Argentina adopts TIA SCS 9001 for critical state telecoms equipment

Argentina adopts TIA SCS 9001 for critical state telecoms equipment

In brief

  • Disposition 7/2026 of Argentina's Centro Nacional de Ciberseguridad (CNC), published on 6 November 2026, approves supply chain security requirements referencing the TIA SCS 9001 standard.
  • It is mandatory for the national public sector and only indicative for private parties, but asks Enacom to consider building it into type approval and licensee obligations.
  • Its real reach will depend on the equipment categories the CNC must define within 90 days and on Enacom's decision.

On 6 November 2026, Argentina’s Boletín Oficial published Disposition 7/2026 of the Centro Nacional de Ciberseguridad (CNC), approving technical supply chain security requirements for equipment used in critical telecommunications infrastructure. It matters because it brings into the country a US industry reference that has already shaped regulatory debates elsewhere in the region.

What the disposition sets out

The text is dated 5 November 2026 and signed by the CNC’s executive director, Walter Fabián Agüero. Under its article 8 it takes effect the day after publication. The requirements are mandatory for the national public sector, including state-owned companies, when they buy, install or operate this equipment. For everyone else they are indicative and voluntary.

The reference point is the SCS 9001 standard of the Telecommunications Industry Association (TIA), a supply chain security management system with third-party certification. The annex requires suppliers to show that the manufacturer holds that certification. The recitals explain that it assesses how a manufacturer works across its whole supply chain, unlike schemes that review a single product. Trade press reports that the annex sets four criticality levels (critical, high, moderate and low), with certification required for the first two.

The CNC has 90 days from entry into force to identify the critical infrastructures and equipment categories covered, which will be published in the Boletín Oficial. Within the same period it must publish a correlation matrix with the US NIST Cybersecurity Framework and ISO/IEC 27001. The text names no companies and does not exclude manufacturers by nationality.

A possible second step: Enacom

Article 9 refers the measure to the Ente Nacional de Comunicaciones (Enacom), asking it to consider building these requirements into equipment type approval and the obligations of ICT licensees. There is no direct obligation on private operators today, but extension by Enacom would change that considerably. According to TeleSemana, Chinese-origin equipment accounts for around 40% of Argentine networks, and Enacom said it had nothing to report for now.

The regional context

TeleSemana links the measure to earlier experiences: Costa Rica included the TIA standard in its 5G tender and Paraguay applied similar rules in its auctions. It also recalls the US announcement of 22 October of USD 15 million to fund a cybersecurity operations centre linked to the CNC. That outlet argues there is a US policy of influence over digital infrastructure; other media note there is no public evidence of US involvement in drafting this disposition.

Our view at CEA Digital Law

Supply chain security is a legitimate goal, and Argentina approaches it with a narrow-scope measure and a stated risk-based approach. Several open questions deserve transparent answers.

First, technological neutrality. Europe has chosen to assess supplier risk through its own tools, such as the EU 5G toolbox and national cybersecurity frameworks. A foreign private certification as the sole benchmark may sideline equivalent schemes such as NESAS/SCAS or Common Criteria. We hope the 90-day correlation matrix recognises equivalences and open accreditation routes.

Second, proportionality and competition. If Enacom extends the requirement to type approval, cooperatives and small operators with less capacity to adapt would be affected. We suggest prior public consultation, transition periods and an impact assessment on costs and competition.

Third, regional coherence. Costa Rica, Paraguay and now Argentina show the value of sharing technical criteria among Latin American regulators, including to negotiate on clear terms with any supplier and country. African states digitalising their networks can also learn from this pattern: define criticality categories early, publish objective criteria and keep sensitive information confidential.

Sources

CEA Digital Law

Lettre d’information

Événements, actualités et analyses sur le droit numérique, dans votre boîte de réception. Seulement quand il y a quelque chose à dire.

Poursuivre la lecture