A communication device for communicating data over a low power wide area, LPWA, communication network , wherein the communication device comprises: a processor configured to process data; a memory configured to store data; a radio configured to transmit and/or receive data over the LPWA communication network ; and a security system configured to operate a plurality of logically separated sets of security domains (111a-c, 113a-c, 115a-c), including a master set of security domains and one or more slave sets of security domains (111b,c, 113b,c, 115b,c), on the processor and the memory , wherein each set of security domains comprises a processor security domain (111a-c) and a memory security domain (113a-c, 115a-c), wherein the processor security domain and the memory security domain of the master set of security domains are configured to implement for each of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c) a respective use policy, which defines use and/or access rights of the respective slave set of security domains (111b,c, 113b,c, 115b,c), characterized in that the processor security domain and the memory security domain of the master set of security domains are configured to store the respective use policy in the respective memory domain (113b,c, 115b,c) of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c), wherein the respective processor security domain (111b,c) of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c) is configured to enforce the respective use policy stored in the respective memory domain (113b,c, 115b,c) of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c), and wherein the master set of security domains is configured to access the radio for receiving from a network management entity a new use policy and/or an updated use policy for one of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c). a processor configured to process data; a memory configured to store data; a radio configured to transmit and/or receive data over the LPWA communication network ; and a security system configured to operate a plurality of logically separated sets of security domains (111a-c, 113a-c, 115a-c), including a master set of security domains and one or more slave sets of security domains (111b,c, 113b,c, 115b,c), on the processor and the memory , wherein each set of security domains comprises a processor security domain (111a-c) and a memory security domain (113a-c, 115a-c), wherein the processor security domain and the memory security domain of the master set of security domains are configured to implement for each of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c) a respective use policy, which defines use and/or access rights of the respective slave set of security domains (111b,c, 113b,c, 115b,c), characterized in that the processor security domain and the memory security domain of the master set of security domains are configured to store the respective use policy in the respective memory domain (113b,c, 115b,c) of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c), wherein the respective processor security domain (111b,c) of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c) is configured to enforce the respective use policy stored in the respective memory domain (113b,c, 115b,c) of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c), and wherein the master set of security domains is configured to access the radio for receiving from a network management entity a new use policy and/or an updated use policy for one of the one or more slave sets of security domains (111b,c, 113b,c, 115b,c). <EOS>