Skip to main content
BSS/OSS Academy
🛡️
Section 15.1

From Regulation to Evidence

The six-rung chain the module teaches, the four regulations that set a European operator’s scope, the three pillars they reduce to, and the trust boundaries where controls land.

Regulation → Requirement → Risk → Architecture control → Deliverable → Evidence. Every security decision in a BSS/OSS estate should be traceable along that chain in both directions.

CHAINPRIVACY — GDPRCYBERSECURITY — NIS2RegulationGDPR — personal andcustomer dataNIS2 — public electroniccommunications providerRequirementMinimise, limit purpose,delete on scheduleManage cyber risk; reportsignificant incidentsRiskCustomer data copied tosystems that never deleteCompromised supplierreaches the activation planeArchitecture controlClassified data flows;SOM receives no nameZoned estate; PAM on themanagement plane; mTLSDeliverableDPIA, RoPA, data-flow map,retention/deletion modelRisk assessment, controlframework, IR plan, BCP/DREvidenceDeletion reached every copy;access reviews; DPA on fileIncident drill record;supplier assessments; logs
The chain this module teaches, worked for one privacy regulation and one cybersecurity regulation. Read down: the law creates a requirement, the requirement names a risk in this estate, the risk is met by an architecture control, the control produces a deliverable, and the deliverable is proven by evidence.

Read up as well as down. A control with no regulation or risk above it is a cost nobody owns; a regulation with no evidence beneath it is an audit finding not yet written. Security architecture for a telco is the discipline of keeping that chain intact while the estate changes under it.

The regulatory scope for a European operator

Four instruments cover most of what a BSS/OSS architect has to design for. Public electronic communications providers sit explicitly in NIS2’s high-criticality sectors; GDPR and ePrivacy form the core EU digital-privacy framework and bite hardest on telcos because of the volume and sensitivity of customer and communications data; the EECC is the sector’s own framework for networks and services.

RegulationWhat it coversKey BSS/OSS deliverables
GDPRPersonal and customer dataDPIA, RoPA, data-flow / data-lineage map, privacy-by-design assessment, retention and deletion rules, data-processing agreements
ePrivacyConfidentiality of communications; traffic and location data; marketing; cookiesCommunications-privacy assessment, consent mechanisms, data-retention rules, breach procedures
NIS2Cybersecurity and resilience of networks and servicesCyber risk assessment, security architecture, control framework, incident-response plan, BCP/DR, vulnerability management, supplier-risk assessment, security evidence
EECCRegulation, security and resilience of electronic communications services and networksNetwork and service security measures, incident management, resilience and continuity controls, regulatory records, customer and service obligations
Scope, deliberately kept narrow
National security-of-networks rules, lawful intercept and sector-specific retention law sit on top of these four and vary by member state. They follow the same chain; this module teaches the chain on the four that apply everywhere.

Three pillars in practice

In architecture terms the four regulations reduce to three pillars of work. Each pillar has a fixed set of focus areas; section 15.3 lists them and names the process each one calls for.

1. Privacy
DPIA · data-flow map · RoPA · data classification · retention and deletion model. Driven by GDPR and ePrivacy.
2. Cybersecurity
Risk assessment · threat model · security architecture · controls · vulnerability management · incident response · BCP/DR · supplier security. Driven by NIS2.
3. Telecom regulatory compliance
Service and network security · resilience and continuity · communications and data protection · regulatory reporting. Driven by the EECC, with NIS2 and ePrivacy overlapping.

Where the controls land: the estate as trust boundaries

ZONEWHAT RUNS THEREUntrustedCustomerPartnerInternetCIAM login · MFA · rate limitingEdge / DMZWAFAPI gatewayBFFOAuth scopes · workforce SSO · RBACBSS zoneCRMCPQCatalogCOMservice accounts · mTLS · scoped tokensOSS zoneSOMInventoryROMPAM · just-in-time access · session recordingManagement planeActivationControllersBastionmanagement VLAN · ACLs · no direct user accessNetwork elementsCoreAccessTransporttrust decreases downwards; every dashed line is a boundary
The architecture-control rung, drawn. Every dashed line is a boundary: something must be authenticated, authorised and logged to cross it, and each zone trusts the one above it a little less.
PrincipleWhat it means hereWhich rung it serves
Trust boundaryA line across which nothing is trusted by defaultArchitecture control — NIS2 zoning, EECC network security
Least privilegeEach identity may do the minimum its job needsArchitecture control — GDPR minimisation, NIS2 access control
Zero trustEvery request is verified, wherever it comes fromArchitecture control — SOM authenticates COM although both are “inside”
Security-by-designControls exist in the first version of the flowDeliverable — privacy-by-design assessment, GDPR Art. 25
Defence in depthNo single control is load-bearingEvidence — a failed control is detected, not discovered

What this module does not solve

It will not make you a security architect or a privacy lawyer, and it does not list controls. It gives an architect the chain, the questions to ask at each boundary — 15.2 — and the focus areas with the process each one calls for — 15.3.

Key Takeaways

  • Regulation → Requirement → Risk → Architecture control → Deliverable → Evidence: if a link is missing, the design is incomplete whatever the firewall says.
  • Four regulations set the scope for a European operator — GDPR, ePrivacy, NIS2, EECC — and they reduce to three pillars of work.
  • The trust boundaries in the estate are where the architecture-control rung is enforced; the deliverables and evidence are how the other rungs are proven.