Who Controls Your Connectivity? The Infrastructure Risks Behind the FCC's Proposed Rules

A utility can secure its control systems and still depend on a communications provider whose remote access practices it barely understands. A bank can buy redundant circuits that share an underlying facility. For organizations running essential services, the security of the communications network is part of their own ability to keep operating. 

The Federal Communications Commission's draft changes to international Section 214 authorizations bring those dependencies into sharper focus. Released for tentative consideration at the Commission's October 29, 2026 meeting, the item would expand scrutiny of carrier ownership, cross-border infrastructure and third-party access while establishing baseline cybersecurity expectations for authorization holders. It would also seek comment on further restrictions and security obligations.  

The practical question for customers is whether they understand the infrastructure and access relationships behind the services they buy. Answering it requires network engineering, security, procurement and legal teams to work from the same facts. 

What is the FCC considering? 

International Section 214 authorizations allow carriers to provide international telecommunications services under the Communications Act. The draft concerns applicants and holders of those authorizations, including providers operating their own facilities and providers reselling services. An enterprise does not become subject to these carrier requirements simply because it buys international connectivity. Its exposure is usually through its providers and the services supporting its operations.  

The document contains two distinct parts. The draft Report and Order describes rules the FCC would adopt if approved. The Further Notice of Proposed Rulemaking asks for public comment on additional measures that would require subsequent Commission action. As of October 12, the circulated text is a proposal for Commission consideration, not an adopted order.  

That distinction matters for investment decisions. Organizations can begin discovery and address known security weaknesses now, while reserving final compliance determinations and deadline calculations for the adopted text and implementation notices. 

What would change for carriers? 

More visibility into ownership and infrastructure: The draft would require more detailed information about facilities supporting communications across the U.S. borders with Canada and Mexico, ownership interests at a 5 percent reporting threshold and services and geographic markets. It would also require disclosures concerning specified third-party providers, including foreign adversary-controlled entities and certain access from foreign adversary countries. These requirements would make the relationships behind a telecommunications service more visible to regulators.  

Cybersecurity expectations tied to service delivery: The cybersecurity provisions would require applicants and authorization holders to certify adherence to baseline practices grounded in recognized frameworks and controls. The draft offers flexibility in implementation. It identifies an established risk management framework, such as the NIST Cybersecurity Framework, combined with practices such as CISA's Cross-Sector Cybersecurity Performance Goals or the CIS Critical Security Controls, as a route that would presumptively satisfy the requirements. It does not mandate one particular framework for every carrier.  

The proposed scope extends to facilities and systems that affect the provision of authorized services, including data centers, points of presence and private interconnection points. A carrier's security program would therefore need to account for the operational systems supporting delivery, rather than stopping at the corporate IT environment.  

Equipment restrictions that depend on authorization status: Covered List provisions deserve careful reading. The draft would prohibit all authorization holders from adding covered equipment or services within the specified scope. Applications filed and granted after the relevant effective date would face restrictions on both use and addition. Existing holders would have disclosure and certification obligations. Those distinctions do not support describing the item as a universal, immediate requirement to remove every installed product associated with a listed company.  

Reporting that follows material changes: The draft would also require notification within 30 days when material changes make previously submitted information or certifications substantially inaccurate or incomplete. Ownership transactions, new services, facility changes and changes involving specified third-party providers could therefore create reporting obligations. The FCC also proposes service commencement and discontinuance reforms and enforcement mechanisms that could affect authorization continuity.  

What remains open for comment? 

The Further Notice considers broader restrictions involving foreign adversaries, additional facilities information, cybersecurity and physical security risk management plans, incident reporting and further access and security requirements. These are proposals for a subsequent rulemaking, not obligations that would automatically take effect with approval of the accompanying Report and Order.  

Implementation timing also requires care. The draft gives existing authorization holders a one-year period after the relevant rules become effective to implement baseline cybersecurity practices, with an earlier certification requirement. New holders would need those practices in place when service begins. Some information collection requirements would await Office of Management and Budget review and FCC notices. A meeting date cannot serve as a substitute for an effective date.  

Who should be involved, and what they should own? 

The work crosses several functions. The following division of responsibility is a recommended operating model, rather than a set of roles prescribed by the FCC. Carrier authorization holders should connect it to their compliance process; enterprise customers should use it to assess provider dependencies and their own resilience. 

The CIO and CISO should agree on an executive sponsor and a single accountable program owner. Legal should determine which changes require filings, while security and infrastructure teams supply the technical evidence. Procurement should incorporate the resulting supplier requirements into contracting and renewal decisions. 

 Seven practical actions for customers 

1) Establish which services and entities are affected 

Start by establishing which services and entities are affected. Carriers should reconcile their authorization records with the facilities, providers and systems supporting those services. Enterprise customers should identify the communications services on which essential operations depend and determine which providers hold relevant authorizations. Legal counsel should establish applicability; engineering teams should establish the actual service dependencies. 

2) Trace supplier access into the network 

Supplier diligence should cover who can administer network equipment, where support access originates, which subcontractors participate and how access is approved, recorded and revoked. A contractual assurance about security has limited value if an organization cannot connect it to the systems and people capable of changing its service. 

