Ericsson, Nokia, Tejas Networks, and Cisco have become the first telecom gear makers to get the "Trusted Source" status from the National Cyber Security Coordinator.
European, Indian Companies Get NCSC Nod, Chinese Companies Wait
Earlier this year, the NCSC launched a portal for gear makers and telcos to apply for "Trusted Sources" status. The companies had to appoint a nodal officer to interact with the NCSC portal and the government. The Chinese telecom suppliers, Huawei and ZTE, still wait for their approval; they have failed to complete the documentation process. Interestingly, Tejas Networks became the first homegrown supplier to get the "Trusted Source" tag.
France-based IIoT solutions provider Proscend, identity-related security service provider IDEMIA, PC Solutions and Dori Software have also received approval.
One of the people familiar with the development said, "this is a first step in the process, but right now it doesn’t mean much, as companies with approval from trusted sources can still get their equipment rejected if the authority is not satisfied”. They added, “the first list of trusted products is expected between the end of November and mid-December".
Since the NCSC has not approved any products as a "trusted product", the telcos still can't buy anything from these gearmakers. As such, they have raised concerned previously about delays in network deployment. However, the NCSC gave them a one-time exception for critical deployment. Vodafone Idea, Reliance Jio and Bharti Airtel recently took that exeption.
Chinese Telecom Gear Makers Wait
On the other hand, Huawei is under process to fulfil its obligations as part of the process to gain approval as a trusted source. A person familiar with the process said that the Chinese gearmaker has not completed the documentation.
Similarly, compatriot ZTE awaits approval from the NCSC. Both the gearmakers seek approval under the Indian Registered Entity category. This means that foreign entities with manufacturing based in India will be considered for approval under IRE, just like domestic suppliers. For instance, Ericsson and Nokia got their approvals in this way; Ericsson has its manufacturing via Jabil in Pune, while Nokia has a local facility in Chennai.
However, the NCSC guidelines do not clarify the origin of the product and the chances of approval. A senior executive at a European gearmaker said, "there is still no clarity on the origin of the component. Much of the global supply chain is in China and you can’t just move that to India overnight. So we wait and watch".