Argentina sets supply-chain rules for telecom gear bought by the state

Argentina sets supply-chain rules for telecom gear bought by the state

6 November 2026: Argentina's National Cybersecurity Centre (CNC) has approved technical requirements for the security of the supply chain behind equipment used in critical telecom networks, and made them mandatory for the national public sector. Disposition 7/2026, signed by the centre's executive director Walter Fabián Agüero and published in the Boletín Oficial, applies to hardware, software and firmware, and to procurements started 90 days after it took effect, which puts the start in early February 2027.

Not yet independently verified. We read the disposition's text as reproduced by CIRA, not on the Boletín Oficial site itself, and we have not read Annex I, which holds the criticality levels and certification rules. The TIA SCS 9001 requirement for high and critical equipment, and its effect on particular vendors, are as reported by DPL News. We will update this when it can be confirmed, and remove this note.

Who has to follow the requirements

Article 2 makes the requirements binding on the national public sector as defined in Law 24.156, including state companies and corporations, when they buy, contract, install and operate equipment for critical telecom infrastructure. Contracting bodies must write the requirements into their tender conditions and contracts, and base any demand for certification or assessment on how critical the equipment is.

For everyone else the text is explicit: the requirements create no direct obligations for people or companies outside the national public sector. They reach suppliers and operators only in three ways: through public-sector tenders and contracts, through rules that the telecom regulator ENACOM may adopt within its own powers, or by voluntary adherence. For private buyers the requirements are a reference standard and adoption is optional.

That makes the practical audience three groups. Vendors and resellers bidding for public telecom contracts will meet the requirements in tender documents. State-owned operators must apply them to their own buying. Private operators and equipment makers face them only if ENACOM folds them into equipment approval or licensee duties.

The timetable the disposition sets

The disposition took effect the day after publication, so 7 November 2026. It then starts several clocks:

• Criticality levels within 90 days. Article 4 gives the CNC 90 days, after consulting the Cybersecurity Committee, to identify critical information infrastructures and assign a criticality level to each category of equipment covered. The categories and their levels will be published in the Boletín Oficial; only the named list of installations may be kept confidential and notified to the operators concerned. Until a category has its level, a provisional level from point 2.4 of Annex I applies.
• A control map within 90 days. Article 5 asks the CNC to publish, in the same period, a correlation matrix between the requirements and existing public-sector security rules, using the NIST Cybersecurity Framework, NIST's supply-chain risk guidance and ISO/IEC 27001 as reference points.
• New tenders after 90 days. Article 7 applies the requirements to acquisition or contracting procedures that begin 90 days after entry into force. Equipment already installed is subject only to adaptation measures under chapter 5 of Annex I, set according to its criticality, exposure, life cycle, available support and risk, with deadlines that the text calls reasonable and that depend on the responsible body's budget.

Ninety days from 7 November is 5 February 2027, the date the cooperatives federation Fecosur names in its response, according to DPL News.

Why TIA SCS 9001 is named

The preamble explains the choice of standard. It says the text refers to TIA SCS 9001 because that standard is a supply-chain security management scheme for information and communications technology that third parties can certify, and that assesses the manufacturer's processes across the whole chain. Product security evaluations such as Common Criteria (ISO/IEC 15408) or NESAS/SCAS, it argues, check a given product and are not equivalent for this purpose. DPL News reports that equipment rated high or critical will need a supplier showing that the manufacturer holds a TIA SCS 9001 certified management system.

The preamble also notes that if ENACOM made the requirements compulsory for equipment approval, notification under article 2.9 of the WTO Agreement on Technical Barriers to Trade and consistency with Mercosur rules would first have to be assessed.

What ENACOM may do next

Article 9 sends the disposition to ENACOM to consider adding the requirements to equipment approval and to the obligations of telecom licensees. The preamble points to the regulator's equipment and materials register, RAMATEL, whose new rules were postponed to 1 December 2026 by ENACOM Resolution 843/26, as the natural place to do that for equipment sold in the country. The disposition is also sent to the national procurement office so it can be built into standard tender documents.

That step is where industry has pushed back. According to DPL News, Fecosur and the cable television association ATVC have asked ENACOM not to adopt the requirements for equipment approval without a public consultation, warning about the effect on connectivity in Argentina's interior, and want a working group before 5 February.

For suppliers to Argentina's public sector

A vendor selling network equipment to a ministry, an agency or a state company should expect tenders opened from February 2027 to ask for supply-chain evidence scaled to the criticality level the CNC assigns. The levels themselves are due in the Boletín Oficial within the same 90 days, so the categories that will require third-party certification of the manufacturer are not yet public. The disposition leaves Disposition CNC 1/26 on operational continuity unchanged and does not exempt suppliers or operators from the existing public-sector security requirements of Administrative Decision 641/21.

Sources

• CIRA: Disposición 7/2026 of the Centro Nacional de Ciberseguridad, text as published in the Boletín Oficial (Spanish), 6 November 2026, 6 November 2026
• DPL News: Argentina sets cybersecurity requirements for telecom equipment supply chains (Spanish), 6 November 2026, 6 November 2026
• DPL News: Fecosur warns new cybersecurity requirements put connectivity in the interior at risk (Spanish), 10 November 2026, 10 November 2026