3.3. Standardisation (baseline work in 3GPP) 5G security issues are increasingly being addressed in the work undertaken by standards bodies, notably within the workgroup on Service and System Aspects 3 (SA3) 24 of the 3rd Generation Partnership Project (3GPP) 25. Apart from standards, it may also be useful to take into account the security architecture defined by 5G-PPP (based on the deliverables by 5G-Ensure) that, stresses the importance of management domains. 5G technologies and standards could improve security compared to previous generations of mobile networks due to the introduction of several new security-related features, such as stricter authentication processes in the radio interface. These new security features will however not all be activated by default in the network equipment, since some of them are optional for implementation for suppliers or for use by operators. Therefore, the overall effectiveness of these security features will greatly depend upon how the operators deploy and manage their networks. As indicated in the EU coordinated risk assessment report the SA3 Working Group is also addressing the lawful interception requirements in 5G systems and intends to produce all specifications needed to meet those requirements 26. 4. Measures and mitigation plans The measures presented in this toolbox are addressed to and for implementation by national and EU responsible authorities and agencies, each with their respective capacities and competences which can range from regulatory oversight to their national security role. In line with the EU coordinated risk assessment report, the measures concern the relevant security stakeholders in the 5G ecosystem 27, these being primarily mobile network operators (MNOs) 28 and their suppliers, in particular telecom equipment manufacturers. On the one hand, mobile network operators have a central, decision-making role, giving them leverage on the overall secure operation of their networks. On the other hand, telecom equipment manufacturers are responsible for the provision of software and hardware required to operate the networks. The measures presented below and their description build on the relevant findings of the EU coordinated risk assessment report. In particular: 24 The Service and System Aspects 3 (SA3) Working Group is responsible for security and privacy in 5G standards. The 3GPP is the main global body for developing standards for mobile communications, a collaboration between seven Organisational Partners, from Europe (ETSI), USA (ATIS), China (CCSA), Japan (ARIB, TTC), Korea (TTA) and India (TSDSI). 3GPP technical specification groups have standardised industry security features in 3G, 4G and now 5G standards. 26 In its conclusions of 3 December 2019 (14517/19), the Council ‘stresses the need to address and mitigate potential challenges arising from the deployment of 5G networks and services to law enforcement including e.g. lawful interception.’ 27 Those stakeholders have been identified in the EU coordinated risk assessment and comprise: Mobile network operators; Suppliers of mobile network operators (including telecom equipment manufacturers and other third-party suppliers, such as cloud infrastructure providers, systems integrators, security and maintenance contractors, transmission equipment manufacturers); Manufacturers of connected devices and related service providers; and Other stakeholders (including service and content providers and end-users of 5G mobile networks). 28 Mobile virtual network operators (MVNOs) and critical infrastructure operators from another sector than telecommunications, which could operate 5G networks for their own activities or on behalf of third parties, would fall under a similar category of stakeholders. 25 10