The European Union Agency for Network and Information Security (ENISA) has published guidance on what nations should take into account when evaluating the security compliance of public communications network and service providers.
The requirements relate to Article 13a of the Framework Directive (2009/140/EC) and Article 4 of the e-Privacy Directive (2002/58/EC).
At first glance, many organisations might assume they do not fall within the remit of this "network and services" legislation, but Technical Guideline on Security Measures for Article 4 and Article 13a describes the "assets in scope" as "all assets of the provider which, when breached and/or failing, can have a negative impact on the security of networks, services and/or the processing of personal data".
The guidance provides a non-exhaustive list of networks and services, and related systems "which are often supporting, directly or indirectly, the provision of networks and services or the personal data processing". Whilst many in scope systems are communication and network related, including wires and fibre, network devices and DNS, other components mentioned are PCs, removable media, power supply systems, backup power supply and cooling systems. Many companies may be providers of services like these to organisations that are affected by the legislation.
The document goes on to describe "additional services" in scope that include "Provider web sites for customers, billing portals, et cetera, if they contain personal data which was collected and processed in connection with the provision of networks or services", "Customer premises equipment (CPE), if under the control of the operator (such as VOIP boxes)" and "Other systems used for storing or processing of personal data collected in connection with
the provision of networks or services. This could involve procedures involving paperwork like paper-printed letters, contracts or bills". As the document states "Third party assets are in scope just as if they were assets of the provider".
The guidance defines a "security incident" as "a single or a series of unwanted or unexpected events which could have an impact on the security of networks, services and/or the processing of personal data". It goes on to provide examples of various scales of incident and whether they are reportable.
The technical guidance is divided into 26 security objectives, each with three levels of sophistication that demonstrates what level of controls are in place. The objectives and measures might be useful for other organisations to assess their own maturity, regardless of legislative applicability.