Risk 1: Misconfiguration of Networks Risk mitigation plan: Increase network security and resilience Most relevant/high-impact measures Regulatory powers: SM01: Strengthening the role of national authorities SM02: Performing audits on operators and requiring information Network security – baseline measures TM01: Ensuring the application of baseline security requirements (secure network design and architecture) TM02: Ensuring and evaluating the implementation of security measures in existing 5G standards Network security – 5G specific measures TM03: Ensuring strict access controls TM04: Increasing the security of virtualised network functions TM05: Ensuring secure 5G network management, operation and monitoring TM07: Reinforcing software integrity, update and patch management Expected effectiveness Potential implementation factors Indicative timeframe Depends on implementation of measures, but can be VERY HIGH.  Resource costs  Sector-specific economic impacts (operators and suppliers)  (potentially) Broader economic and/or societal impacts Depends on scope of measures, but can be MEDIUM to HIGH.  Resource costs  Sector-specific economic impacts SHORT term Depends on scope of measures, but can be HIGH.  Resource costs  Sector-specific economic impacts SHORT term. Depends on 5G deployment calendar. SHORT term Risk 2: Lack of Access Controls Risk mitigation plan: Increase network security, in particular strengthen rules on access to network by suppliers and on use of Managed Service Providers and third line support Expected Potential Indicative Most relevant/high-impact measures effectiveness implementation factors timeframe Regulatory powers: SM01: Strengthening the role of national authorities SM02: Performing audits on operators and requiring information Depends on implementation of measures, but can be VERY HIGH. Third party suppliers: SM03: Assessing the risk profile of suppliers and for suppliers considered to be high risk, applying restrictions, including necessary exclusions, for key assets Depends on scope of measures, but can be HIGH.  Resource costs  Sector-specific economic impacts (operators)  (potentially) Broader economic and/or societal impacts  Resource costs  Sector-specific economic impacts (operators and suppliers) SHORT term SHORT term. Depends on 5G deployment calendar. 32