Annex 1 to the 5G EU toolbox of risk mitigating measures • Table 1: Strategic, technical measures & supporting actions STRATEGIC MEASURES a) Regulatory powers Id Measure SM01 Strengthening the role of national authorities SM02 Performing audits on operators and requiring information 31 Description This should include regulatory powers for national authorities, to be able to: - impose strengthened obligations on operators, for example concerning the security of the signalling/management plane; - use ex-ante powers to restrict, prohibit and/or impose specific requirements or conditions, following a risk-based approach, for the supply, deployment and operation of the 5G network equipment, taking into account among other things:  Security of critical and sensitive parts of 5G networks;  Security of the equipment itself or the environment (deployment, interconnections, etc.);  Risk of interference by a third country in the 5G supply chain;  Risk of major dependency on a single supplier by individual MNOs or nationally  Risks for national security. In exercising their powers under Article 41(2) of the EECC 32, competent authorities should: Audit, or require audits, of MNOs, if needed at an in-depth technical level, for example of critical components and/or sensitive parts of the 5G networks; Require operators to provide detailed and up-to-date information about their plans for the sourcing of 5G equipment and for the involvement of third party suppliers; Related risks Relevant actors 31 R1 R2 R3 R4 R5 R6 R7  Relevant authorities  Operators R1 R2 R3 R4 R5 R6 R7  Relevant authorities  Operators Supporting actions SA01 SA04 SA06 SA02 This column aims at identifying the main owners of the measures, i.e. actors responsible for developing, enforcing and/or implementing a measure. 32 For specific new use cases in 5G (e.g. small closed 5G network serving critical functions such as, for example, a harbour or a hospital network) it is recommended to evaluate whether regulatory powers apply to these new type of MNOs and if not, to assess the need to regulate them. 20