The requirements refer in particular to operators of public telecommunications networks with a high potential threat, the Agency said in a statement. The essential elements of the new security rules include the sourcing of systems only from trustworthy suppliers that follow national security regulations and provisions for the secrecy of telecommunications and for data protection, constantly monitoring the network traffic, the certification of security-related network and system components (critical key components) by the Federal Office for Information Security (BSI) and IT security checks by an approved testing body of the BSI.
In addition, operators have to give proof that the hardware tested are actually deployed in the products used to build a network, "monocultures" have to be avoided by using network and system components from different manufacturers, and only professionally competent, reliable and trustworthy contractors should be employed to source system-related process. Finally, adequate redundancy must be available for critical, security-related network and system components.
The BSI and the Federal Commissioner for Data Protection and Freedom of Information (BfDI) have written the requirements. A draft of the new security regulation is planned for spring 2019. The Federal Network Agency will publish the final version of the requirements after receiving comments from manufacturers and associations.
The Telecommunications Act will be amended in a second step to clarify that the security requirements bind the network equipment suppliers. The German government has been debating the possibility to introduce new security rules following international concerns over Huawei and ahead of the 5G spectrum auction starting 19 March.
The Chancellery wants in fact to avoid the exclusion of Huawei. The fear is that China can retaliate with punitive actions against Germany if Huawei were banned.
