[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract

TELECOM & CONNECTIVITY

Your network runs on software you do not control. Prove it can be recovered and brought back into operation

Telecom operators worldwide depend on third-party BSS, OSS and network-management software from vendors they do not control. Castler independently rebuilds those vendor applications and produces signed Proof of Recovery — supporting cyber-security and critical-infrastructure resilience obligations across every major regulatory jurisdiction.

ISO 27001SOC 2 Type IICERT-InPCI DSS

TELECOM SOFTWARE ESTATE

Independent recovery evidence by critical layer

01BSS · charging
RECOVERY PATH
02OSS · assurance
RECOVERY PATH
035G · orchestration
RECOVERY PATH

SIGNED OUTPUT

Proof of Recovery · per vendor · per verified release

THE PROBLEM

When a BSS or OSS vendor fails, the dependent operation stalls

Telecom operators have digitised every layer of the network, from subscriber charging to network assurance. Each critical function depends on software, specialist knowledge and release artefacts held by a third-party vendor.

Vendor insolvency

A billing platform vendor enters liquidation. Prepaid top-ups, post-paid billing and roaming settlement face disruption while the operator reconstructs the system from incomplete documentation.

Acquisition or discontinuation

A foreign OSS vendor is acquired and the regional product variant is discontinued. The operator must migrate a critical system without a tested independent recovery path.

Cyberattack on the vendor

A ransomware incident disables a network-management supplier. Operational visibility degrades while the vendor restores its own environment and the operator waits for support.

THE REGULATORY MANDATE

Telecom resilience is a critical-infrastructure obligation — in every jurisdiction

Regulators across the UK, EU, Singapore, Australia, the Middle East and India classify telecom as critical national infrastructure. Recovery obligations — including third-party software continuity, incident response, and cyber-security controls — are mandated under frameworks including EU NIS2, DORA, the UK PRA's operational resilience rules, MAS TRM, APRA CPS 230, and India's NCIIPC and CERT-In directions.

EU NIS2 Directive

Art. 21 — security measures for essential entities including network providers

Proof of Recovery + Deployment Runbook

MAS TRM (Singapore)

§9 — independent vendor recoverability expected

Proof of Recovery per vendor

THE SOLUTION

One signed Proof of Recovery per vendor. Per verified release

Castler's agentic verification engine rebuilds critical telecom software in a clean environment without depending on the vendor's operating team. A named Castler engineer reviews the evidence and signs the resulting recovery pack.

01

BSS and revenue assurance

Billing platforms, charging systems and fraud-management software kept current in custody and backed by release-specific recovery evidence.

02

OSS and network management

Network-management, spectrum, inventory and fault-management platforms covered as part of the operator's critical Software Estate.

03

5G core and orchestration

Cloud-native network functions, orchestration layers and SDN controllers verified against the declared production architecture.

REPRESENTATIVE PROGRAMME

A practical path from vendor inventory to signed recovery evidence

This is an illustrative telecom remediation model, not a claimed customer engagement. Scope and timelines depend on application complexity, deposit quality and vendor cooperation.

01

Map the critical estate

Prioritise BSS, OSS, charging, assurance and orchestration systems by operational consequence and vendor dependency.

02

Establish current custody

Bring source, configuration, infrastructure definitions and documentation into controlled custody with an agreed update cadence.

03

Verify and sign

Rebuild and deploy each release independently, close deposit gaps and issue the signed Proof of Recovery pack.

OUTPUT PACKBuild ReportDeployment RunbookReplication ReportSBOMSigned Proof of Recovery

TELECOM & CONNECTIVITY

Map the telecom Software Estate to the recovery evidence it needs

Bring your critical BSS, OSS and network-management vendor estate. We will map custody, verification and signed evidence in a 15-minute briefing.

Book a 15-min briefing
ISO 27001SOC 2 Type IIPCI DSS

No spam · Reply within one business day