← Back to all briefings

Policy · Credibility 92/100 · · 1 min read

Policy Briefing — EU 5G Cybersecurity Toolbox Endorsed

The European Commission and member states agreed on an EU 5G cybersecurity toolbox to coordinate supplier risk controls and mitigation measures across national networks.

Executive briefing: On , the European Commission and EU member states published the EU Toolbox for 5G Cybersecurity, delivering a joint risk mitigation plan endorsed by the NIS Cooperation Group. The toolbox combines strategic and technical measures to reduce dependence on high-risk vendors, protect critical functions, and improve resilience of 5G networks. Telecommunications operators, cloud providers, and enterprises relying on private 5G deployments are expected to align investment and procurement decisions with the toolbox recommendations.

Threat landscape and strategic objectives

Compliance checkpoints: safeguard national security interests

The toolbox follows the EU coordinated risk assessment released in October 2019, which highlighted supply chain dependencies, state-backed espionage, and potential sabotage of critical services. Strategic measures include strengthening regulatory powers for national authorities, ensuring diversity of suppliers, assessing third-country laws affecting vendors, and applying restrictions to high-risk suppliers for critical assets. Member states are encouraged to adopt a multi-vendor strategy to avoid single points of failure and to restrict access of high-risk suppliers from the core network, network management, and orchestration layers.

Operational moves: coordinate investments and spectrum policy

The Commission emphasised that decisions must reflect national risk profiles, but coordination is essential to avoid fragmentation that could undermine the Digital Single Market. EU funding programmes such as Connecting Europe Facility and the European Investment Bank are expected to prioritise projects that respect toolbox measures.

Technical risk mitigation measures

Operational moves: harden 5G core and virtualised infrastructure

Technical controls recommended by the toolbox include strengthening security requirements for mobile network operators (MNOs), assessing supplier risk on an ongoing basis, performing strict access control and secure operation of networks, and ensuring physical security of sites. Specific measures cover secure 5G core architecture design, application of security by design in virtualization and software-defined networking (SDN), and leveraging security monitoring and incident response capabilities. Operators are urged to adopt best practices from ENISA, implement network slicing controls, and ensure secure update mechanisms for network equipment.

Enablement tasks: prepare for EU certification and assurance regimes

The toolbox also promotes the use of certification schemes under the EU Cybersecurity Act. ENISA is tasked with developing candidate certification schemes for 5G components, supporting harmonised assurance levels. Operators must prepare to evidence compliance through independent audits, vulnerability assessments, and penetration testing focused on orchestration, virtualization, and supply chain integration.

Governance and regulatory expectations

Compliance checkpoints: align licences and reporting obligations

National regulators, including BEREC members and NIS competent authorities, are expected to incorporate toolbox measures into licensing conditions, spectrum auctions, and supervisory oversight. For example, Germany’s IT Security Act 2.0 and France’s "Loi Huawei" (2019-810) provide legal frameworks to restrict high-risk vendors. The Commission signaled that coordinated adoption will be monitored, and an implementation report is due each year. Operators should anticipate enhanced reporting obligations covering vendor inventories, security incidents, and mitigation plans.

Operational moves: integrate national coordination and crisis playbooks

The toolbox encourages deeper cooperation between telecom regulators, cybersecurity agencies, and intelligence services. Member states are asked to ensure that critical operators have incident response plans aligned with the NIS Directive and to participate in EU-level stress tests. Enterprises deploying private 5G networks in manufacturing, logistics, or energy sectors should engage with national authorities to understand how toolbox guidance applies to industrial campuses, as these deployments may rely on the same vendors and frequency bands as public networks.

Supply chain and vendor management implications

Operational moves: rebalance vendor portfolios

MNOs and enterprises must re-evaluate vendor selection, contractual safeguards, and lifecycle management. The toolbox recommends rigorous supplier risk assessments covering ownership structure, product security practices, and third-country legal obligations. Operators should map vendor portfolios, including radio access network (RAN) equipment, core network software, and managed services, to identify concentration risks. Dual-sourcing strategies should factor in open RAN initiatives, though the toolbox cautions that emerging vendors must meet equivalent security requirements.

