
The decision included a Notice of Proposed Rulemaking (NPRM) requiring telecom companies to create, update, and implement cybersecurity risk management plans, and certify them annually.
However, this week the FCC claimed that the Declaratory Ruling “misconstrued” CALEA, calling it “flawed,” and “unlawful and ineffective.”
According to the agency, their action follows “months-long engagement with communications service providers” in which they have demonstrated a “strengthened cybersecurity posture” following Salt Typhoon.
These providers have agreed to undertake “extensive, urgent, and coordinated efforts” to protect their networks against cyberattacks, mitigate operational risks, protect consumers, and preserve national security interests, according to the FCC.
The Commission added that it has taken “a series of actions” to harden communication networks and improve security. This includes establishing a Council on National Security that engages with security partners, and adopting targeted rules for critical infrastructure that don’t impose “inflexible and ambiguous requirements,” such as a mandate that submarine cable licenses only be granted after risk management plans are in place.
Further, the FCC has banned “bad labs,” equipment-testing companies owned or controlled by foreign adversaries (notably China), from its equipment authorization program to ensure “no such entities are subject to untrustworthy actors that pose a risk to national security.”





















