b) Standardisation SA03 Supporting and shaping 5G standardisation SA04 Developing guidance on implementation of security measures in existing 5G standards Ensuring the application of standard technical and organisational security SA05 measures through specific EU-wide certification scheme c) Third party suppliers Exchange of best practices on the implementation of SA06 strategic measures, in particular national Increase engagement in relevant standardisation bodies, in particular through reinforced coordination at EU level in order to increase ability to shape standardisation according to identified needs, by setting up a forum or group of national regulatory authorities and other relevant competent authorities of Member states, reporting to the NIS Cooperation Group and the EECG 41, in particular tasked to: - Contribute to achieving an appropriate level of convergence as regards technical measures relying on standardisation and certification, in line with existing legislation, such as but not limited to the Cybersecurity Act; - Promote standardisation of interfaces to facilitate diversity of suppliers; - ensure liaison between the NIS Cooperation Group and relevant European and/or international standardisation bodies; - Ensure full participation by EU industry and improve the dialogue between the industry and the MS. Develop specific EU guidance on the implementation of security measures under the existing 5G standards (e.g. 3GPP), and in particular: - Provide recommendations on the optional elements of standardisation and on aspects that are not covered by a specific standard; 42 Identify existing gaps in telecommunications standardisation of architectures/functionalities for mitigating identified risks. Consider developing an EU-wide certification scheme under the EU certification framework for information security management systems (ISMS) for telecommunication providers. To facilitate a coordinated approach, exchange good practices on the implementation of strategic measures, in particular on the risk factors to be taken into account (see paragraph 2.37 of the EU coordinated risk assessment report) when assessing the risk profile of suppliers/vendors. In addition to the factors listed in the EU coordinated risk  Relevant authorities  EC  Operators  Suppliers  ENISA  Relevant authorities  ENISA  Relevant authorities  ENISA  Stakeholde rs  Relevant authorities SM05, SM06, TM02, TM09, TM10 SM01, TM02 TM01 to 06 SM01, SM03, SM04 41 The European Cybersecurity Certification Group (EECG) set up under the Cybersecurity Act is composed representatives of national cybersecurity certification authorities or representatives of other relevant national authorities. 42 This may include, for example, aspects such as deployment/hosting options, recommended commercial off-the-shelf (COTS) software and hardware architectures and configurations, monitoring procedures or any other aspects. 28