text: July 2021

text: July 2021

text: Directive (EU) 2018/1972

text: of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code, OJ L 321, 17.12.2018, p. 36. 2 Directive

text: of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services, OJ L 108, 24.4.2002, p. 33.

text: Commission Recommendation (EU) 2019/534 of 26 March 2019

text: – Cybersecurity of 5G networks, OJ L 88, 29.3.2019, p. 42. 4 Cybersecurity of 5G networks EU Toolbox of risk mitigating measures, available at https://digitalstrategy.ec.europa.eu/en/library/cybersecurity-5g-networks-eu-toolbox-risk-mitigating-measures. 5

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, OJ L 194, 19.7.2016, p. 1. 6 Proposal for a directive of the European Parliament and of the Council of 16 December 2020 on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: , COM(2020) 823 final, 16.12.2020.

text: July 2021

text: See also Section 6 of this report for full details of the conclusions and recommendations.

text: July 2021

text: European Commission, ‘New EU cybersecurity strategy and new rules to make physical and digital critical entities more resilient’, press release, 16 December 2020 (https://ec.europa.eu/commission/presscorner/detail/en/IP_20_2391). 9 Proposal for a directive of the European Parliament and of the Council of 16 December 2020 on the resilience of critical entities, COM(2020) 829 final, 16.12.2020.

text: July 2021

text: July 2021

text: July 2021

text: Ahmet Yesilyurt Federal Network Agency (Bundesnetzagentur), Germany; co-chair of the European Competent Authorities for Secure Electronic Communications (ECASEC) Expert Group (formerly

text: Article 13

text: a Expert Group)

text: Antoine Berthier National Agency for the Security of Information Systems (Agence nationale de la sécurité des systèmes d’information (ANSSI)), France

text: Costas Efthymiou Digital Security Authority (Αρχή Ψηφιακής Ασφάλειας), Cyprus

text: Davide Nardacci Ministry of Economic Development, Directorate-General for Communications Technologies and Information Security – Higher Institute

text: Alessandro Paci

text: of Communications and Information Technologies (Ministero dello Sviluppo Economico, Direzione generale per le tecnologie delle comunicazioni e la sicurezza informatica – Istituto superiore delle comunicazioni e delle tecnologie dell'informazione (DGTCSI-ISCTI)), Italy

text: Costin Masiliev National Authority for Administration and Regulation in Communications (Autoritatea Națională pentru Administrare și Reglementare în

text: Előd Hainal-Filla

text: Comunicații (ANCOM)), Romania

text: George Drivas National Cyber Security Authority, Hellenic Ministry of Digital Governance N. Chouliaras (Εθνική Αρχή Κυβερνοασφάλειας, Υπουργείο Ψηφιακής Διακυβέρνησης) Sotiris Vasilos Greece

text: Heidi Kivekas Finnish Transport and Communications Agency (Traficom – Liikenne- ja Tatu Giordani viestintävirasto)

text: July 2021

text: Ilmar Toom State Information System Board (Riigi Infosüsteemi Amet (RIA)), Estonia

text: Jens Marschall Deutsche Telekom, Germany

text: Iain Boyd Richmond Rainer Koch

text: Joseph Stephens National Cyber Security Centre (NCSC), Department of the Environment, Climate and Communications, Ireland

text: Lukas Pimper National Cyber and Information Security Agency (Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB)), Czechia

text: Manuel Barros National Communications Authority (Autoridade Nacional de Comunicações (ANACOM)), Portugal

text: Per Ekare Swedish Post and Telecom Authority (Post- och telestyrelsen (PTS))

text: Regis Rousselot Orange

text: Vincent Maurin Franck Laurent Francois Zamora Luisa Rossi

text: Remi Van de Calseijde Liberty Global

text: Martin Pickford Robert Kolthek

text: Rodrigo Pereira NOS, SGPS S.A., Portugal

text: Jorge Frazao Manuela Figueiredo

text: Stephen Hermanson Vodafone Group

text: Tamás Róka National Media and Communications Authority (Nemzeti Média- és Hírközlési Hatóság (NMHH)), Hungary

text: Thomas Due Centre for Cyber Security (Center for Cybersikkerhed (CFCS)), Denmark

text: Tim Masy Belgian Institute for Postal Services and Telecommunications (BIPT)

text: Warna Münzebrock Radiocommunications Agency Netherlands (Agentschap Telecom (AT)); chair of the ECASEC Expert Group (formerly

text: Article 13

text: a Expert Group)

text: July 2021

text: Collaboration between telecom providers and operators of essential

text: services (energy, finance, etc) is good. Collaboration between telecom providers is good. 18 52 4 2 24 Collaboration between telecom security authority and data protection

