The procurement of network security equipment should be undertaken by the organization responsible for the network or service, guided by relevant regulatory authorities and security frameworks.

Responsible Authority

The primary responsibility for procuring network security equipment lies with the organization or entity operating the network, such as a telecommunications provider, critical infrastructure operator, or enterprise IT department. These organizations must ensure that equipment meets security requirements, aligns with risk management policies, and supports the continuity of critical services . Regulatory and advisory bodies provide guidance and oversight:

• National Cyber Security Centre (NCSC): Offers guidance for assessing the security of network equipment, particularly for critical services, and recommends ongoing evaluation of vendor security practices .
• European Union Agency for Cybersecurity (ENISA): Provides practical guidelines for ICT procurement, helping organizations manage security risks in procured products or outsourced services .
• GSMA NESAS (Network Equipment Security Assurance Scheme): Establishes an industry-wide security assurance framework for network equipment, ensuring compliance with global security standards .
• Information Commissioner's Office (ICO): Advises on due diligence, risk assessment, and contractual enforcement of information and cyber security requirements when engaging IT suppliers .

Key Responsibilities in Procurement

Organizations undertaking procurement should:

1. Conduct risk assessments to identify potential security threats associated with vendors and equipment .
2. Perform due diligence on suppliers, including reviewing security policies, certifications, and past performance .
3. Include enforceable security requirements in contracts, ensuring vendors comply with the organization's security objectives .
4. Monitor and audit vendor security throughout the lifecycle of the equipment to maintain ongoing compliance and resilience .
5. Align with regulatory frameworks such as the Telecommunications (Security) Act, Electronic Communications Security Measures, or other national and international standards .

Conclusion

While the organization operating the network is directly responsible for procurement, it should do so under the guidance of regulatory authorities and industry standards to ensure security, compliance, and resilience. This collaborative approach mitigates risks, enforces vendor accountability, and supports the secure operation of critical networks and services .