(1)

The Commission has recognised 5th generation (5G) deployment of network technologies as a major enabler for future digital services and a priority for the Digital Single Market strategy. The Commission adopted the 5G Action Plan to make sure that the Union has the connectivity infrastructure necessary for its digital transformation from 2020 (1).

(2)

5G networks will build on the current 4th generation (4G) of network technologies, by providing new service capabilities and becoming the central infrastructure and enabler for large parts of the Union economy. Once rolled out, 5G networks will form the backbone for a wide range of services essential for the functioning of the internal market and the maintenance and operation of vital societal and economic functions – such as energy, transport, banking, and health, as well as industrial control systems. The organisation of democratic processes, such elections, will also rely more and more on digital infrastructure and 5G networks.

(3)

The dependence of many critical services on 5G networks would make the consequences of systemic and widespread disruption particularly serious. As a result, ensuring the cybersecurity of 5G networks is an issue of strategic importance for the Union, at a time when cyber-attacks are on the rise and more sophisticated than ever.

(4)

The interconnected and transnational nature of the infrastructures underpinning the digital ecosystem, and the cross-border nature of the threats involved, mean that any significant vulnerabilities and/or cybersecurity incidents concerning 5G networks happening in one Member State would affect the Union as a whole. This is why measures should be provided to underpin a high common level of cybersecurity of 5G networks.

(5)

The need for action at Union level has been confirmed by the Member States. In its conclusions of 21 March 2019, the European Council looked forward to a Commission recommendation on a concerted approach to the security of 5G networks (2).

(6)

Ensuring European sovereignty should be a major objective, in full respect of Europe's values of openness and tolerance (3). Foreign investment in strategic sectors, acquisition of critical assets, technologies and infrastructure in the Union and supply of critical equipment may also pose risks to the Union's security.

(7)

The cybersecurity of 5G networks is key for ensuring the strategic autonomy of the Union, as recognised in the Joint Communication ‘EU-China, a Strategic Outlook’ (4).

(8)

The European Parliament's resolution on security threats connected with the rising Chinese technological presence in the Union also calls on the Commission and Member States to take action at Union level (5).

(9)

This Recommendation addresses cybersecurity risks in 5G networks by setting out guidance on appropriate risk analysis and management measures at national level, on developing a coordinated European risk assessment and on establishing a process to develop a common toolbox of best risk management measures.

(10)

There is a strong Union legislative framework in place to protect electronic communications networks.

(11)

The Union's framework in the field of electronic communications (6) promotes competition, internal market and end-user interests and with the European Electronic Communications Code (7) pursues an additional connectivity objective, articulated in terms of outcomes: widespread access to and take-up of very high capacity fixed and mobile connectivity for all Union citizens and businesses while safeguarding the interests of the citizens. Directive 2002/21/EC requires Member States to ensure that the integrity and security of public communications networks are maintained, with obligations to ensure that undertakings providing public communications networks or publicly available electronic communications services take technical and organisational measures to appropriately manage the risks posed to security of networks and services. It also provides that competent national regulatory authorities have powers, including the power to issue binding instructions, to ensure compliance with such obligations.

(12)

In addition, Directive 2002/20/EC of the European Parliament and of the Council (8) allows Member States to attach conditions concerning the security of public networks against unauthorised access to the general authorisation, for the purpose of protecting the confidentiality of communications in accordance with Directive 2002/58/EC of the European Parliament and of the Council (9).

(13)

To support the implementation of these obligations, the Union has set up a number of cooperation bodies. The Agency for Network and Information Security (ENISA), the Commission, Member States and national regulatory authorities have developed technical guidelines for national regulatory authorities on incident reporting, security measures and threats and assets (10). The Cooperation Group established by Directive (EU) 2016/1148 of the European Parliament and of the Council (11) (‘the Cooperation Group’) brings together competent authorities in order to support and facilitate cooperation, in particular by providing strategic guidance for the activities of the Computer Security Incident Response Teams network, which at technical level facilitates operational cooperation.

(14)

The future European cybersecurity certification framework (12) should provide an essential supporting tool to promote consistent levels of security. It should allow for the development of cybersecurity certification schemes to respond to the needs of users of 5G-related equipment and software. The critical importance of these infrastructures should make the development of relevant European cybersecurity certification schemes for information and communications technologies' products, services or processes used for 5G networks an immediate priority. Member States and market players should actively engage in the development of such certification schemes, including providing support for the definition of specific protection profiles for 5G networks.