text: authorities is good. Collaboration between telecom security authority and NIS Directive

text: authority and/or national CSIRT is good. Collaboration between national telecom security authority and telecom

text: sector is good. Incident reporting has been useful in improving cybersecurity. 18 33 18 2 29

text: The right incidents are being reported to authorities. 13 56 9 2 20

text: Security measures taken in the telecom sector are appropriate. 18 64 9 2 7

text: There is a culture of risk management in the telecom sector. 36 48 7 2 7

text: The authority offers useful implementation guidelines. 7 58 20 4 11

text: The authority has sufficient resources. 4 42 33 4 17

text: The authority has sufficient cybersecurity expertise. 11 45 38 2 4

text: The authority has sufficient powers. 36 49 13 2

text: Strongly agree Agree Disagree Strongly disagree Don't know, no opinion%

text: July 2021

text: ‘Incidents’ were not defined in the Telecom Framework Directive, which may have contributed to the problem. The EECC introduces the definition of a ‘security incident’ in

text: Article 2(42)

text: : “security incident” means an event having an actual adverse effect on the security of electronic communications networks or services’.

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: The ENISA

text: Article 13

text: a expert group brings added value. 31 43 2 24 ENISA is effective in facilitating harmonization and collaboration across the

text: EU. ENISA guidelines on telecom security policy are useful (e.g.

text: Article 13

text: a

text: guidelines). ENISA is successful in supporting the implementation of telecom security

text: legislation across the EU. Across the EU collaboration between the telecom security authorities and the

text: authorities for the NIS Directive, the NIS Cooperation group is good. EU collaboration between telecom providers is good (EU ISACs, industry groups, e.g.) 2 51 9 2 36

text: EU telecom security legislation is consistent with the NIS Directive. 33 24 7 36

text: The national capabilities on telecom security are comparable across the EU. 2 11 49 16 22

text: Technically the telecom security requirements are similar across the EU. 4 33 40 7 16

text: Strongly agree Agree Disagree Strongly disagree Don't know, no opinion

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: July 2021

identifier: Assessment of EU Telecom Security Legislation

title: Assessment of EU Telecom Security Legislation

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: CONTACT

text: To contact the authors, please email resilience@enisa.europa.eu For media enquiries about this paper, please email press@enisa.europa.eu

text: AUTHORS

text: Marnix Dekker, Sławomir Bryska, ENISA

text: ACKNOWLEDGEMENTS

text: To complete this guideline, ENISA worked closely with a working group of experts from national authorities, the European Competent Authorities for Secure Electronic Communications (ECASEC) Expert Group (formerly known as the Article 13a Expert Group), as well as all other stakeholders mentioned in Section 2 of this report. We are grateful for their valuable input, comments and support in the process of developing this document.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to

text: Regulation (EU) No 2019/881

text: . ENISA may update this publication from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources, including external websites, referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity, 2021. Reproduction is authorised provided the source is acknowledged.

text: For any use or reproduction of photos or other material that is not under ENISA’s copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-505-0 doi:10.2824/30649 Catalogue number: TP-02-21-565-EN-N

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION

text: EXECUTIVE SUMMARY

text: European Union telecom security legislation has been changing over the last few years.

text:  At the end of 2020, Article 40 of the European Electronic Communications Code (EECC) replaced

text: Article 13

text: a of the Directive on the common regulatory framework for electronic communications networks and services (Telecom Framework Directive).

text:  With its Recommendation on Cybersecurity of 5G networks , in 2019, the European Commission commenced an EU-wide collaboration on cybersecurity of 5G networks. This culminated in the NIS Cooperation Group issuing the EU 5G Cybersecurity Risk Mitigation Toolbox in January 2020 (EU 5G Toolbox).

text:  The European Commission has been reviewing the Network and Information Systems Directive (NIS Directive) and, on 16 December 2020, made a proposal for its amendment (NIS2 proposal), which would bring EU telecom security rules under the NIS Directive.

text: In light of these policy changes, ENISA carried out an assessment of the implementation of EU telecom security policy, to inform policy makers in the Commission and in the Member States, as well as experts from the sector, about challenges, gaps and possible improvements. This paper contains the highlights of this assessment. We summarize our findings here and we refer the reader to the body of the paper for more details.

text: This assessment of the implementation of EU telecom security legislation focuses on:

text: 1. Implementation at national level, including the relevant national telecom security legislation, the powers and capabilities of the national authorities, and collaboration and information sharing at national level.

text: 2. Implementation at EU level, including the harmonisation across the EU, the collaboration between the different Member States, and ENISA’s role.

text: The assessment was carried out by interviewing and surveying a balanced group of experts from the public and private sectors, including the national authorities responsible for telecom security, the national authorities responsible for the NIS Directive, and experts from the EU telecom sector (see Figures ES1 and ES2).

