SpainReal Decreto-ley 7/2022 on the Security of 5G Networks and Services, Duties of 5G Operators, Suppliers and Corporate Users
Arts. 12, 13, 15 y 17 del Real Decreto-ley 7/2022, de 29 de marzo
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a 5G operator, a 5G supplier, or a 5G corporate user holding rights to use the radio spectrum for a private 5G network or for professional or self-supply 5G services, this decree-law binds you (Article 4).
- As a 5G operator, guarantee the secure installation, deployment and operation of public 5G networks and the secure provision of 5G services, including technical and operational measures for the physical and logical integrity of the networks, contingency plans for essential services that depend on them, control of who can access network assets, use of only certified products, resources, services and systems to operate them, compliance with applicable technical standards and European certification schemes, supplier security requirements, control of your own supply chain, and a security audit at your cost (Article 12(1) and (2)).NIST CSF 2.0GV.PO-01
- If you own or operate critical elements of a public 5G network, design a supply-chain diversification strategy under which access-network equipment, systems and resources come from at least two different suppliers, and send it to the Ministry of Economic Affairs and Digital Transformation within six months of the decree-law's entry into force (Article 12(3) and the Second Additional Provision).NIST CSF 2.0GV.SC-01
- As a 5G supplier, guarantee the security of the telecommunications equipment, hardware, software and ancillary services you provide for 5G networks and services: meet security standards from design to commissioning, strengthen software integrity and manage updates and patches, show product and service certification, audit the security of your equipment, products and services, give information on possible third-party interference in their design and operation, and give operators and corporate users information showing compliance with security standards (Article 13(1) and (2)).NIST CSF 2.0PR.PS-06
- As a 5G corporate user with spectrum rights for a private 5G network or self-supply services, guarantee the secure installation, deployment and operation of your private 5G network and the secure provision of your 5G services (Article 15(1)).NIST CSF 2.0PR.IR-01
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- GV.SC-01A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
- PR.IR-01Networks and environments are protected from unauthorized logical access and usage
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Secretaría de Estado de Telecomunicaciones e Infraestructuras Digitales, which exercises the sanctioning power under Article 30(8).
Settledness
- As of
- Open questions
- In what terms must the security audit that Article 12(2)(h) of Real Decreto-ley 7/2022 requires of a 5G operator be carried out, when Real Decreto 443/2024 leaves the terms of the audit and the requirements for certifying entities to a Technical Security Instruction (Instrucción Técnica de Seguridad)?
What this law does
Real Decreto-ley 7/2022, de 29 de marzo, published in the Boletín Oficial del Estado of , sets requirements to guarantee the security of fifth-generation (5G) electronic communications networks and services, and applies under Article 4 to 5G operators, 5G suppliers and 5G corporate users.
Article 12(1) requires 5G operators to guarantee the secure installation, deployment and operation of public 5G networks and the secure provision of 5G services available to the public, and Article 12(2) lists security obligations that include technical and operational measures for the physical and logical integrity of the networks, using only certified products, resources, services and systems to operate them, and submitting at the operator's own cost to a security audit.
An operator that owns or operates critical elements of a public 5G network must also design a supply-chain diversification strategy under which the access network's equipment, systems and resources come from at least two different suppliers (Article 12(3)).
Article 13 requires 5G suppliers to guarantee the security of the telecommunications equipment, hardware, software and ancillary services they provide for use in 5G networks and services, with obligations that include security by design, software integrity, update and patch management, certification of products and services, and a security audit of their equipment, products and services.
Article 15 requires a corporate user with rights to use the radio spectrum for a private 5G network to guarantee that network's secure installation, deployment and operation. Under Article 17(2) a public administration that installs or operates 5G networks, or provides 5G services, may not use equipment, products and services from suppliers classified as high-risk or medium-risk for reasons of national security.
Under Article 30(4), a failure to meet Article 12, 13, 15 or 17 is a serious infringement, and a failure by an operator that owns or operates critical elements to meet Article 12(3) is a very serious one, sanctioned under Title VIII of Law 9/2014. Articles 12, 13, 15, 16 and 17 enter into force one month after publication, and the rest of the decree-law the day after publication.
When LexLint raises it
When your app profile says your app provides telecom services or distributes a software product.