For most of the LTE era, CPE security was treated as a vendor problem. Operators specified radio performance, and security meant little more than a password on the admin page. That era is ending. A wave of product cybersecurity regulation—led by the EU Radio Equipment Directive (RED) delegated act and the FCC Cyber Trust Mark in the United States—is pushing device security from a checklist item to a legal requirement, and it is already changing how 5G CPE is specified, certified and procured.
The EU RED delegated act: cybersecurity becomes mandatory
Under Delegated Regulation (EU) 2022/30, radio equipment placed on the EU market must now demonstrate protection of networks, protection of personal data and privacy, and protection against fraud. For connected devices such as 5G CPE and routers, this took effect from 1 August 2025. In practice, that means manufacturers must implement and evidence baseline security controls—secure authentication, encrypted communications, protected software updates and resistance to common attack vectors—rather than simply asserting them.
The FCC Cyber Trust Mark: a voluntary label with market weight
In the United States, the FCC’s Cyber Trust Mark programme takes a different route: a voluntary labelling scheme, modelled on Energy Star, that lets consumers and, increasingly, enterprise and operator buyers identify devices that meet recognised security baselines. Because the mark is visible and comparable, it is rapidly becoming a procurement signal—enterprise and government buyers are starting to treat it as a de facto requirement even where it remains formally voluntary.
Why operators should care
Operators are the first line of accountability when a compromised CPE becomes part of a botnet, is used to attack the network, or leaks subscriber data. Regulatory pressure now lands on the supply chain as a whole: operators procuring non-compliant devices inherit legal, reputational and operational risk. This is shifting tenders from radio-first to security-inclusive, with specific clauses for secure boot, signed firmware updates and vulnerability disclosure processes.
What changes in the CPE specification
- Secure boot and firmware signing become baseline requirements, not differentiators.
- Documented vulnerability management and a commitment to security patch support for a defined period.
- Hardware root of trust and protected storage for credentials and keys.
- SBOM (software bill of materials) to track components and respond to disclosures.
- Evidence of conformity for the EU RED requirements and, where relevant, Cyber Trust Mark certification.
The commercial and strategic impact
Compliance is not free, but it is becoming a competitive filter. Vendors who can demonstrate secure-by-design hardware and clean conformity documentation are winning RFPs, while those treating security as an afterthought are being deselected at the specification stage. For operators, aligning procurement with these rules now reduces retrofit costs and liability later, and positions the fleet for whatever the next round of regulation—such as the EU Cyber Resilience Act’s broader scope—will require.
The direction is clear: CPE security is no longer optional, and it is no longer invisible. It is a procurement requirement, a certification pathway and, increasingly, a competitive advantage. Buyers and vendors who move now will be building the compliant, secure-by-design fleets that regulators and customers will expect for the rest of the decade.