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION Figure ES1: Participation in the online survey Figure ES2: Participation in the telephone interviews

text: We highlight the findings from the assessment :

text: 1. EU telecom security legislation has a positive impact. The security provisions in the EU regulatory framework have contributed to a high level of cybersecurity in the telecommunications sector.

text: 2. The legislative framework is complex. Several experts found national telecom security legislation rather complex.

text: 3. Authorities have powers but few resources. The powers of the national telecom security authorities are considered sufficient, but there are concerns about scarcity of resources and expertise.

text: 4. Incident reporting can be improved. In general, national-level incident reporting is working well, but there is room for improvement, for example to address the problem of reporting the same incident to multiple authorities, or the lack of feedback after submission of an incident report.

text: 5. Collaboration at national and EU levels is good. In general, both national- and EUlevel collaboration works well. On the latter, experts recognised the positive contribution of ENISA and the European Competent Authorities for Secure Electronic Communications (ECASEC, formerly

text: Article 13

text: a) Expert Group.

text: The experts who were interviewed and surveyed also provided recommendations for ENISA, Commission, and the national authorities in the EU Member States:

text: 1. Prioritise the implementation of new policies. In the short term, the priority is to implement the EECC, the EU 5G Toolbox and the related recommendations.

text: 2. More resource sharing and collaboration. To address cybersecurity skills shortages, it is important to explore resource and capability sharing not only between authorities in the same country and between authorities across the EU, but also between authorities and providers, depending on the topic. 3. More technical guidance for service providers. While ENISA’s role and the work of the ENISA ECASEC Expert Group were valued, experts from the sector asked for more technical and operational guidelines.

text: 4. Better incident reporting. To improve incident reporting, it is important that authorities provide feedback in response to incident reports. In addition, definitions of what should be reported and the thresholds for reporting should be clarified.

text: 5. More trust and engagement between public and private sectors. Trust between authorities and providers, as well as engagement with the private sector, are important, including in the early stages of policymaking.

text: As mentioned, at the end of 2020 the Commission put forward its NIS2 proposal. The NIS2 proposal constitutes part of a broader EU cybersecurity strategy , which addresses, among other things, the next steps in 5G security policy and updates the existing critical infrastructure protection legislation with a proposal for a directive on the resilience of critical entities . Under the NIS2 proposal, the EU telecom security provisions would be brought under the NIS Directive. We look forward to supporting these policy discussions between the European Commission, the EU Member States and the European Parliament.

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 6

text: 1.1. SCOPE 6

text: 1.2. TARGET AUDIENCE 6

text: 1.3. METHODOLOGY 6

text: 1.4. ACKNOWLEDGEMENTS 7

text: 2. FINDINGS 9

text: 2.1. ASSESSMENT OF TELECOM LEGISLATION AT NATIONAL LEVEL 9

text: 2.1.1.Summary 9 2.1.2.Positive impact of the legislation 10 2.1.3.Capabilities and powers of national authorities 11 2.1.4.Incident reporting and audits 11 2.1.5.Collaboration at national level 12

text: 2.2. ASSESSMENT OF TELECOM LEGISLATION AT EU LEVEL 14

text: 2.2.1.Summary 14 2.2.2.Harmonisation of implementation across the EU 15 2.2.3.Collaboration across the EU 15 2.2.4.ENISA and

text: Article 13

text: a Expert Group 16

text: 3. GOOD PRACTICE EXAMPLES 18 4. CHALLENGES AND RECOMMENDATIONS 20

text: 4.1. CHALLENGES FOR THE SECTOR 20

text: 4.2. RECOMMENDATIONS FOR ENISA AND THE NATIONAL AUTHORITIES 21

text: 5. CONCLUSIONS 22

text: 5.1. CONCLUSIONS FROM THE SURVEY AND INTERVIEWS 22

text: 5.2. RECOMMENDATIONS MADE BY THE EXPERTS 22

text: 1. INTRODUCTION

text: In 2020, ENISA carried out an assessment of the implementation of EU telecom security policy across the EU. The aim was to provide policymakers with input on a number of recent policy changes and reviews, such as the new EECC (whose

text: Article 40

text: replaced

text: Article 13

text: a of the Telecom Framework Directive), the review of the NIS Directive and the review of the Commission Recommendation on Cybersecurity of 5G networks.

