•HRES 575 EH 
account the global economy and interoperable rules, 
with sufficient oversight and respect for the rule of 
law. 
‘‘(D) The overall risk of influence on a supplier 
by a third country should be taken into account, no-
tably in relation to its model of governance, the ab-
sence of cooperation agreements on security, or 
similar arrangements, such as adequacy decisions, 
as regards data protection, or whether this country 
is a party to multilateral, international or bilateral 
agreements on cybersecurity, the fight against 
cybercrime, or data protection. 
‘‘(2) TECHNOLOGY.— 
‘‘(A) Stakeholders should regularly conduct 
vulnerability assessments and risk mitigation within 
all components and network systems, prior to prod-
uct release and during system operation, and pro-
mote a culture of find/fix/patch to mitigate identi-
fied vulnerabilities and rapidly deploy fixes or 
patches. 
‘‘(B) Risk assessments of supplier’s products 
should take into account all relevant factors, includ-
ing applicable legal environment and other aspects 
of supplier’s ecosystem, as these factors may be rel-
•HRES 575 EH 
evant to stakeholders’ efforts to maintain the high-
est possible level of cyber security. 
‘‘(C) When building up resilience and security, 
it should be taken into consideration that malicious 
cyber activities do not always require the exploi-
tation of a technical vulnerability, e.g. in the event 
of insider attack. 
‘‘(D) In order to increase the benefits of global 
communication, States should adopt policies to en-
able efficient and secure network data flows. 
‘‘(E) Stakeholders should take into consider-
ation technological changes accompanying 5G net-
works roll out, e.g. use of edge computing and soft-
ware 
defined 
network/network 
function 
virtualization, and its impact on overall security of 
communication channels. 
‘‘(F) Customer—whether the government, op-
erator, or manufacturer—must be able to be in-
formed about the origin and pedigree of components 
and software that affect the security level of the 
product or service, according to state of art and rel-
evant commercial and technical practices, including 
transparency of maintenance, updates, and remedi-
ation of the products and services. 
‘‘(3) ECONOMY.—
•HRES 575 EH 
‘‘(A) A diverse and vibrant communications 
equipment market and supply chain are essential 
for security and economic resilience. 
‘‘(B) Robust investment in research and devel-
opment benefits the global economy and techno-
logical advancement and is a way to potentially in-
crease diversity of technological solutions with posi-
tive effects on security of communication networks. 
‘‘(C) Communication networks and network 
services should be financed openly and trans-
parently using standard best practices in procure-
ment, investment, and contracting. 
‘‘(D) State-sponsored incentives, subsidies, or 
financing of 5G communication networks and serv-
ice providers should respect principles of fairness, 
be commercially reasonable, conducted openly and 
transparently, based on open market competitive 
principles, while taking into account trade obliga-
tions. 
‘‘(E) Effective oversight on key financial and 
investment instruments influencing telecommuni-
cation network development is critical. 
‘‘(F) Communication networks and network 
service providers should have transparent owner-
•HRES 575 EH 
ship, partnerships, and corporate governance struc-
tures. 
‘‘(4) SECURITY, PRIVACY, AND RESILIENCE.— 
‘‘(A) All stakeholders including industry should 
work together to promote security and resilience of 
national critical infrastructure networks, systems, 
and connected devices. 
‘‘(B) Sharing experience and best practices, in-
cluding assistance, as appropriate, with mitigation, 
investigation, response, and recovery from network 
attacks, compromises, or disruptions should be pro-
moted. 
‘‘(C) Security and risk assessments of vendors 
and network technologies should take into account 
rule of law, security environment, vendor malfea-
sance, and compliance with open, interoperable, se-
cure standards, and industry best practices to pro-
mote a vibrant and robust cyber security supply of 
products and services to deal with the rising chal-
lenges. 
‘‘(D) Risk management framework in a man-
ner that respects data protection principles to en-
•HRES 575 EH 
sure privacy of citizens using network equipment 
and services should be implemented.’’. 
Attest: 
Clerk.