Assessing suppliers and service providers in telecom networks under Section 165(2a) no. 4 TKG

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026, catalogue of security requirements of the Bundesnetzagentur (BNetzA), the German Federal Network Agency, version 2.0 of 29 April 2020, checked on 6 November 2026. This page goes into one of the ten minimum measures in detail. The overview of all of them is on the page protective measures under Section 165 TKG. This is general information, not legal advice. Whether and how a duty applies to your company is a question for a lawyer admitted in Germany. Quotations from German statutes and from the catalogue of security requirements on this page are our own unofficial translations. Only the German text is legally binding.

What does Section 165(2a) no. 4 TKG require?

The provision requires measures for "supply chain security, including security-related aspects of the relationships between each entity and its direct suppliers or service providers". It applies to operators of public telecommunications networks and providers of publicly available telecommunications services that are essential or important entities under Section 28 of the BSI Act (BSIG). Section 28 BSIG sets no lower size threshold for these providers, so in our reading subsection 2a applies to practically every telecom provider. The classification is explained on the page NIS2 for telecom providers.

The Act does not say how the supply chain is to be secured. It names two features: the measures concern security-related aspects, and they concern the direct suppliers and service providers, meaning the companies you have a contract with yourself. Closely related is no. 5, security in the acquisition, development and maintenance of network and information systems, including vulnerability handling. When you buy and maintain a network component, both numbers apply together.

Which suppliers in a telecom network are covered?

All whose service or access can affect the security of your network or your services. Catalogue 2.0 speaks of "suppliers and agents" and requires particular care where entire business processes are outsourced, naming help desks, call centres and network connections. In the telecom network of a regional provider, in our assessment, these are mainly five groups:

At shared sites, Section 165(7) also applies: each party has the duties under subsections 1 to 5 to the extent they cannot be assigned to one party. If your equipment sits in someone else's data centre, agree in writing who takes on which protective measure.

What does catalogue 2.0 in force require?

Chapter 3 of catalogue 2.0 is mandatory for all companies subject to the duty. Section 3.1.3 "Supplier management" opens with the principle: the company "must therefore assess the reliability, trustworthiness and quality of the agent or supplier", and dependencies on third parties must not impair the security of networks, services and personal data. It then sets out four points:

• Gather information before placing the order: "Information is to be gathered before the order is placed." An assessment after the contract is signed does not meet this.
• Bind by contract: "Third parties are to be bound by contract." Security requirements belong in the contractual basis, for example when buying IT products or IT services.
• Ensure data protection: for data processing on behalf of the company, Article 28 GDPR applies.
• Check compliance: the security requirements should be checked where possible, always for data processing on behalf, and the checks should be repeated regularly.

Two further parts of the catalogue concern suppliers. Chapter 3.2 expressly counts people provided by suppliers or manufacturers as personnel. And chapter 3.6.2 on recovery provides that supplier contracts are checked in advance for replacement provision. For remote maintenance providers, this page therefore covers assessing them and binding them by contract. How the remote maintenance access is secured technically is on the page access to network elements and MFA.

What would draft 2025-10 change?

The draft of the new catalogue (version 2025-10) has not been adopted (as of 6 November 2026), and catalogue 2.0 continues to apply. In the draft, section 4.2.4 is called "Security in dependencies on third parties" and gives upstream providers, cloud providers and colocation as examples. The company's security objectives and security standards would also be binding on third parties and would have to be secured by contract. The measures are graded in three levels:

Which category a company would have to meet under the draft depends on the threat potential the draft introduces. That classification does not apply today. What the draft changes overall and how the classification is meant to work is explained on the page catalogue of security requirements under Section 167 TKG. In our assessment this means in practice: an overview of all contracts with third parties, and security clauses in those contracts, already make sense under catalogue 2.0 and would also be the lowest category, a), under the draft.

Network operators with increased threat potential, which today only 5G mobile network operators have, must in addition have critical components certified under Section 165(4) and obtain a declaration from the source of supply on its trustworthiness. The page critical components in telecommunications covers this.

How do you assess a supplier of network components?

The catalogue names three yardsticks, reliability, trustworthiness and quality, but no method. We work with a simple assessment per supplier that a small company can keep up to date. The questions are our professional recommendation, neither exhaustive nor mandatory:

• Access: Does the supplier have physical access, logical access or remote access to the network or data? This determines how critical the supplier is.
• Replaceability: Is there a second supplier or spare equipment, and how long would a switch take?
• Security practice: Does the manufacturer provide security updates for the version in use, and for how long? Is there a channel for reporting vulnerabilities? How does the service provider secure its own access?
• Contract: Does the contract contain security requirements, duties to report incidents, confidentiality and, where needed, a data processing agreement?
• Review: When was it last checked whether the supplier meets the requirements, and with what result?

Example: supplier assessment for network components

Fictitious example, not a client. A regional fibre ISP with 12 employees runs an FTTH network and offers internet access and telephony. The OLTs come from one manufacturer, an IT service provider handles maintenance by remote access, and a second service provider covers the night-time on-call service. The core network and customer systems sit in a rented data centre. This is what its supplier assessment could look like, with all details invented:

The traffic lights are our working aid: green means assessed, bound by contract and reviewed; amber means one point is missing; red means no assessment or no security requirements. The table is also the overview of contracts with third parties that the draft would require at category a), and it belongs as evidence in the measures part of the security concept under Section 166 TKG.

Three typical gaps

If you want to know where your company stands on the ten minimum measures as a whole, start with the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.