For mobile network operators:      Poor network design and architecture; Poor physical security for network and IT infrastructure; Poor policies for local and remote access to network components; Lack of or insufficient security requirements in the procurement process; and Poor change management process. 2. Supplier-specific vulnerabilities The increased role of software and services provided by third party suppliers in 5G networks leads to a greater exposure to a number of vulnerabilities that may derive from the risk profile of individual suppliers. The risk profiles of individual suppliers can be assessed on the basis of several factors, notably:  The likelihood of the supplier being subject to interference from a non-EU country. This is one of the key aspects in the assessment of non-technical vulnerabilities related to 5G networks 47. Such interference may be facilitated by, but not limited to, the presence of the following factors: o o o o A strong link between the supplier and a government of a given third country; The third country’s legislation, especially where there are no legislative or democratic checks and balances in place, or in the absence of security or data protection agreements between the EU and the given third country 48; The characteristics of the supplier’s corporate ownership; and The ability for the third country to exercise any form of pressure, including in relation to the place of manufacturing of the equipment.  The supplier’s ability to assure supply.  The overall quality of products and cybersecurity practices of the supplier, including the degree of control over its own supply chain and whether adequate prioritisation is given to security practices. The assessment of a supplier’s risk profile may also take into account notices issued by EU authorities and/or Member States national authorities. 3. Vulnerabilities stemming from dependency to individual suppliers Within individual networks, a large degree of reliance on a single supplier (monoculture) creates a dependency on specific solutions and makes it more difficult to procure solutions from other suppliers, especially where solutions are not fully interoperable. As a result, EU-based operators who become overly dependent on a single equipment supplier are exposed to a number of risks caused by that supplier coming under sustained 47 While a threat actor’s direct access to or influence on the telecom supply chain may significantly facilitate its exploitation for malicious actions and make the impact of such actions significantly more severe, it should also be noted that actors with a high level of intent and capabilities, such as State actor, would seek to exploit vulnerabilities at any stage of the product lifecycle provided by any supplier. 48 In this context, several Member States attribute a higher risk profile to suppliers that are under the jurisdiction of third countries conducting an offensive cyber policy. 42