Build a NIS2-compliant secure telco cloud using VMware Telco Cloud Platform

For Communications Service Providers (CSPs), alignment with the enhanced cybersecurity regulations of the European Union’s NIS2 Directive is a strategic imperative and a compliance task. As providers of essential mobile and digital communication services, the telecom sector is designated as an Essential Entity under NIS2. This classification brings the highest level of regulatory scrutiny for Telcos. It also compels Telcos to comply with proactive oversight, mandatory audits, and stringent risk-management documentation requirements.

The NIS2 Directive creates a unified EU cybersecurity standard benefiting Telcos with cross-border operations. The adoption of risk-management measures boosts organizational resilience, minimizes disruption, and strengthens defenses against systemic threats. NIS2 also ensures operational consistency with a standardized security baseline across the EU, simplifying management and enabling seamless service delivery. 

To assist CSPs in building a secure and resilient foundation for the digital ecosystem, we are excited to announce the NIS2 Product Applicability Guide (PAG) for VMware Telco Cloud Platform. The document is the result of a thorough evaluation by Tevora, an independent third-party IT audit firm. Following discussions with Broadcom product teams, Tevora mapped VMware product capabilities to the NIS2 directive, providing an unbiased, expert perspective on the solution’s alignment to the directive. It is designed to break down the NIS2 directive and offer actionable understanding to CSPs. It also helps CSPs align to regulatory requirements by leveraging the capabilities of the Telco Cloud Platform.

How VMware Telco Cloud Platform Supports NIS2?

This PAG provides an in-depth evaluation of how the VMware Telco Cloud Platform maps directly to key NIS2 requirements.

Here is a glimpse of what the guide covers:

• Cybersecurity Risk Management (Article 21): The guide details how Telco Cloud Platform capabilities support the ten key measures of Article 21. This includes crucial components such as:
  • Incident Handling: Leveraging platform features for robust incident response.
  • Supply Chain Security: Addressing security aspects of direct suppliers and service providers.
  • Multi-Factor Authentication: Guidance on implementing MFA and continuous authentication solutions.
  • Business Continuity: Aligning platform capabilities for backup management, disaster recovery, and crisis management.
• Governance and Accountability (Article 20): Learn about the governance and accountability requirements, including the obligations for senior management to oversee and approve cybersecurity risk-management measures.
• Incident Reporting (Article 23): Understand the expectations and reporting timelines for cyber incidents.

Built with “Security by Design”

The document highlights Broadcom’s commitment to “security by design” framework, showcasing that it incorporates product capabilities aligned to NIS2 requirements. The analysis goes a step further by evaluating the platform against eleven security lenses, including:

• Automated Security
• Data Encryption & Protection
• System Hardening
• Network Protection
• Trusted Execution/Secure Boot
• Software Development Lifecycle (SDLC)

This layered approach helps security and compliance practitioners understand how the features of Telco Cloud Platform support both NIS2 compliance and general security best practices.

VMware Telco Cloud Platform NIS2 Product Applicability Guide is designed to help organizations navigate the complexities of the NIS2 Directive. Referencing the complete guide could equip you with the knowledge to evaluate your specific vulnerabilities, strengthen your capability to assess cybersecurity defenses, and prove compliance with different aspects of the NIS2 Directive.