3) Examine the connections supporting essential operations 

For critical infrastructure operators, this work should extend to the connectivity supporting control centers, remote sites and operational technology. Map the paths that permit vendor maintenance and remote administration. Verify whether a provider compromise could expose an operational environment, interrupt visibility or prevent staff from reaching equipment during an incident. These are recommended security practices, not a claim that the draft imposes new Section 214 duties on every utility or manufacturer. 

4) Prioritize changes by operational consequence 

Use those findings to prioritize architecture changes. Separate management access from ordinary service traffic where feasible. Reduce standing administrative privileges, strengthen authentication, restrict access to approved pathways and collect logs that allow investigators to reconstruct changes. Review configurations, software support status and recovery procedures for equipment whose compromise could affect multiple sites. A severity score alone cannot tell an operator which weakness would cause the greatest disruption. 

5) Give legacy infrastructure a funded replacement plan 

Legacy infrastructure requires an explicit decision. When equipment cannot support necessary controls or is no longer supported, document the exposure and assign a funded replacement plan. Segmentation and restricted access can reduce risk while that work proceeds, but their effectiveness should be tested against the actual attack paths and operational requirements. 

6) Test recovery and verify service independence 

Recovery deserves the same engineering attention as prevention. Determine whether alternate circuits share facilities, upstream providers or administrative dependencies. Test the ability to isolate compromised access, restore trusted configurations and maintain essential communications during recovery. Two contracts do not establish independence between two services. 

7) Connect operational changes to governance 

Connect security and infrastructure changes to governance. A new support provider, ownership transaction or cross-border facility should trigger a review of both operational risk and potential reporting obligations. Keep supporting evidence current so that a certification reflects the environment that exists when it is signed. 

How WWT can help 

The practical challenge is turning the FCC's proposed requirements into changes that strengthen security and keep services running. WWT brings cybersecurity, network engineering, infrastructure and automation expertise together to help customers determine where to act, what to invest in and how to validate the result. 

Establish the exposure and build the plan 

The work begins with a clear picture of the environment: which services support essential operations, who can administer the underlying systems and where supplier relationships introduce risk. WWT can help customers map those dependencies, assess gaps against their selected security framework and prioritize remediation by the consequences of a compromise or outage. 

That assessment should produce an executable roadmap. Each recommendation should identify the infrastructure or control to change, the accountable owner, the implementation dependencies and the evidence needed to demonstrate improvement. Regulatory counsel determines the legal obligations; technical teams 

establish whether the environment can support the commitments being made. 

Test whether the controls protect the service 

WWT's Advanced Technology Center allows customers to compare technologies and validate proposed designs before deploying them into production. For organizations operating essential services, testing should examine how a security change affects maintenance, connectivity and recovery. 

• Can a supplier's access be restricted without interrupting authorized maintenance?
• Does segmentation prevent a compromised management account from reaching operational systems?
• Can teams restore trusted communications when their usual administrative pathway is unavailable?

These questions give customers concrete criteria for evaluating a design. WWT's Cyber Range can also support exercises that test how technical controls and response procedures perform together, including the decisions teams must make when containment could affect service availability. 

Use the findings to guide modernization 

Testing can reveal where existing infrastructure supports stronger controls and where replacement is necessary. Those findings help customers make investment decisions based on demonstrated exposure and operational needs, with a clearer understanding of migration risks and recovery requirements. 

As the FCC resolves its final requirements, infrastructure leaders can begin this work now. Knowing who controls their connectivity, proving that access restrictions work and testing the ability to recover will help them make better decisions throughout implementation. 

Cybersecurity expectations tied to service delivery

The cybersecurity provisions would require applicants and authorization holders to certify adherence to baseline practices grounded in recognized frameworks and controls. The draft offers flexibility in implementation. It identifies an established risk management framework, such as the NIST Cybersecurity Framework, combined with practices such as CISA's Cross-Sector Cybersecurity Performance Goals or the CIS Critical Security Controls, as a route that would presumptively satisfy the requirements. It does not mandate one particular framework for every carrier.  

The proposed scope extends to facilities and systems that affect the provision of authorized services, including data centers, points of presence and private interconnection points. A carrier's security program would therefore need to account for the operational systems supporting delivery, rather than stopping at the corporate IT environment.  

Equipment restrictions that depend on authorization status

Covered List provisions deserve careful reading. The draft would prohibit all authorization holders from adding covered equipment or services within the specified scope. Applications filed and granted after the relevant effective date would face restrictions on both use and addition. Existing holders would have disclosure and certification obligations. Those distinctions do not support describing the item as a universal, immediate requirement to remove every installed product associated with a listed company.  

Reporting that follows material changes

The draft would also require notification within 30 days when material changes make previously submitted information or certifications substantially inaccurate or incomplete. Ownership transactions, new services, facility changes and changes involving specified third-party providers could therefore create reporting obligations. The FCC also proposes service commencement and discontinuance reforms and enforcement mechanisms that could affect authorization continuity.