CPE Compliance: ETSI Mapping

Ensuring Consumer Routers & ONTs meet NIS2 Article 21 requirements via ETSI EN 303 645 standards.

📡

ISP Accountability: Managed CPE (Customer Premises Equipment) is considered part of the "Supply Chain" (Art 21.2.e) and "Network Security" (Art 21.2.a) mandates. Failure to secure these assets can lead to localized signaling storms or widespread data breaches.

Quick Self-Audit

0% COMPLIANT

Unique per-device passwords (factory reset)

Firmware updates signed via CA-root

WAN-side management (TR-069) uses HTTPS

Support for WPA3 on wireless LAN

No UPnP enabled by default on WAN

Validated "Kill-Switch" for compromised fleets

ETSI EN 303 645 Technical Matrix

Provisions (CPE Focus)

NIS2 Article 21.2

CPE Implementation (TR-069/USP)

Provision 1

No Universal Default Passwords

Unique credentials for TR-069 and local admin.

Art 21.2(g)

Art 21.2(i)

Cyber hygiene & Access Control.

TR-069 / USP

ACSR (Auto Config) pushes unique salted hashes during bootstrap.

Provision 2

Vulnerability Reporting Policy

Public PSIRT for CPE firmware flaws.

Art 21.2(f)

Policies regarding vulnerability handling.

PSIRT / ISO 29147

Establish a 24h intake for "Bug Bounty" reports on router vulns.

Provision 3

Firmware Updates & End-of-Life

OTA updates must be signed and timely.

Art 21.2(e)

Art 21.2(g)

Supply chain & Maintenance.

OTA / CMS

Automatic firmware push for all "End-of-Life" (EoL) hardware.

Provision 6

Minimize Attack Surfaces

WAN-side ports closed by default.

Art 21.2(a)

Risk Analysis & Network Security.

ACLs / Firewall

Stealth-mode by default; WAN management limited to ACS IP range.

Provision 9

Resilience to Outages

Dual-image BIOS for recovery.

Art 21.2(c)

Business Continuity.

Dual-Flash

Automatic partition fallback if firmware upgrade fails mid-stream.

Managed Lifecycle Roadmap

Zero-Touch Provisioning

Use TR-069 'Bootstrap' profiles to push unique per-device passwords and disable WAN-side telnet/SSH.

OMCI Security

Ensure ONT-to-OLT authentication using encrypted PLOAM or 802.1X for fiber-to-the-home (FTTH).

Rollback Protection

Firmware OTA must include anti-rollback counters to prevent attackers from reverting to vulnerable versions.