For Ukrainian telecom companies planning expansion into the EU market or already integrated with European operators, compliance with the NIS2 cybersecurity directive has become a strict structural prerequisite for doing business. Today, European regulators and partners assess the resilience of counterparty infrastructure as a critical factor for market access.
For CEOs and CFOs of telecom providers, NIS2 requirements directly impact the preservation of export revenue. Non-compliance threatens not only regulatory fines but also exclusion from cross-border service supply chains. The main obstacle to passing a European audit is often outdated monolithic Business and Operations Support Systems (BSS/OSS), which cannot provide granular access control and security perimeter isolation.
NIS2 as a new entry barrier: why European telecom is closing doors to legacy systems
In the Threat Landscape 2025 report, the European Union Agency for Cybersecurity (ENISA) analyzed 4,875 cybersecurity incidents between July 1, 2024, and June 30, 2025. The data highlights high regulatory stakes: 53.7% of all affected organizations belonged to essential entities covered by NIS2.
Telecom operators are under intense regulatory scrutiny due to the massive impact of their infrastructure. If a Ukrainian provider is connected to a partner network in the EU via insecure legacy interfaces, it automatically becomes a vulnerable link. For financial and technical leadership, this means that investments in architectural security modernization are capital expenditures essential for maintaining partnership contracts.
Anatomy of vulnerability: why monolithic BSS/OSS fail to meet directive requirements
Traditional monolithic BSS/OSS were designed for environments with a closed local perimeter. Billing, CRM, tariffing, and provisioning often function around a single database without internal isolation. The primary problem with such architecture is the maximum blast radius. If an attacker gains initial access (e.g., via phishing) to a secondary module, they potentially gain control over the entire system.
Critical shortcomings of monoliths in the context of NIS2 include:
- Lack of granular access separation at the microservice and data levels.
- Absence of centralized, tamper-proof system event logging, making timely audits and incident investigations impossible.
- Reliance on hard-coded (point-to-point) integrations instead of standardized, authenticated API.
Architectural transition: Open Digital Architecture (ODA) as a security foundation
The only sustainable solution is a phased departure from the monolith in favor of a component-based, API-first architecture. The TM Forum consortium defines the Open Digital Architecture (ODA) standard, which replaces monolithic BSS/OSS with loosely coupled components. It is important to note that implementing ODA does not automatically guarantee NIS2 certification, but it creates the necessary technological foundation to meet cybersecurity requirements.
Practical transition steps include:
- Refactoring billing systems into microservices. Isolating critical modules (e.g., payment processing from content management) allows the system to continue functioning safely even in the event of local compromise.
- Transitioning to Open API. Inter-system connections are routed through an API Gateway with mandatory mutual authentication, ensuring visibility and control over OSS traffic.
- Centralized Identity and Access Management (IAM). Implementing a unified multi-factor authentication system and Role-Based Access Control (RBAC) at the BSS level.
To build such a foundation without destructively replacing all base software, it is advisable to use reliable platform solutions. For example, the UnityBase platform (a joint development by Intecracy Group companies, with InBase as the key developer) allows operators to create secure integration layers over existing legacy systems. Thanks to built-in mechanisms such as automatically generated secure REST API, RBAC, Row-Level Security (RLS), and detailed audit trails, architects can deploy NIS2-compliant interfaces for integration while maintaining business process continuity.
Protecting signaling protocols and countering fraud
Beyond BSS/OSS, European audits focus on protecting signaling traffic. In the Threat Landscape 2025 report, ENISA specifically highlights the risks of exploiting outdated signaling protocols, such as SS7 and Diameter, which are often used without proper authentication and encryption.
According to the CFCA Global Fraud Loss Survey 2025, global losses from telecom fraud reached an astronomical $41.82 billion. Vulnerable signaling networks remain the primary tool for spoofing and traffic interception. To meet security criteria, operators need platforms that combine routing with built-in control and fraud protection.
Within the Intecracy Group portfolio, an example of this comprehensive approach is DooxSwitch, a carrier-grade VoIP platform that integrates softswitch, real-time billing, and intelligent routing (LCR). Its architecture allows operators to control voice and IoT/M2M traffic at the carrier level, ensuring high availability and minimizing the risk of financial losses from fraud, which aligns with the spirit of NIS2 infrastructure resilience.
Telecom infrastructure readiness scale for NIS2 security requirements
| Readiness level | BSS/OSS architecture and protocols | Access control and integration |
|---|---|---|
| Level 0: Monolithic | BSS/OSS is a single monolith; insecure SS7/Diameter protocols are used. | No centralized access audit. |
| Level 1: Fragmented | Microservice transformation initiated. | Basic API monitoring, partial user activity logging. |
| Level 2: Standardized | TM Forum Open API implemented; critical billing perimeters isolated; signaling traffic encrypted. | All integrations authenticated (API Gateway), centralized audit. |
| Level 3: NIS2-Compliant | Full ODA compliance. | Automated incident detection, Zero Trust between systems. |
The economics of compliance
For telecom providers, investments in transitioning to ODA and secure API are mathematically justified. The NIS2 directive applies strict sanctions to violators (heavy fines or a ban on operations within the EU jurisdiction), and losses from fraud via insecure signaling protocols can wipe out company capital in days. Modernizing BSS/OSS systems through the implementation of modern platforms and microservices minimizes these risks and guarantees a stable position in the European market.
FAQ
What fines does the NIS2 directive impose on telecom operators for non-compliance?
For essential entities, the directive provides for significant administrative fines, which can reach 10 million euros or 2% of the company's total annual global turnover, whichever is higher.
How does the Open Digital Architecture (ODA) standard help meet cybersecurity requirements?
ODA involves transitioning from monolithic BSS/OSS to a component-based, API-first architecture. This allows for the isolation of critical modules (e.g., billing), reducing the blast radius during incidents and ensuring granular access control for every function.
Is it mandatory to completely replace billing systems to meet European security standards?
No, a complete abandonment of existing systems is not immediately required. Phased modernization is possible by deploying a secure API integration layer over existing software (e.g., using the UnityBase platform) to implement centralized auditing and authentication.