Telecom engineering teams should prioritize four things: lock down the management plane, collect logs centrally and keep off-site copies, keep an accurate inventory of devices and firmware, and review supplier software before it enters the network. CISA and partner agencies published hardening guidance for communications infrastructure that points to the same list.
Why this list?
In its Enhanced Visibility and Hardening Guidance for Communications Infrastructure, CISA and partner agencies from Australia, Canada and New Zealand warned that threat actors affiliated with the People's Republic of China had compromised networks of major global telecommunications providers for a broad cyber espionage campaign. The guide is aimed at network engineers and defenders and lists concrete practices. It is not a regulation, but it is a useful baseline when auditors, regulators or enterprise customers ask what you do.
Regulatory duties vary by country and by license type, so read the rules that apply to you. This post covers engineering priorities, not legal obligations.
How do you protect the management plane?
The guide recommends out-of-band management where possible, a strict default-deny access control list strategy for inbound and outbound traffic with denied traffic logged, and strong segmentation using router ACLs, stateful inspection, firewalls and DMZ constructs, with VLANs and private VLANs for finer separation.
It also asks for phishing-resistant multi-factor authentication on all accounts that access company systems, including administrative access to routers, and for unique credentials and sensible password policy. If SNMP is in use, it advises SNMP v3 with encryption and authentication and ACLs against public exposure, and it calls for disabling unnecessary discovery and management services and not exposing them to the internet.
A constructed check: scan your own address space from outside. If any management interface answers, treat it as an incident-class finding and fix it before anything else on this list.
What should logging look like?
The guidance calls for secure, centralized logging that can analyze and correlate large amounts of data from many sources, encrypts log traffic to remote destinations using IPsec, TLS or another encrypted transport, and stores copies of logs off-site so they cannot be modified or deleted by an intruder. It also asks teams to monitor logins from inside and outside the management environment and to establish a baseline of normal network behavior with alert rules for abnormal behavior.
For engineers this means every network element needs a log destination, time sync, and a retention policy decided in advance. A gap in coverage on one class of device is where an intruder will stay.
Why is the inventory a priority?
The guide stresses keeping the inventory of devices and firmware in the environment up to date so monitoring is effective. You cannot patch, monitor or retire what you cannot list. Include software that runs on those devices, including open source components in network functions, operations and billing systems. An SBOM per software release makes "do we run this version?" a lookup instead of a project.
What about supplier software?
Telecom networks run software from equipment makers, integrators and open source projects. Treat the supplier relationship as part of your security program: ask for SBOMs and vulnerability notification terms in contracts, verify signatures on firmware and software updates, test updates in a lab before production, and keep a list of end-of-support components with a retirement plan. NIST SP 800-161 offers a structure for cybersecurity supply chain risk management that you can adapt.
What to do
- Scan your external address space for management interfaces and close them.
- Move management access to an out-of-band network with phishing-resistant MFA.
- Apply default-deny ACLs and log denied traffic.
- Send logs to a central system over encrypted transport and keep off-site copies.
- Build and maintain an inventory of devices, firmware and software versions.
- Add SBOM and notification terms to supplier contracts.
- Verify update signatures and test updates before production.
- Check local regulation for reporting and resilience duties and map your evidence.
Safeguard's dependency scanning and SBOM generation can cover the software components in your own code and operations tooling. It is not a network security product.
Quick check
Is the CISA guidance mandatory?
No. It is guidance from government agencies, not a regulation. It is still a credible baseline to show customers and auditors.
Why keep off-site copies of logs?
An intruder with access to a device can alter or delete its local logs. An off-site copy preserves evidence for the investigation.
Sources
- CISA: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
- NIST SP 800-161 Rev. 1
- NIST SP 800-53 Rev. 5
Last reviewed: 18 October 2026.