(15)

In the absence of harmonised Union law, Member States may specify by means of national technical regulations, adopted in compliance with Union law, that a European cybersecurity certification scheme should be mandatory. Member States also have recourse to European cybersecurity certification schemes in the context of public procurement and of Directive 2014/24/EU of the European Parliament and of the Council (13) and could support the development of assistance mechanisms – such as an assistance hub – for the purchase of cybersecurity solutions by public buyers.

(16)

A high level of data protection and privacy is an important element in ensuring the security of 5G networks. Rules have also been defined at Union level ensuring the security of processing of personal data, including in electronic communications. The General Data Protection Regulation (14) sets the obligation to process personal data in a manner that ensures its security, including for preventing unauthorised access to or use of personal data and the equipment used for the processing. The Directive on privacy and electronic communications lays down specific rules on the protection of confidentiality of communications and of the terminal equipment of end-users. It also imposes obligations on service providers to take appropriate technical and organisational measures to safeguard the security of their services.

(17)

The Union has also adopted an instrument that will protect critical infrastructure and technologies, such as those used in communications, by allowing Member States to screen foreign direct investments on grounds of security or public order and by creating a cooperation mechanism where Member States and the Commission will be able to exchange information and raise concerns related to specific investments (15).

(18)

Member States and operators are currently taking important preparatory steps towards enabling the large-scale roll-out of 5G networks. Several Member States have expressed concerns about potential security risks related to 5G networks in the context of carrying out procedures for the grant of rights of use in radio spectrum bands designated for 5G networks (16) — and have been exploring measures to address these risks.

(19)

Addressing cybersecurity risks in 5G networks should take into account both technical and other factors. Technical factors may include cybersecurity vulnerabilities that may be exploited to gain unauthorised access to information (cyberespionage, be it for economic or political reasons) or for other malicious purposes (cyberattacks aimed at disrupting or destroying systems and data). Important aspects to consider should be the need to protect the networks across their entire lifecycle and the need to cover all relevant equipment, including in the design, development, procurement, deployment, operation and maintenance phases of 5G networks.

(20)

Other factors may include regulatory or other requirements imposed on information and communications technologies equipment suppliers. An assessment of the significance of such factors would need to take into account, inter alia, the overall risk of influence by a third country, notably in relation to its model of governance, the absence of cooperation agreements on security, or similar arrangements, such as adequacy decisions, as regards data protection between the Union and the third country concerned, or whether this country is a party to multilateral, international or bilateral agreements on cybersecurity, the fight against cybercrime, or data protection.

(21)

As an important step in developing a Union approach to the cybersecurity of 5G networks, a risk assessment should be conducted and completed at national level. This would help Member States to adapt national measures on security requirements and risk management in the light of this assessment.

(22)

Coordination should be developed to ensure the effectiveness of measures aimed at addressing these cybersecurity threats, measures which are essential for the smooth functioning of the internal market and for the protection of personal data and privacy.

(23)

The national risk assessments should form the basis for a coordinated Union risk assessment, made up of a threat landscape mapping and a joint review to be conducted by the Member States, with support from the Commission and together with the European Agency for the Cybersecurity (ENISA).

(24)

Taking into account national and Union risk assessments, the Cooperation Group should establish a toolbox identifying types of cybersecurity risk and of possible measures to mitigate the risks in areas including certification, testing and access controls. It should also identify possible specific measures appropriate to address risks identified by one or more Member States. The Cooperation Group should draw on the support of the European Agency for Cybersecurity (ENISA), Europol, the Body of European Regulators for Electronic Communications (BEREC) and the EU Intelligence and Situation Centre. This toolbox should serve to advise the Commission on developing minimum common requirements to further ensure a high level of cybersecurity of 5G networks across the Union.

(25)

When measures are taken to address cybersecurity risks consideration should be given to the promotion of cybersecurity through diversity of suppliers when building any single network.

(26)

This Recommendation should be without prejudice to the competences of the Member States regarding activities concerning public security, defence, national security and the activities of the State in areas of criminal law, including the right of the Member States to exclude providers or suppliers from their markets for national security reasons.