On 31 August 2023, the President, the Minister of Public Security and the Minister of Science, Innovation, Technology and Telecommunications jointly adopted Decree No. 44196-MSP-MICITT on cybersecurity measures to guarantee the safe use and exploitation of networks and provision of telecommunication services based on fifth-generation mobile technology (5G) and higher. The Decree sets out a list of national security risk scenarios for the public procurement of 5G deployment and operation, which regulatory authorities are required to consider in bidding processes. These scenarios include, in the case of foreign bidders, the risk of interference by foreign states that could compromise the security, availability, integrity of the infrastructure and the privacy of sensitive personal data. The Decree also lays out possible risk mitigation actions that authorities may adopt to manage the identified security risks.
"Article 1 - Purpose . The purpose of this regulation is to establish cybersecurity measures to ensure the safe, privacy-protected use and operation of telecommunications networks and services based on fifth-generation mobile technology (5G) and higher.
Article 2 - Scope of application. This regulation applies to the active operation of networks and services based on fifth-generation mobile technology (5G) and higher, by natural or legal persons, public or private, national or foreign, that operate networks or provide telecommunications services based on fifth-generation mobile technology (5G) and higher that originate, terminate, or transit through the national territory, with the exception of the operation of private telecommunications networks.
In the case of public procurement processes aimed at enabling networks and services based on fifth-generation mobile technology (5G) and higher, as well as the active technological equipment necessary for their deployment, for the use and exploitation of the radioelectric spectrum, the Administration or contracting entity must adopt the appropriate mechanisms to verify that potential bidders have considered all aspects related to risk management and mitigation contained in these regulations when planning, designing and implementing their technical offer. If the contract is awarded, the provisions of this regulation will be mandatory during the operation of the networks and provision of services based on fifth-generation mobile technology (5G) or higher.
[...]
Article 4 - National Cybersecurity Risks in 5G and Higher Networks. To ensure the safe use and operation of networks and the provision of telecommunications services based on fifth-generation mobile technology (5G) and higher, the following national cybersecurity risks for 5G and higher networks have been identified, grouped into five scenarios. These risks will constitute the framework for establishing public policy guidelines and regulatory measures based on risk prevention, mitigation, and control: [...]
III Risk scenarios related to the modus operandi of the main risk agents | R5: State interference through the 5G supply chain , when this could compromise the security, availability , integrity, and privacy of information.
[...]
Article 10 - High-risk parameters. Subjects falling within the scope of Article 2 of this Regulation must consider the following high-risk parameters for the operation of 5G or higher telecommunications networks and the provision of their services: [...]
(c) When the subjects included in the scope of application of article 2 of this Regulation or their hardware and software suppliers are susceptible to pressure from a foreign government due to a regulatory provision or official public policy of said foreign government, in relation to the location or execution of their operations.
(d) Where the subjects falling within the scope of Article 2 of this Regulation or their hardware and software suppliers are based in a country, or are otherwise subject to the direction of a foreign government with established laws or practices that may require them to share information of end-users of telecommunications services in the absence of a transparent legal process that adequately protects their rights and interests.
[...]
Article 11. Measures applicable when high risk is identified. When any of the subjects included in the scope of application of Article 2 of this Regulation identifies the presence of one or more of the parameters of high risk listed in the previous article, must inform the Superintendency of Telecommunications ( Sutel ) in accordance with the provisions of article 42 of the General Telecommunications Law, No. 8642, within 3 (three) calendar days following its identification and adopt the appropriate technical and administrative measures to guarantee the security of its networks and services.
When the presence of one or more of the high-risk parameters is identified by the subjects included in the scope of application of Article 2 of this Regulation, they will be subject to the immediate adoption of the following technical cybersecurity measures:
1) Telecommunications equipment, transmission systems, switching or routing equipment, and other resources that allow the transport of signals may not be used in critical network elements, as they represent a high cybersecurity risk for 5G and higher networks and national security. For this purpose, the following are declared critical elements of 5G and higher networks:
i. Those relating to the functions of the network core.
ii. Control and management systems and support services.
iii. The access network in those geographic areas and locations that provide coverage to centers linked to national security and the provision of essential public services. [...]" (Decree No. 44196-MSP-MICITT - Regulation on cybersecurity measures applicable to telecommunications services based on mobile fifth generation (5G) technology and above, Gazette No.159, 31 August 2023 [google translation])
Decree No. 44196-MSP-MICITT - Regulation on cybersecurity measures applicable to telecommunications services based on mobile fifth generation (5G) technology and above, Gazette No.159, 31 August 2023
[<a href="http://www.pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=NRTC&nValor1=1&nValor2=100155&nValor3=137277&strTipM=TC">Decree</a>]