Security rules for 5G mobile networks in Spain

Automatic summary, not yet reviewed

1. This rule sets security requirements for installing, deploying and operating 5G networks and providing services based on this technology. Its goals include comprehensive security for the 5G ecosystem, a diversified supplier market, and stronger national security.
2. 5G operators, suppliers and corporate users must analyze the risks of their networks, equipment and services, detecting vulnerabilities and threats. Operators must do this every two years and send the analysis to the Ministry of Economic Affairs and Digital Transformation.
3. Operators with critical network elements must use at least two different suppliers, cannot use equipment from high-risk suppliers in critical elements or in access networks covering certain sensitive sites, and must keep those critical elements within Spain.
4. The Government, by agreement of the Council of Ministers, can classify a supplier as high risk, looking at its technical guarantees and its exposure to interference from third countries. Operators will then have a period, never shorter than one year, to replace its equipment.
5. A National Security Scheme for 5G networks and services is created, approved by the Government through a royal decree and reviewed at least every four years. It will carry out a nationwide risk analysis and set measures to manage those risks.
6. Breaches of these obligations are penalized under the General Telecommunications Law, with very serious, serious and minor offenses. The rule takes effect the day after publication, but the main obligations take effect one month later.

Who it affects

• 5G operators: They must analyze and manage risks, diversify their suppliers, undergo audits, and send information to the Ministry.
• 5G suppliers: They must guarantee the security of their equipment and services; if classified high risk, they can be banned from parts of the network.
• 5G corporate users: Those using private 5G networks with rights over the public radio domain must analyze and manage their risks.
• Public administrations: They cannot use equipment from high-risk or medium-risk suppliers for national security reasons.

Words worth knowing

Suministrador 5G (5G supplier)

Manufacturer, importer, distributor or provider of equipment, software or services involved in 5G networks.

Usuario corporativo 5G (5G corporate user)

A company or person that installs or uses a private 5G network for professional purposes or for its own use.

Elementos críticos (critical elements)

The most important parts of the network, such as the core, control and management systems, and the access network in certain areas.

Esquema Nacional de Seguridad de redes y servicios 5G (National Security Scheme for 5G networks and services)

A plan the Government will approve with a nationwide risk analysis and measures to reduce those risks.

Consejo de Ministros (Council of Ministers)

The body made up of the Government's ministers that makes major decisions such as this risk classification.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries