This Decree-law, which was published in the BOE the following day and entered into force on March 31, has already received the validation of the Congress of Deputies, which yesterday ratified it with 312 votes in favor. This regulation will allow suppliers to be classified as low, medium or high risk suppliers and limit the presence of the latter in critical elements of the network.
Five years to replace critical items
At the end of March, the Government approved the Royal Decree-law to speed up the bill it was working on in the face of increased security risks and cyberattacks that may occur after the invasion of Ukraine. It was then that the so-called 5G Cybersecurity Law came into force, which establishes the specific cybersecurity requirements for the deployment and operation of 5G networks,
This new regulation, which was ratified yesterday by Congress, incorporates the strategic and technical measures of the European Union into the Spanish legal framework, by which the main threats and vulnerabilities are identifiedthe most sensitive assets and strategic risks in the deployment of 5G networks, taking into account the analyzes made by network operators.
The 5G Cybersecurity Law also establishes a procedure and criteria so that suppliers can be classified as low, medium and high risk. From there, the public 5G network operators may not use equipment from high-risk suppliers in the nucleus or core of the network, in its network management system and in certain locations of the access network.
And this affects both networks or 5G network elements already installed, as well as new 5G networks that are installed. If the operators were forced to replace the equipment, products or services provided by said suppliers, have a term of five years to carry out the replacement of critical network elements.
According to this standard, operators must also analyze their dependence on the supply chain and are required to include measures to limit dependency on a single supplier and restrictions for suppliers that are classified as high risk.