Assess and document supplier risks before contract using the vendor security assessment in Annex B; record end-of-life equipment still in use and plan its replacement; record risk management actions; store SIM credentials so key material cannot be read, review SIM keys, algorithms and applets and phase out weak ones (M4). Before award, test the security functionality of equipment; make security a significant factor in procurement for security critical functions; record deployed equipment and its configuration; remove default passwords and insecure management protocols; prioritise security patches over features; and protect SIM data across its lifecycle with vendor-specific transport keys, non-default algorithm parameters, independently audited SIM vendors, and replacement of vendor-known profiles within the first year for modifiable SIMs (M8). Due: M4: Tier 1 by 31 March 2024; Tier 2 by 31 March 2025; M8: Tier 1 and Tier 2 by 31 March 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.