text: This assessment was carried out by interviewing and surveying a large and balanced group of experts working in the EU telecom sector, experts working at telecommunications national regulatory authorities (NRAs) and experts working at national authorities for the NIS Directive. The body of this report contains the main results of this assessment.

text: 1.1. SCOPE

text: The scope of this assessment includes the security provisions of the EU legislative framework for electronic communications (namely,

text: Article 13

text: a of the Telecom Framework Directive), the new security provisions (

text: Article 40

text: ) under the EECC, other relevant EU policies related to telecom security, and national policies and legislation incorporating EU legislation adopted in the EU Member States.

text: 1.2. TARGET AUDIENCE

text: The target audience of this report are policymakers at EU and national levels and telecom security and policy/legislation experts.

text: 1.3. METHODOLOGY

text: An online survey was used to gather expert input. The survey was completed by a mixed group of 45 experts from across the EU, including experts working in the telecom sector and experts working at the national authorities. In addition, 21 telephone interviews were conducted with the experts to explore the key issues in more detail. Figures 1 and 2 show how each group was represented in the survey and interviews, respectively.

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION Figure 1: Participation in the online survey Figure 2: Participation in the telephone interviews 1.4. ACKNOWLEDGEMENTS

text: We are very grateful to all the experts who took the time to complete the online survey. We would also like to acknowledge the experts who participated in the telephone interviews.

text: Interviewee Affiliation

text: Interviewee Affiliation

text: 2. FINDINGS

text: This section presents the findings of the assessment. They are discussed at two levels:

text: 1. National level. Implementation of telecommunications security legislation at national level, including its impact, powers and capabilities of NRAs, incident reporting and national-level collaboration.

text: 2. EU level. Operation of telecommunications security legislation at EU level, including harmonisation, EU-level collaboration and work of the

text: Article 13

text: a (now ECASEC) Expert Group and ENISA.

text: 2.1. ASSESSMENT OF TELECOM LEGISLATION AT NATIONAL LEVEL 2.1.1. Summary

text: Overall, collaboration at national level is considered to be strong, especially between national telecom security authorities and the telecom sector, and between national telecom security authorities and NIS Directive national authorities and/or national cybersecurity incident response teams (CSIRTs). In addition, experts agree that security measures and risk management are good in the telecom sector.

text: On the other hand, there are mixed opinions on the sufficiency of national authorities’ resources. Moreover, there are concerns about collaboration at national level between telecom security authorities and data protection authorities, and between telecom operators and operators of essential services.

text: Figure 3: National level – capabilities and collaboration

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION 2.1.2. Positive impact of the legislation EU telecom security legislation has achieved a culture of risk management

text: EU legislation has increased the level There is a culture of risk management across EU Member of maturity in telecoms security in States and the security measures taken are considered many countries appropriate. The survey results underpin this opinion as 84% of participants agreed that there is a culture of risk management in the telecommunications sector.

text: Security measures are generally Only about 9% of the respondents disagreed with this appropriate statement. More than half of the respondents who disagreed with the appropriateness of security measures were CSIRT representatives.

text: Figure 4: Security measures taken in the telecom sector are appropriate

text: However, legislation is complex and guidance is missing

text: National legislation is complex Experts found legislation definitions, obligations and terms rather incoherent or unclear. They noted that permissive definitions or a lack thereof under the old EU regulatory framework allowed different interpretations at national level, which could hinder the operation of providers that are present in more than one Member State. The most commonly invoked example was that of an ‘incident’ . One of the interviewees commented that incidents ‘are seen and interpreted differently by many companies’.

text: Closely related to this was the uncertainty around the reporting thresholds and the treatment of digital service providers, domain name systems and Internet exchange points (IXPs). One of the experts noted that the last two services could potentially be within the scope of both the EECC and the NIS Directive.

text: In some countries, this is compensated However, in some cases, no additional materials are provided by guidelines to service providers. In addition, based on the findings of the survey, one quarter of the respondents thought that the guidelines provided by NRAs are not useful enough as they are considered too high level and lack operational and technical details.

text: Overlapping obligations and In some countries, service providers are supervised by and are requirements have been reported forced to collaborate with more than one authority regarding network security, for instance the NRA and a cybersecurity agency.

text: It is not always clear which specific For example, in some cases, telecommunications operators authority a certain service provider are also IXPs, which raises the question of whether their IXP falls under operations fall within the remit of the NRA (EECC) or the competent authority under the NIS Directive.

text: 2.1.3. Capabilities and powers of national authorities

text: 85% of the survey respondents agreed In addition, some respondents highlighted the continuous that the NRA has sufficient power adaptation of the NRA’s capabilities to technical changes.

text: However, many stakeholders were 37% of the survey respondents indicated that authorities’ lack concerned about the scarcity of of resources is an issue and 40% found that NRAs have resources and expertise insufficient expertise.

