The Federal Communications Commission (FCC) announced measures to bolster the security of U.S. telecommunications networks in light of the recent cybersecurity threats, specifically the “Salt Typhoon” incident involving unauthorized access by state-sponsored actors from China.
Declaratory Ruling (DR):
The Declaratory Ruling affirms that telecom carriers’ obligations under section 105 of CALEA extend not only to the equipment they use in their networks, but also to the management of these networks. Telecom carriers are required to take steps to secure their networks from unlawful access or interception of communications. The DR takes effect immediately.
Notice of Proposed Rulemaking (NPRM):
- Annual Certification Requirement: The NPRM proposes that communications service providers must submit annual certifications confirming that they have developed, reviewed, and implemented a cybersecurity risk management plan.
- Comments: The FCC invites public comments on proposed cybersecurity risk management requirements, which apply to a variety of communications providers.
- Further Security Measures: The NPRM also seeks input on additional methods to strengthen the cybersecurity posture of communications systems and services.
The full text of the DR and NRPM can be found here.
Next Steps for Telecom Providers:
The FCC’s recent actions require a prompt evaluation and enhancement of cybersecurity protocols to align with new regulatory requirements. Key actions to consider include:
- Ensure compliance with the existing obligations under CALEA, in particular the required filing of a System Security and Integrity (SSI) Plan.
- Reviewing and enhancing cybersecurity risk management plans to meet both current and anticipated obligations.
- Conducting internal audits of compliance with CALEA, including the accuracy and sufficiency of SSI Plans.
- Monitoring FCC proceedings to stay informed about the NPRM and participate in the public comment process.
If you require assistance with navigating these developments or ensuring compliance with existing requirements under CALEA, including assistance with drafting and filing an SSI Plan, Marashlian & Donahue, PLLC, the CommLaw Group, is here to help. Contact Susan Duarte (sfd@commlawgroup.com or 703-714-1318), or Adam Davis (amd@commlawgroup.com or 703-714-1325) for more information.