Enablement tasks: enforce lifecycle and assurance commitments

Contracts should include clauses mandating timely patching, secure software development practices, and transparency on subcontractors. Operators need to monitor supply chain security through audits, certifications (e.g., GSMA NESAS), and threat intelligence sharing via the CSIRT network. For virtualized network functions (VNFs) sourced from cloud providers, enterprises must ensure alignment with the toolbox’s emphasis on secure infrastructure, segregation of critical functions, and monitoring of third-party management access.

Operational readiness and resilience

Operational moves: test critical network functions against disruption

Operators should conduct risk assessments covering 5G core, edge computing nodes, and network slicing controllers. Security teams must enforce least privilege, multi-factor authentication, and secure logging for management interfaces. Incident response plans should incorporate scenarios such as supply chain compromise, rogue base station deployment, and targeted denial of service against control-plane elements. Business continuity plans need to account for dependencies on timing synchronization, cloud orchestration, and software updates.

Compliance checkpoints: evidence resilience to regulators and boards

The toolbox highlights the need for redundancy and diversity at all layers. Network architects should design for geographic dispersion of critical functions, use diverse firmware versions where feasible, and maintain fallback capabilities to 4G systems during migration. Regular penetration tests and red-team exercises should be run in coordination with national cyber exercises, and lessons learned fed into change management pipelines.

Action plan

  1. Immediate: Map existing 4G/5G vendor portfolios, identify high-risk components, and assess compliance with toolbox strategic measures. Engage with national regulators to understand local implementation timelines.
  2. 30–60 days: Update procurement policies and RFP templates to incorporate toolbox requirements, including multi-vendor strategies, certification expectations, and incident reporting clauses. Launch supplier risk assessments prioritising core network vendors.
  3. 60–90 days: Execute technical gap assessments on virtualization security, access control, and monitoring capabilities. Develop remediation roadmaps, budget requests, and board reporting dashboards tracking toolbox adherence.
  4. Continuous: Participate in EU and national threat intelligence exchanges, monitor ENISA certification developments, and refresh resilience testing scenarios annually. Document compliance evidence for auditors, investors, and enterprise customers procuring 5G services.

Aligning with the EU 5G toolbox reduces systemic risk, protects national security interests, and builds trust in advanced connectivity services that underpin Industry 4.0, autonomous mobility, and critical public safety communications.

Market response and investment planning

Enablement insight: budget for diversified vendor ecosystems

European operators including Vodafone, Orange, and Deutsche Telekom issued statements welcoming the coordinated approach while warning that rapid restrictions on incumbent suppliers could increase rollout costs. Analysts from the GSMA noted that diversification must be paired with support for open interfaces and European R&D investment to maintain competitive ecosystems. The toolbox urges member states to leverage EU structural funds and national recovery plans to finance trusted vendors, particularly for small and medium-sized operators upgrading rural infrastructure.

Operational moves: sync capital planning with toolbox compliance

Enterprise adoption of private 5G, especially in manufacturing and logistics, is expected to accelerate under the toolbox once trusted supply chain frameworks are in place. Companies running mission-critical automation should align capital expenditure plans with toolbox-aligned vendors and ensure service-level agreements include rapid patch deployment and transparent lifecycle milestones. Investors and board-level risk committees will scrutinise 5G-related spending, requiring clear articulation of how toolbox compliance reduces long-term risk.

Follow-up: The Commission’s 2023 progress report urged faster removal of high-risk suppliers, and by 2024 member states including Germany, Belgium, and Sweden announced concrete Huawei and ZTE phase-out plans aligned with the toolbox risk mitigation measures.

Sources

  • 5G
  • Cybersecurity
  • European Union
Back to curated briefings