9  Relevant authorities  Operators  Suppliers SA03, SA04, SA05, SA10 b) Network security – 5G specific measures TM03 TM04 Ensuring strict access controls Increasing the security of virtualised network functions Ensure that MNOs implement adequate, flexible and verifiable technical measures to ensure that: - Strict network access controls are applied; - The principle of least privilege is applied, ensuring that various rights in the network (e.g. access rights between network functions, network administrators’ rights, virtualization configuration) are minimized; - The segregation of duties principle is applied; - Procedures are in place to ensure that these rules are in effect all the time and evolve with the network. In setting the access control policies, particular care should be taken to ensure that remote access by third parties, especially suppliers considered to be high risk, is minimized and/or avoided whenever possible. When remote access is necessary, for example to address service outages, the MNO should apply appropriate authentication 37, authorization, logging and auditing so as to have a clear visibility on access to data and configuration changes or network alterations. Ensure that MNOs follow security best practices for network function virtualisation. Note that there may be settings, for example when a network function is highly critical or when it is handling highly sensitive information, where virtualization is not appropriate and in such settings physical separation may be necessary. R1 R2 R3 R5 R6 R7 R1 R3 R6 R7  Relevant authorities  Operators  Relevant authorities  Operators SA05, SA10 SA01, SA05, SA10 37 In terms of authentication general good practices apply and appropriate mechanisms should be used, for example for temporary access by third parties and/or remote access (e.g. no permanent credentials, temporary (one-time) passwords, usable only for designated tasks should be used). These measures could, for example, be enforced by using appropriate Privileged Access Management (PAM) platforms. 24