SpainReal Decreto 443/2024 National Security Scheme for 5G Networks and Services, Duties of 5G Operators and Suppliers
Real Decreto 443/2024, arts. 18, 19, 23 y 24, Esquema Nacional de Seguridad 5G
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- If you are a 5G operator, a 5G supplier or a 5G corporate user, this scheme binds you under Real Decreto-ley 7/2022 (Article 4.1).
- As a 5G operator, analyse the risks to your 5G networks and services and send a new analysis to the Ministry for Digital Transformation and the Civil Service before and then every two years, or when it requires one after significant changes (Article 18.1 and 18.6).
- As a 5G operator, submit to an ordinary security audit at your own cost at least every two years, and to an extraordinary one after substantial changes that may affect the security measures (Article 23.2(j)).
- As a 5G supplier, analyse the risks of the equipment, hardware, software and ancillary services you provide for 5G networks, and give that analysis to the Ministry and to the operators you supply when required (Article 19.1 and 19.2).
- As a 5G supplier, meet security standards from design to commissioning, strengthen software integrity, manage updates and patches, and carry out a security audit of your equipment, products and services (Article 24.2(a), (b) and (e)).
These lines are LexLint's reading of the law's text.
What this law does
The national security scheme for 5G networks and services applies to 5G operators, 5G suppliers and 5G corporate users, and to public administration entities that install, deploy and operate 5G networks or provide 5G services unless their activities are mainly in national security, public security, national defence or law enforcement. A 5G operator must analyse the risks to its 5G networks and services, detecting the vulnerabilities and threats that affect them.
A 5G operator must carry out a new risk analysis and send it to the Ministry for Digital Transformation and the Civil Service before , and then every two years. A 5G operator must also submit to a security audit at its own cost at least every two years. A 5G supplier must analyse the risks of the telecommunications equipment, hardware, software and ancillary services involved in operating 5G networks.
A 5G supplier must meet security standards from the design of its equipment, products and services to their commissioning, and must strengthen software integrity and manage updates and patches. A 5G supplier must also carry out a security audit of its equipment, products and services. The sanctions regime of articles 30 and 31 of Real Decreto-ley 7/2022 applies to breaches.
When LexLint raises it
When your app profile says your app provides telecom services or distributes a software product.
Back to the example · Lint your app
Page updated .