The UK government has announced plans for legislation to impose tighter security requirements on telecom operators and their supply chains. However, it stopped short of taking a decision on "high-risk vendors", saying it will study the matter further following the US government's recent blacklisting of Chinese equipment maker Huawei.
The 'Telecoms Supply Chain Review' released by the Department of Digital, Culture, Media and Sport outlines the government’s review of security risks in the telecom sector and proposes a series of new security requirements. Overseen by Ofcom and government, the telecoms operators will need to design and manage their networks to meet these new standards.
They will also be subject to "rigorous oversight" as part of their procurement and contract management processes, the ministry announced. Operators will need to work much more closely with suppliers to ensure that there is proper assurance testing for equipment, systems and software.
The review also identified a lack of diversity in the supply chain and recommends that regulations enforcing telecoms cyber security must be strengthened. The government will now develop legislation and look to provide Ofcom with stronger powers. Until then, the government said it will work with industry to develop new security requirements.
The review also looked at how to mitigate the risks from "high risk vendors". The UK has already been evaluating Huawei for several years due to such concerns and continues to find security failings it cannot mitigate.
However, the UK government was unable to agree a new position on such vendors. Following the action by the US Department of Commerce and uncertainty around the implications for the telecoms market as a whole from Huawei's entity listing, the UK said it will further consider its position and "decisions in this area will be made in due course". This suggests the decision has been left to the next Prime Minister, who is expected to be named in the coming days.
