Network Equipment Security Assurance Scheme

What it is

GSMA states NESAS's objective directly: "The objective of NESAS is to provide an industry-wide security assurance framework to facilitate improvements in security levels across the whole industry."

GSMA describes the scheme as voluntary: "NESAS is a voluntary network equipment security assurance scheme operated and maintained by GSMA, with contributions from 3GPP, covering the methodology and security targets for equipment under test. It defines a globally applicable security baseline that network equipment vendors can meet."

NESAS has two components: a "Vendor Development and Product Lifecycle Processes Assessment", where an Auditing Organisation appointed by GSMA independently audits the vendor's internally-assessed development and lifecycle processes and produces an Audit Report; and a "Network Product and Evidence Evaluation", where an accredited NESAS Security Test Laboratory tests the product against the applicable Security Assurance Specifications (SCAS) and produces an Evaluation Report. GSMA's document states that only an evaluation report containing both results is meaningful: "It is the Evidence evaluation that links the tested Network Product to the internally assessed and independently audited vendor processes and this is why only an Evaluation Report that contains both results ... is meaningful to a MNO."

NESAS issues no certificate. GSMA's own document states: "There is no certification of Equipment Vendors or network equipment by an officially recognised authority."

Who owns it

GSMA defines and maintains the scheme: "The GSMA defines and maintains the NESAS specifications, which cover assessment of the Vendor Development and Product Lifecycle Processes, NESAS Security Test Laboratory accreditation, and security evaluation of network equipment."

3GPP supplies the security requirements and test cases the product evaluation is run against: "3GPP and other SDOs define security requirements and test cases for network equipment implementing one or more Network Functions – specified in Security Assurance Specifications (SCAS)."

3GPP's own technologies page describes what SCAS is, verbatim: "A SCAS Specification contains security requirements and test cases for a defined Network Function or a group of Network Functions." The same page states, verbatim: "The GSMA Network Equipment Security Assurance Scheme (NESAS) has adopted the 3GPP specified Security Assurance Specifications for its security assurance program."

Who assesses it

Two separate bodies assess, not GSMA itself: an Auditing Organisation appointed by GSMA audits the vendor's development and lifecycle processes, and an accredited NESAS Security Test Laboratory evaluates the network product against SCAS. Laboratory accreditation itself is a separate ISO/IEC 17025 accreditation matter, not something GSMA grants directly.

Who asks for it

Voluntary. GSMA's own document describes NESAS as voluntary and names no country or regulator as requiring it. A separate, verified exception exists at national level (Germany's BSI operates its own mandatory certification program, BSI NESAS, based on the GSMA scheme) — that is a distinct national record, not this one, and is not merged into it.

GSMA's own document describes the scheme's intended reach in general terms only: "NESAS is designed to be recognised and adopted by regulatory authorities..." The document names no specific country or regulator that has adopted it, and this record does not claim any beyond what is stated here.