or crisis, in particular the Blueprint for a coordinated response to large-scale cybersecurity incidents and crisis and the Cyber Diplomacy toolbox 21. 3.2. National implementation of EU telecoms rules Under the current EU telecom rules 22, EU Member States supervise a set of security requirements for telecom providers. As described under 3.1.1 above, Article 13a requires Member States to ensure that: • • • Telecom providers assess risks and take appropriate security measures; Telecom providers take resilience measures to mitigate disruptions of their networks and/or services; and Telecom providers notify significant incidents to the relevant national authorities. Most national laws transposing the current EU legal framework were adopted around 2011. In terms of supervision method and obligations, Member States have followed diverse approaches. For instance, where binding rules apply to mobile network operators, they may cover different types of technical and organisational measures. In Member States where security measures are further clarified in more technical and practical detail (often via secondary legislation), they often refer to the security measures of the Article 13a security framework 23. At this stage, with very few exceptions, national measures in this area do not explicitly provide for advanced security requirements specifically relating to the roll-out of 5G networks. Similarly, they do not explicitly provide for ex-ante regulatory powers or obligations related to security in the context of procurement and deployment by operators of network equipment, nor do they include provisions aimed at promoting security and resilience through an appropriate degree of supplier diversity or at addressing risks and vulnerabilities related to the risk profile of individual suppliers. 21 Framework for a Joint EU Diplomatic response to malicious cyber activities (Council Conclusions 20 November, 2017, 9916/17) and Commission Recommendation (Blueprint) on a coordinated response to large-scale cybersecurity incidents & crisis (EU 2017/1584). A Work Stream within the NIS Cooperation Group has undertaken the task of implementing the operational layer provided for by the Blueprint. 22 Directive 2002/21/EC as last amended by Directive 2009/140/EC on a common regulatory framework for electronic communications networks and services 25.11.2009, and Directive 2018/1972 of 11 December, 2018 establishing the European Electronic Communications Code. 23 Technical guidance on the security measures in Article 13a (https://resilience.enisa.europa.eu/article-13/guideline-for-minimumsecurity-measures) is a detailed security framework developed jointly by Member States experts to promote a common approach to supervision and/or good practices for the sector security supervision across the EU. The framework covers a wide range of security measures, at a high level and applies to different types of telecom providers. 9