Should organisations treat 5G network security as an IT control issue or a third-party risk issue?

Why 5G Security Spans Telecom Controls and Third-Party Assurance

5G security is not just a perimeter or radio issue. The control plane, orchestration layer, hosted components and managed services are usually shared across operators, integrators and cloud providers, so the security question is really about whether each party can be trusted to operate its slice safely and consistently. That makes supplier assurance part of the control model, not an optional add-on.

In practice, the network team may own segmentation, hardening and monitoring, but the business risk often sits with the vendor chain that provisions software, manages updates, exposes APIs or administers support access. A useful way to think about it is that 5G introduces telecom-grade controls that must survive a multi-party operating model, not a purely internal one.

For readers building the risk model, the main issue is whether the organisation can still enforce policy when responsibility is split. If the answer depends on one provider’s tooling, another provider’s remote access, and a cloud tenant boundary, then the subject is already broader than a conventional IT control review. Third-party assurance becomes the governance layer that tells you whether the technical controls are actually enforceable end to end.

What Fails When 5G Is Treated as Only an IT Control Problem

Pure IT control thinking tends to overfocus on configuration, firewalls and monitoring inside one domain. That misses supplier compromise, insecure managed access, weak token handling and the operational reality that many 5G functions are delivered through external platforms or contracted operators. The result is a false sense of completeness: the controls may be sound locally but weak at the handoff points.

That is why 5G security should be assessed through the same lens used for other shared-service architectures. If a managed service provider can administer network functions, a cloud vendor hosts orchestration, or a subcontractor maintains components, then a weakness in one party can bypass otherwise solid internal controls. NHIMG’s Ultimate Guide to NHIs, Key Challenges and Risks is a useful reference for understanding how visibility gaps, overprivilege and unmanaged credentials tend to compound in multi-party environments.

That same pattern shows up in real-world compromise paths. Stolen tokens, exposed keys and vendor access can turn a remote administration path into direct operational control. The lesson is not that network controls are unnecessary, but that they are insufficient unless the supplier side of access, rotation and segregation is equally strong.

BeyondTrust breach 2024 and JumpCloud breach 2023 both show how vendor-controlled access can become the shortest path into critical systems when keys or admin channels are exposed.

How to Frame 5G Governance So Controls and Suppliers Work Together

The practical answer is to use one risk model with two lenses: control effectiveness and supplier trustworthiness. Network engineering should define the technical baseline for segmentation, hardening, logging and exposure reduction, while supplier assurance should validate who can change the environment, how access is granted, how keys are rotated and how third-party dependencies are monitored.

EU Digital Operational Resilience Act (DORA) and EU NIS2 Directive both reinforce that third-party ICT and supply-chain risk is part of resilience, not a separate paperwork exercise. For 5G programs, that means the governance question is not “who owns the incident ticket?” but “who can actually prevent, detect and recover from compromise across the full service chain?”

ISO/IEC 27002:2022 Information Security Controls and SOC 2 Trust Services Criteria (AICPA) are useful when you need to translate that shared responsibility into evidence, especially around access control, supplier oversight and operational assurance. In a 5G setting, those frameworks help separate what the operator can verify directly from what must be contractually and technically enforced on the provider side.

Where software provenance and hosted components matter, supply-chain controls also become part of the 5G answer. If an orchestration package, integration layer or managed update path is compromised, the issue is no longer only telecom security, it is platform trust. NIST SSDF (SP 800-218) and SLSA are relevant here because they address provenance and integrity in the delivery chain that often underpins modern network services.

Risk and Threat Considerations

5G environments increase exposure when trust is distributed across vendors, cloud tenants and managed access paths. The main risk is not a single weak control, but a control gap at the boundary between organisations, where an attacker can exploit stale credentials, overbroad support access or a compromised supplier to move from management plane access into service disruption or data exposure.

Failure mechanism: A supplier-facing secret, admin token or remote support channel is reused, poorly rotated or overprivileged, allowing an attacker or rogue insider to bypass the operator’s internal control stack and act with legitimate access.

Impact: The organisation can lose visibility, integrity and recovery leverage at the same time, because the compromised path often sits above the controls that were intended to secure the network itself.

Practitioner Guidance

What to prioritise: Start with the interfaces where a supplier can change, observe or administer 5G services. Those are the points where control failures become systemic, so they deserve the strongest combination of access review, segregation and monitoring.

What to verify: Confirm who holds privileged access, how it is time-bound, how it is revoked, and whether the operator can independently detect misuse. If the answer depends on manual assurances from the provider, treat that as a control weakness rather than a completed control.

Decision rule: If a third party can affect network availability, configuration or subscriber data, treat the issue as both an IT control matter and a supplier risk matter, but use the supplier lens to set the governance baseline and the IT lens to test technical enforcement.

Practitioner takeaway: In 5G, the strongest control is rarely the one inside the network diagram alone; it is the one that still works when vendor access, cloud hosting and managed services are part of the operating model.

Related resources from NHI Mgmt Group

• Should organisations treat third-party app access as a governance issue or a security issue?
• When should organisations treat an NHI as a high-priority risk?
• Should organisations treat shadow AI as a security risk or an innovation issue?
• Should organisations treat third-party access as a privileged identity risk?