-Other assets When considering key assets, a number of entities and categories of users can be considered as requiring particular attention, namely:      Operators of essential services under NIS Directive and critical infrastructure operators; Government entities, law enforcement, Public Protection and Disaster Relief (PPDR), military; Key sectors/entities not covered by cybersecurity regulations; Strategic private companies; and Areas or entities for which there is no back-up solution in place in case of 5G network failure. In addition, a number of Member States have identified geographic areas that are particularly sensitive, based on an analysis of the demographic, economic, societal and national security factors. Indeed, certain areas could suffer greater disruption due to the concentrations of economic and societal reliance on network and information systems (e.g. as in the case of smart cities) or because sensitive entities or categories of users are located in them. -Vulnerabilities The report assessed three main types of vulnerabilities: 1. Vulnerabilities related to hardware, software, processes and policies As any digital infrastructure, 5G networks can be associated with a range of generic technical vulnerabilities, which may affect software, hardware or arise from potential deficiencies in the security processes of any of the various stakeholders 46. Furthermore, in the early stage of deployment, vulnerabilities in the existing 3G and 4G infrastructure shall also be duly considered. While many of these vulnerabilities are not specific to 5G networks, their number and significance is likely to increase with 5G, due to the increased level of complexity of the technology and of the future greater reliance of economies and societies on this infrastructure. When it comes to process or configuration-related vulnerabilities are considered to be of special significance in the future 5G environment: For all stakeholders, in particular mobile network operators and their suppliers:     Lack of specialised and trained personnel to secure, monitor and maintain 5G networks; Lack of adequate internal security controls, monitoring practices, security management systems and insufficiencies in risk management practices; Lack or inadequate security or operational maintenance procedures, such as software update/patch management; and Lack of compliance with 3GPP standards or incorrect implementation of standards. 46 Reviews of the practices of one of the major network equipment suppliers as regards 4G equipment and services have been for instance carried out by the UK Huawei Cybersecurity Evaluation Centre (HSCEC). 41