c) Requirements related to suppliers’ processes and equipment Raising the security standards in suppliers’ processes through robust procurement conditions Ensure that MNOs demand specific security standards from equipment suppliers in the procurement process (e.g. on specific security improvements and demonstrating quality levels, security maintenance of the equipment throughout its lifetime and built-in of security in the product' development processes). TM09 Using EU certification for 5G network components, customer equipment and/or suppliers’ processes The Commission should consider including into the Union Rolling Work Programme 39 relevant EU-wide scheme(s) for critical network components used in the 5G networks and/or for 5G customer equipment (for example, for eSIMs and related cryptographic material) under the EU certification framework. It should also be examined at a later stage whether the certification or supplier’s process could also be added to the Union Rolling Work Programme. TM10 Using EU certification for other non 5G-specific ICT products and services (connected devices, cloud services) TM08 The Commission should consider including into the Union Rolling Work Programme EU-wide schemes under the EU certification framework for non-5G specific ICT products and services, such as for: - The security of cloud services and related technologies, which are an important part of 5G deployment 40; - The security of connected (end-user) devices, including IoT. R3 R6 R7  Relevant authorities  Operators  Suppliers R3 R6 R7  Relevant authorities  EC  ENISA  Stakeholders R9  Relevant authorities  EC  ENISA  Stakeholders SA02, SA10 SA02, SA03 , SA09, SA10 SA02, SA03, SA09, SA10 39 Under the EU cybersecurity certification framework, the Commission should publish the Union Rolling Work Programme for the development for the EU-wide certification schemes by July 2020. 40 In accordance with Article 48(2) of the Cybersecurity Act, on 21 November 2019 the European Commission requested ENISA to prepare a candidate European cybersecurity certification scheme for cloud services. 26