Cybersecurity tips for telecommunications carriers after FCC updates

Telecommunications carriers that implemented cybersecurity plans in response to updated rules from the Federal Communications Commission (FCC) should take a proactive approach to support their programs for long-term success.

Explore tips your organization can take to help keep programs operating seamlessly.

Background on cybersecurity rules

In July of 2023, the FCC issued rules for telecommunication carriers, specifically outlining cybersecurity requirements for those that chose to participate in the Enhanced Alternative Connect America Cost Model (E-ACAM) program.

The requirements stipulated that these carriers implement an operational cybersecurity and supply chain risk management plan (CSCRM), and submissions ended up being required in February 2024 after the rule was finalized and published.

Keep the plan operational

Now that the deadlines have passed and plans have been submitted, it’s time to start considering how to keep the plan operational throughout 2024 and beyond.

There are two categories of planned items:

• Remediation
• Annually recurring work

Remediation

Start by remediating any open items from building out the initial program and developing your corrective action plan. Depending on the gaps in the program, there are a few things to plan out.

Business impact analysis (BIA)

Assuming business continuity and disaster recovery plans need to be built, a BIA first needs to be completed. The BIA goes through your critical IT assets, identifies their importance, predicts the consequences of a disruption to your business if one or more of your critical IT assets are compromised.

The BIA is completed first because it helps inform recovery strategies that are built into business continuity plans (BCPs) and disaster recovery plans (DRPs).

Incident response plans (IRP)

IRPs will also need to be completed. The IRP goes through the response process in the event an incident occurs. An incident could lead to using the BCPs or DRPs previously created, but not always. The IRP is there to provide a response guide, so in moments of panic or distress you won’t have to think about what should be done next — you can just follow the plan.