Third party suppliers: SM03: Assessing the risk profile of suppliers and for suppliers considered to be high risk, applying restrictions, including necessary exclusions, for key assets SM04: Controlling the use of Managed Service Providers (MSPs) and vendor third line support Depends on scope of measures and exposure to high risk suppliers but can be VERY HIGH Network security – 5G specific measures TM03: Ensuring strict access controls TM05: Ensuring secure 5G network management, operation and monitoring TM07: Reinforcing software integrity, update and patch management If taken as standalone measure can be MEDIUM  (potentially) Broader economic and/or societal impacts  Resource costs  Sector-specific economic impacts (operators and suppliers)  (potentially) Broader economic and/or political impacts SHORT term. Depends on 5G deployment calendar  Resource costs  Sector-specific economic impacts SHORT term. Depends on 5G deployment calendar. Potential implementation factors Indicative timeframe Risk 6: Exploitation of 5G networks by organised crime Risk mitigation plan: Increase network security and raise quality of supplier’s processes and equipment Most relevant/high-impact measures Regulatory powers SM01: Strengthening the role of national authorities SM02: Performing audits on operators and requiring information Network security – baseline measures TM01: Ensuring the application of baseline security requirements (secure network design and architecture) TM02: Ensuring and evaluating the implementation of security measures in existing 5G standards Network security – 5G specific measures TM03: Ensuring strict access controls TM04: Increasing the security of virtualised network functions TM05: Ensuring secure 5G network management, operation and monitoring TM06: Reinforcing physical security TM07: Reinforcing software integrity, update and patch management Expected effectiveness Depends on scope of measures, but can be High or VERY HIGH  Resource costs  Sector-specific economic impacts (operators)  (potentially) Broader economic and/or societal impacts Depends on scope of measures, but can be MEDIUM TO HIGH  Resource costs  Sector-specific economic impacts SHORT term Depends on scope of measures, but can be HIGH.  Resource costs  Sector-specific economic impacts SHORT term. Depends on 5G deployment calendar. SHORT term 35