Largely yes. The joint guidance on communications infrastructure is aimed at network engineers, and the agencies say it may also apply to organisations with on-premises enterprise equipment. A company without carrier scale can adopt the basics: inventory, central configs, management isolation, modern protocols, MFA and patching.
What the agencies say
The guide was issued on 4 December 2024 by CISA, NSA, FBI and partner agencies from Australia, Canada and New Zealand. Its purpose is to help network engineers and defenders improve visibility and harden devices against exploitation like that seen in telecom networks. The agencies add that the activity used existing weaknesses, so patching and general hygiene reduce risk.
What carries over unchanged
Most of the list does not depend on being a carrier.
- A device and firmware inventory.
- Central storage of device configurations.
- Alerts on changes outside change management.
- A management network kept apart from user traffic.
- Default deny access lists and segmentation.
- No Telnet, FTP, TFTP or SNMP v1 and v2c where avoidable.
- Phishing resistant MFA for administrators.
- Prompt patching and tracking of end of life gear.
What scales with size
Some items need judgement.
- Flow monitoring at key ingress and egress points is easy at one office and a project at forty.
- A physically separate management network may be a dedicated VLAN and jump host for a small shop, and a full out of band network for a large one. The guide asks for physical separation, so know where you fall short and record it.
- A SIEM is something the guide says to consider, so size it to the team that will watch it.
A prioritised order for a smaller team
- List every network device you own, with firmware version and owner.
- Remove default credentials and turn off insecure services you find.
- Put administrator access behind MFA and a dedicated workstation or jump host.
- Pull configs into one versioned store.
- Send device logs somewhere central.
- Patch edge devices first, and retire anything that is end of life.
Steps 1 and 2 cost little and close the most obvious doors.
What the guide does not tell you
It does not say your network is a target, and it does not give a risk rating for any size of company. Use your own risk assessment to decide how far to go. The guide also covers vendor specific steps for only one vendor, so check your own vendor's guidance for the rest.
How to explain it to leadership
Keep it short. The agencies reported that the activity used known weaknesses. The response is therefore a set of routine controls: know what you own, control who can administer it, turn off what you do not need, and patch. Ask for an owner and a date for each, not a large budget on day one.
Quick check
Do small companies need to follow every item?
The guide does not set a compliance bar. Treat it as a list of good practice, start with inventory, credentials and exposed services, and record gaps with owners.
Sources
Last reviewed: 19 October 2026.
