Nowadays, there are thousands of network operators, ranging from long-established national
incumbents (who have trusted each other for many years) to small, start-up networks with no track
record and no real basis of establishing trust, so new problems that did not exist in the traditional
regulated environment are now emerging. It is necessary for operators to know who they are dealing
with and the extent to which they can trust other operators to avoid the security problems. Security
baseline is the response to this new challenge.
The use of this supplement might vary from country to country, according to regulatory regimes.
Some regulatory regimes may choose to require that network operators follow the requirements of
this supplement. Some network operators may themselves require that other network operators meet
certain level of security as a prerequisite to the interconnection.
It is recommended that an operator provide telecommunication service for users at the security level
that is guaranteed by the implementation of this supplement. The services of higher security level
may be provided on customer's demand by the operator at a cost to the former.
This supplement is organized into three groups: operator's policy baseline and implementation,
technical tools baseline and collaboration baseline. These must be capable of being verified.
Evaluation might be conducted by an operator itself as a declaration procedure or with the
assistance of the evaluation body through the compliance certification.
NOTE – This security baseline includes both technical and management-oriented tools.