NCCS Certification

Who Needs This Service

Telecom equipment OEMs and importers, including core network, CPE, routers, firewalls, SIM and eUICC, IoT, smart meters and cameras as ITSARs are enforced, and labs seeking TSTL designation need NCCS certification.

Vendors selling to telecom operators should plan for it.

Startups building secure devices should check ITSAR coverage.

If your product is not yet covered, monitor enforcement.

Key Benefits

• Security assurance against ITSAR
• Ten-year certificate validity
• TSTL testing coordinated
• Application support
• Market access

Next Steps & Related Services

After NCCS certification, maintain compliance with ITSAR updates. Related services: MTCTE, TEC Certification, ETA and DOT Certification.

Common Mistakes

• Wrong ITSAR.
• Unapproved lab.
• Ignoring variants.
• Assuming MTCTE covers security.
• Missing renewal.

Timeline, Costs & Practical Tips

Testing time depends on ITSAR.

Practical tip: confirm the ITSAR early.

Additional Information

ComSec enhances trust in telecom networks through security certification.

Practical Scenarios

Scenario 1:

A firewall vendor certifies.

Scenario 2:

A CPE maker tests.

Scenario 3:

A lab seeks TSTL status.

Process & Planning

For NCCS security certification, begin by finding the ITSAR that applies to your equipment type and checking whether it is enforced. Apply to NCCS under the security certification procedure with product details, select an NCCS-designated TSTL, and let the lab test the product against the ITSAR. NCCS reviews the lab reports and issues the certificate, valid for ten years after the 2023 amendment, subject to continued compliance. Planning checklist: design security features to the ITSAR from the start, keep firmware versions controlled, plan retesting when major changes occur and diarise renewal well before the ten years end.

Practical Guidance

Security certification is a design question as much as a testing one. ITSARs define security requirements for each equipment type, such as authentication, access control, cryptography, logging and secure update. If your engineering team builds to these requirements from the start, testing is smoother and cheaper. If you wait until the product is complete, you may need redesign.

Select an NCCS-designated TSTL with scope for your ITSAR and discuss the test plan. The lab performs tests and sends reports to NCCS, which evaluates them and issues the certificate. Since the 14 September 2023 amendment, certificates are valid for ten years, subject to continued ITSAR compliance, so you must also manage product updates. When you issue new software versions or change hardware, assess whether the change affects certified functions and whether NCCS needs to be informed or the product retested.

Also coordinate with MTCTE, since TEC conformity and NCCS security are separate processes with different evidence. Keep a security documentation set, including architecture, test results, vulnerability handling procedures and update policies, because buyers and regulators may ask for them.