text: Resource sharing and collaboration For example, NRAs can receive support from national CSIRTs between authorities helps or other security services, such as crisis centres and intelligence services.

text: 2.1.4. Incident reporting and audits

text: Generally, national-level incident 69% of the online survey respondents agreed or strongly agreed reporting is working well. It has also that the right incidents are reported to authorities. Only a small been useful in improving cybersecurity percentage of respondents disagreed with this statement and 20% of respondents had no opinion on the topic.

text: However, some incidents are not being Three main reasons were identified by the respondents:

text: reported or are missing essential

text:  diverse interpretation of incidents within the scope,

text: details

text:  reporting rules focus on the duration of service interruption and, as a result, certain incidents may not be reported (e.g. data leaks), and  lack of trust between the authorities and telecom providers.

text: Incident-reporting obligations and Some respondents highlighted that there may be reporting processes may be fragmented obligations to multiple authorities, or the root cause of an incident may not be easy to define, which results in the same incident being reported to more than one authority. A noteworthy example of good practice is the universal reporting tool developed by the Danish Centre for Cyber Security (CFCS), which sends the report to the relevant authority.

text: It is uncommon to receive feedback on As a result, the interviewees sometimes viewed the incidentreported incidents reporting obligations as an ‘administrative burden’. The interviewees noted that receiving feedback would significantly increase the utility of reporting.

text: Concern: frequency of audits varies considerably

text: Some countries carry out 10–15 audits per year, while others conduct more than 250. In general, the view is that authorities have enough power to conduct or order audits, monitor procedures, perform supervision and collect the necessary information.

text: 2.1.5. Collaboration at national level

text: National-level collaboration is working well. Figure 5 presents the general findings on collaboration between stakeholders. This is followed by presentation of some of the highlights of the online survey and the interviews.

text: Figure 5: Collaboration between the following stakeholders is good

text: Collaboration between authorities at national level is improving

text: In most Member States, competent Collaboration between different telecommunications-related authorities recognised the increasing authorities is mostly considered to be good. There is also the importance of joint work intention to combine the capabilities and expertise of the different authorities, and confidence that this can be achieved.

text: Some challenges have been identified Challenges exist as a result of the different focuses and approaches of the different authorities involved. For example, while some stakeholders noted that collaborations between NRAs and CSIRTs are fruitful when they do occur, others claimed that such cooperation is still limited. Other stakeholders noted the problem of overlaps in responsibilities, which sometimes occurs between NRAs and other relevant authorities. Nevertheless, the stakeholders surveyed expressed their commitment to resolving any such overlaps.

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION Collaboration between national authorities and telecom providers is good

text: Major telecommunication service The regularity of the cooperation varies: from cooperation providers and the NRAs communicate on ‘based on necessity’ to ‘monthly meetings with the a regular basis competent authorities ’ about specific topics (e.g. implementation of the 5G Toolbox).

text: Some interesting examples of good For example, in Portugal, a collaboration platform practice have been reported in select coordinated by the National Communications Authority Member States (ANACOM) has been set up for telecom operators’ security experts, where they can share and discuss their main issues.

text: Building and maintaining trust is key Some stakeholders declared that the relationship between telecom operators and the authorities may not be fully transparent, as the operators are usually careful with the information they share. The majority of the authorities recognised the importance of building trust. They reported making significant efforts to improve collaboration by increasing the level of transparency in their decision-making.

text: Collaboration between telecom service providers is good

text: Telecom service providers have Apart from bilateral exchanges, some service providers expressed a desire to increase the level collaborate in informal groups or communities, where they of security-related cooperation share information on security topics.

text: In some countries, there are formalised national cooperation groups, which are sometimes even led by the relevant authority.

text: The quality of such collaboration varies In some countries, telecom service providers actively cooperate to solve major security incidents. However, in other countries they do not, reportedly because of ‘strong competition’.

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION 2.2. ASSESSMENT OF TELECOM LEGISLATION AT EU LEVEL 2.2.1. Summary

text: In summary, experts gave positive feedback on:

text:  the added value of the

text: Article 13

text: a Expert Group (now called ECASEC); and

text:  ENISA’s role in supporting the implementation of EU telecom security legislation, as well as ENISA’s technical guidelines.

text: On the other hand, experts highlighted issues with harmonisation and consistency. They did not agree that national capabilities in telecom security are comparable across the EU. In addition, experts expressed concerns about the consistency of telecom security requirements across the EU, as well as the consistency between EU telecom security legislation and the NIS Directive.

