【行业研报】关于欧盟成员国实施5G网络安全工具进展的第二次报告_市场营销策划_重点报告2023080.docx

SecondreportonMemberStates/Progressinimp1ementingtheEUToo1boxon5GCybersecurityJune2023600R0NCGTab1eofcontents1. Introduction31.1. Po1icycontext31.2. Objectivesandcontentofthereport41.3. Methodo1ogy42. MemberStates'progressinimp1ementingtheEUToo1boxmeasures52.1. Imp1ementationofStrategicMeasures52.2. Imp1ementationofTechnica1Measures113. EUToo1boxsupportingactionsandotherEU1eve1actions163.1. Exchangeofknow1edgeandcapacity-bui1ding173.2. Supp1ychainresi1ience183.2.1. CybersecurityofOpenRadioAccessNetworks(OpenRAN)183.2.2. Riskassessmentonthecybersecurityandresi1iencyofEurope'scommunicationsinfrastructuresandnetworks193.2.3. EUcoordinatedriskassessmentsbeyond5G193.2.4. Standardisationandcertification203.2.5. InvestmentsinEUcapacitiesintheareaofnetworktechno1ogies203.2.6. EUfundingforsecure5Gdep1oyment214. Imp1ementationoftherecommendationsoftheEuropeanCourtofAuditors215. Keyfindingsandconc1usions226. Annex251. Introduction1.1. Po1icycontextTheEUToo1boxon5GcybersecurityNISCooperationGroup,Cybersecurityof5Gnetworks-EUToo1boxofriskmitigatingmeasures,29January2023zhttps:/diRita1-strateRY.ec.europa.eu/en/IibrarVcybersecurity-5e-networks-eu-too1box-risk-mitigatinn-measuresSpecia1meetingoftheEuropeanCounci1(1and2October2023)-Conc1usions,EUCO13/20.Counci1Recommendation15623/22onaUnion-widecoordinatedapproachtostrengthentheresi1ienceofcritica1infrastructure,9December2023.Directive(EU)2018/1972oftheEuropeanPar1iamentandtheCounci1estab1ishingtheEuropeanE1ectronicCommunicationsCode.(EUToo1box)pub1ishedinJanuary2023aimstoaddressrisksre1atedtothecybersecurityof5Gnetworks.Itidentifiesanddescribesasetofstrategicandtechnica1measures,aswe11ascorrespondingsupportingactionstoreinforcetheireffectiveness,whichmaybeputinp1aceinordertomitigatetheidentifiedrisks.MemberStatesarecurrent1yimp1ementingthedifferentmeasuresatnationa11eve1.TheToo1boxanditskeyrecommendationshavebeenendorsedbytheEuropeanCommissionandMemberStatesatthehighest1eve1.InOctober2023,theEuropeanCounci1ca11edontheEUandtheMemberStates“tomakefu11useofthe5GcybersecurityToo1boxadoptedon29January2023,andinparticu1artoapp1ythere1evantrestrictionsonhigh-risksupp1iersforkeyassetsdefinedascritica1andsensitiveintheEUcoordinatedriskassessment,basedoncommonobjectivecriteria”.InitsRecommendationofDecember2023,theCounci1oftheEUreiteratedthat"itisimportantthattheMemberStatesachievetheimp1ementationofthemeasuresrecommendedintheEUToo1boxon5Gcybersecurityandinparticu1arthattheMemberStatesenactrestrictionsonhigh-risksupp1iers,consideringthata1ossoftimecanincreasevu1nerabi1ityofnetworksintheUnion'".Thecoordinatedactionon5GcybersecurityatEU-IeveIandtheEUToo1boxarepartofabroaderEuropeanframeworkfortheprotectionofe1ectroniccommunicationsnetworksandothercritica1infrastructures,andcomp1ementsexistingmeasuressuchastheEuropeanE1ectronicCommunicationsCode(EECC),theTe1ecomsFrameworkztheCybersecurityActRegu1ation(EU)2019/881oftheEuropeanPar1iamentandoftheCounci1of17Apri12019onENISA(theEuropeanUnionAgencyforCybersecurity)andoninformationandcommunicationstechno1ogycybersecuritycertificationandrepea1ingRegu1ation(EU)No526/2013(CybersecurityAct).zandtheDirectiveonsecurityofnetworkandinformationsystems(NISDirective)Directive(EU)2016/1148oftheEuropeanPar1iamentandoftheCounci1of6Ju1y2016concerningmeasuresforahighcommon1eve1ofsecurityofnetworkandinformationsystemsacrosstheUnion.ThefirstreportonMemberStates'progressinimp1ementingtheEUToo1boxwaspub1ishedinJu1y2023NISCooperationGroup,ReportonMemberStates'progressinimp1ementingtheEUToo1boxon5GCybersecurity,24Ju1y2023,https:/diHta1-StrategV.ec.europa.euenIibrarVreport-member-states-proHress-imp1ementing-eu-to。IbOX-5g-cybersecurity(firstProgressReport)andgaveastateofp1ayoftheimp1ementationofthedifferentmeasuresbyMemberStatesasofJune2023.Thereportconc1udedthatconcretestepshadbeentakentoimp1ementtheEUToo1box.ManyMemberStateshada1readyadoptedorwerewe11advancedinthepreparationofmoreadvancedsecuritymeasureson5Gcybersecurity.However,workwassti11ongoinginmanyMemberStatesondefiningthecontentandscopeofthemeasuresandinsomecases,po1itica1decisionssti11neededtobemadeinthisregard.Asregards5Gdep1oyment,a11EUcountrieshavecommercia15Gserviceavai1ab1eat1eastinapartofthecountryinApri12023andapproximate1y81%oftheEU,spopu1ationiscoveredbyat1eastoneoperatoroffering5Gservices5GObservatory,Quarter1yReport18,Apri12023.1.2. ObjectivesandcontentofthereportThisdocumentisthesecondreportontheimp1ementationoftheEUToo1box.ItsmainobjectiveistoprovideanoverviewoftheEUToo1boximp1ementationprocessbyMemberStatesunti1May2023,andtheprogressmadesincethefirstProgressReportof2023.IthasbeenpreparedandagreedbytheNISCooperationGroup,withthesupportoftheCommissionandtheEUAgencyforCybersecurity(ENISA).Thereportcoverstheimp1ementationofthestrategicandtechnica1measuresoftheEUToo1box.StrategicMeasures(SMs)inc1udemeasuresconcerningincreasedregu1atorypowersforauthoritiestoscrutinisenetworkprocure