text: Figure 6: EU level – harmonisation and collaboration

text: 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION 2.2.2. Harmonisation of implementation across the EU

text: Article 13

text: a was considered rather general Surveyed experts reported that this freedom of interpretation in scope of

text: Article 13

text: a has led to dissimilar telecommunication security requirements across the Member States.

text: Article 13

text: a Working Group guidelines However, one of the experts interviewed noted that there was have helped to an extent ‘no official endorsement from the side of the Commission, which leads to unharmonised processes in Member States’.

text: Therefore, beyond legal requirements, some experts argued that it would be beneficial to standardise the implementation too. This would be particularly helpful to cross-border operators.

text: Figure 7: National capabilities on telecom sector security are comparable across the EU

text: 2.2.3. Collaboration across the EU

text: EU-level collaboration is generally considered to be good, but it appears to have limited exposure. Many stakeholders could not answer the question on whether EU collaboration is good or had no opinion on the matter.

text: Figure 8: EU level collaboration is good between the following stakeholders

text: Most respondents had no opinion on collaboration between the NRAs, the NIS Directive competent authorities and the NIS Directive authorities. This suggests that there is a need to establish better links between these two groups of authorities.

text: Most respondents considered EU-level collaboration between telecom providers to be good

text: This may result from operations in Strong EU-level collaboration between telecom providers may multiple Member States be connected to the fact that some major providers operate in multiple Member States, which makes it important for them to cooperate and harmonise processes.

text: 34% of respondents could not answer the Those respondents were mainly CSIRT and NRA question, or had no opinion representatives.

text: 2.2.4. ENISA and

text: Article 13

text: a Expert Group Role of

text: Article 13

text: a (now ECASEC) Expert Group described as ‘extremely beneficial’

text: Nevertheless, areas for improvement Some telecom service providers did not find the work of the have been identified

text: Article 13

text: a Expert Group sufficiently transparent. Some respondents thought that there needs to be stronger collaboration between the

text: Article 13

text: a Expert Group and the NIS Cooperation Group.

text: Despite its achievements, the

text: Article 13

text: a Some stakeholders also noted that, despite their usefulness, (now ECASEC) Expert Group does not there has been no official approval of the

text: Article 13

text: a technical have a legal status guidelines (now the revised ECASEC guidelines) by the European Commission. The stakeholders added that this results in unharmonised procedures.

text: ENISA plays a valuable role, but there is room for improvement

text: Positive feedback concerned facilitation 82% of participants surveyed agreed that ENISA is successful of knowledge sharing, incorporation of in supporting the implementation of telecommunications legislation and establishment of EU-wide security legislation, 87% agreed that the guidelines provided guidelines by ENISA are useful and 67% agreed that ENISA is effective in facilitating harmonisation and collaboration across the EU. It was also claimed that ENISA is especially good at bringing together the different Member States. 74% of survey participants thought that the

text: Article 13

text: a (now ECASEC) Expert Group brings added value.

text: ENISA’s guidelines are at too high a level Some stakeholders expressed the need for more operational and technical guidance.

text: ENISA’s powers and human resources Some stakeholders expressed concerns that ENISA might are insufficient lack sufficient human resources to manage the more technical and operational tasks requested by many Member States.

text: Figure 9: ENISA is effective in facilitating harmonisation and collaboration across the EU

text: 3. GOOD PRACTICE EXAMPLES

text: The experts gave examples of good practice during this assessment, either via the online survey or during the telephone interviews. Some of these suggestions are provided in the following sections.

text: Guidelines to assist the sector with implementing primary legislation

text: The Portuguese NRA, ANACOM, had introduced some additional secondary legislation to support telecom providers regarding regulatory interpretation and thus create a basis for more agile responses and approaches. Each telecom operator has to have an employee who is responsible for telecommunication regulation and security. In addition, each telecommunication operator has to have a contact point who is available 24/7; this is an operational position. A collaboration platform is also coordinated by ANACOM, where stakeholders can share and discuss security issues.

text: Resource and capability sharing

text: Resource sharing within the public sector. For inspections, the Belgian NRA, BIPT, can obtain help from other departments within the organisation, such as the controls-related department or the legal department. When specific cyber capabilities are needed, the Belgian NRA can obtain support from the national CSIRT or other security services, such as the crisis centre and intelligence services. In cases of both internal and cross-stakeholder types of collaborations and dynamic resource allocation, the effectiveness of task and responsibility fulfilment has been enhanced.

text: Resource sharing between the public and private sectors. The National Cyber Security Centre in Ireland has an extensive cooperation network with the private sector (e.g. with Amazon and Microsoft) and the partners provide technical assistance.

text: Combining responsibilities and competences for more streamlined operations. In Finland, Traficom combines the competences of the NRA, CSIRT and cybersecurity agency to maximise the available resources and streamline the execution of tasks.

text: Single incident-reporting platform

text: To address the issue of reporting incidents to multiple authorities, the Danish CFCS has developed a universal reporting tool, which is more efficient at sending reports to whichever authorities need to be informed.

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION Collaborative approach towards the private sector

text: The Radiocommunications Agency Netherlands uses a collaborative approach to build trust with telecommunication service providers. It tends to avoid the use of fines as a means of control because it considers it more important to create a learning curve, create the right mindset and help service providers improve their cybersecurity and risk-management processes.

text: The Belgian Institute for Postal Services and Telecommunications tries to carry out inspections and audits in a cooperative way (e.g. providing regular communication and feedback), as, ultimately, it has the same objective as the telecommunication service providers, which is to increase security in Belgium. It noted that those in security teams may find this process annoying initially; however, they realise that the reports help them to obtain resources and organisational support for their projects and improve their security standing.

text: Collaboration through common projects

text: Project-based collaboration is a good way to build trust. Belgium provided an example of such a process. In the context of the NIS Directive, there was a need for an incident notification platform. The Belgian Institute for Postal Services and Telecommunications offered the use of its own telecommunication incident notification platform to avoid the need for all authorities to develop their own. It worked closely with the Centre for Cyber Security Belgium to share its incident notification platform and practices. This helped to build trust and improve collaboration between the different authorities involved.

text: 4. CHALLENGES AND RECOMMENDATIONS

text: This section gives an overview of the perceived future challenges for the sector and lists several recommendations for ENISA and the national authorities.

text: 4.1. CHALLENGES FOR THE SECTOR

text: The key challenges for the EU telecom sector are:  next-generation networks, such as network function virtualisation (NFV) and 5G  cybersecurity skills shortages  dependencies on vendors and suppliers.

text: These challenges are described in more detail below.

text: Complexity of new technologies The most frequently mentioned challenge was adaptation to and such as NFV and 5G implications of the use of next-generation network technology, such as Network Function Virtualization (NFV) and 5G. 5G not only constitutes a technology change. It also introduces new business models, new vendors and network architecture changes. One expert noted: ‘New types of technologies and new types of services are gaining ground, such as machine-to-machine (M2M) and over-the-top (OTT), which brings up different types of security issues.’

text: Shortages of cybersecurity skills 89% of the online survey respondents identified the availability of cybersecurity skills as one of the biggest challenges in the sector. Some stakeholders reported that this skills shortage is affecting their core operations. Without the required technical expertise, many security challenges become even harder to tackle. For example, even if a public authority has the power to impose specific measures, exercising this power (e.g. effective monitoring) becomes very difficult without the right expertise.

text: Security gaps in the supply Some of the main challenges highlighted were supplier dependence, chain lack of security requirements for suppliers, outsourcing and geopolitical issues. According to the online survey and the interviews, many telecom service providers move parts of their operations outside their own countries because of more favourable legislative or business environments. This makes it difficult to oversee or influence critical security factors, and it introduces geopolitics into the security aspect of the supply chain.

text: ASSESSMENT OF EU TELECOM SECURITY LEGISLATION 4.2. RECOMMENDATIONS FOR ENISA AND THE NATIONAL AUTHORITIES

text: Experts made several recommendations for ENISA and the national authorities.

text: Implement new legislation, Timely implementation of the EECC, the EU 5G Toolbox and any regulations and related related recommendations was identified as the main short-term goal.

text: guidelines in a timely and

text: harmonised manner Experts stressed the need for simplicity and harmonised approaches. The

text: Article 13

text: a Expert Group (now ECASEC) was seen as making a positive contribution to this harmonisation. A priority topic going forward for the

text: Article 13

text: a Expert Group (now ECASEC) and the 5G Toolbox is supply chain security and risks. Developing EU-level standardisation has also been identified as important.

text: Increase collaboration between Experts would like to see better and earlier involvement of the private private and public sectors – at sector, including at the earliest stage of policymaking. This includes both EU level and national level providing the private sector with more exposure to ENISA ’s work. This would contribute to the private sector’s understanding of its own obligations and the steps it needs to take to fulfil them. The majority of authorities also recognised the need for deeper collaboration between private and public sectors and reported that considerable efforts are being made to build trust.

text: Provide more technical Technical guidelines provided by ENISA and national authorities are guidelines and share them with considered useful. However, stakeholders noted that they would find stakeholders as soon as it beneficial to have more detailed guidelines that break the legislation

text: possible

text: down into specific operational requirements. Telecom providers expressed the need for such guidelines to be made available as soon as possible to facilitate the smooth implementation of legislative requirements.

text: Review incident-reporting focus Avoiding unclear and overlapping obligations on telecom providers areas, carefully define from different authorities was one of the key recommendations. For thresholds and avoid obligation example, as in the Danish (CFCS) good practice example, this could overlaps be achieved by creating a single reporting platform where telecom providers could upload their reports, which could then be accessed by relevant authorities. When defining reporting thresholds, stakeholders recommended considering the inclusion of other aspects of network integrity besides focusing on the duration of service interruption. Experts also stated that they would like to see harmonised reporting thresholds across the EU, based on services’ characteristics.

text: Provide regular and detailed Telecom providers expressed the need for regular and detailed feedback on reported incidents feedback on the incidents they report. They reasoned that such feedback could contribute to creating a learning environment.

text: 5. CONCLUSIONS

text: In this report, we have provided an overview of an assessment of the EU telecom security legislation that was carried out in 2020. In this section, we list the main conclusions and recommendations.

text: 5.1. CONCLUSIONS FROM THE SURVEY AND INTERVIEWS

text: 1. EU telecom security legislation has a positive impact. Based on the responses from our stakeholders, security provisions in the EU regulatory framework, specifically in the Telecom Framework Directive, have successfully contributed to a high level of cybersecurity in the telecommunications sector. Indeed, most respondents were of the view that, in general, there is a culture of risk management across EU Member States and the security measures taken are appropriate.

text: 2. The legislative framework is complex. Notwithstanding the above, some stakeholders find national legislation rather complex. Moreover, some of the experts surveyed reported that the generality of

text: Article 13

text: a of the Telecom Framework Directive has led to dissimilar security requirements across the Member States.

text: 3. Authorities have powers, but few resources. The powers of the national telecom security authorities are considered sufficient, but there are concerns about scarcity of resources and expertise.

text: 4. Incident reporting could be improved. In general, national-level incident reporting is working well, but there is room for improvement. Apart from the scarcity of feedback on reported incidents, doubts sometimes arise over which authority a specific incident should be reported to, which results in telecom operators occasionally reporting the same incident to more than one authority.

text: 5. Collaboration at national and EU levels is good. In the latter context, stakeholders recognised the positive contribution of ENISA and the

text: Article 13

text: a (ECASEC) Expert Group. Nevertheless, some challenges were identified, such as the issue of involvement of the private sector in policymaking at both national and EU levels and the relatively low exposure of the private sector to existing EU-level collaboration.

text: 5.2. RECOMMENDATIONS MADE BY THE EXPERTS

text: The experts we engaged with also made recommendations for ENISA and the national authorities.

text: 1. Prioritise the implementation of new policies and legislation. To keep fostering the culture of risk management, timely implementation of the EECC, the EU 5G Toolbox and any related recommendations was identified as the main short-term goal.

text: 2. Address skills shortages with resource sharing and collaboration. To address cybersecurity skills shortages, it is important to explore resource and capability sharing. Several resource- and capability-sharing models have been identified to address this, for example resource sharing among public sector stakeholders and compensating resource shortages with private sector collaborations.

text: 3. More technical guidance for service providers. While the stakeholders described the outputs of ENISA and the

text: Article 13

text: a (ECASEC) Expert Group as ‘extremely beneficial’, they also expressed the need for more detailed guidelines that break down

text: the legislation into specific operational requirements. At national level, this report also provides examples of good practice to assist with the interpretation of primary legislation, such as the use of supplementary regulatory instruments and guidelines, and the provision of more direct assistance – such as collaboration groups or contact points.

text: 4. Improving and streamlining incident reporting. In addition to clarifying incidentreporting obligations at national level, this report highlights some examples of good practice to address the problem of telecom operators reporting the same incident to more than one authority. Moreover, to improve incident reporting, it is important that the authorities provide feedback in response to the submitted reports.

text: 5. Better engagement with the private sector. Regarding both national- and EU-level collaboration, stakeholders would like to see better and earlier involvement of the private sector, including at the earliest stage of policymaking. There may also be a need to increase the level of dissemination of information to the private sector to increase exposure to EU-level collaboration. Finally, the majority of the authorities recognised the importance of building trust between them and the private sector entities they supervise.

text: We would like to repeat our expressions of gratitude for the valuable feedback provided by the experts who were surveyed and interviewed. We look forward to continuing to work with the sector and the national authorities to address the issues identified in the assessment, and we will follow up on the recommendations made.

text: -N -EN -565 -21 -02 TP

text: ABOUT ENIS A

text: ISBN: 978-92-9204-505-0 DOI: 10.2824/30649