Sector · Telecommunications

The network is critical. So is the provider.

An operator keeps traffic and subscriber data that describes people. The choice of host determines which law can be invoked to reach it.

What we see

  • OSS and BSS were assembled over twenty years. Replacing one piece means documenting interfaces nobody had opened in a long time.
  • Traffic and billing records are kept for extended periods for operational and compliance reasons. That duration moves the question of where they sit and which law applies.
  • Network teams and systems teams do not work to the same cycles. A network maintenance window is not negotiated the way a server update is.
What is at stake

Outages are counted. So is dependency.

01

Service continuity

An interruption is measured in affected customers and contractual obligations. Management platforms have to survive the loss of a region without manual intervention.

02

Confidentiality of communications

Communication content and metadata fall under protection regimes of their own. Choosing a hosting provider therefore commits more than performance and price.

03

Reversibility

An operator whose directory, mail and productivity suite sit on a single stack follows that vendor’s calendar. A Canadian federal framework on the protection of critical cyber systems would cover telecommunications; its status is worth checking before treating it as a planning assumption.

What we do

Reproducible environments. Exits that exist.

01

Multi-region Azure landing zone

Networking, identity, quotas and policy are written as Infrastructure-as-Code, with one definition covering every region. Losing a region does not require rebuilding by hand.

02

AI agents on network incidents

Eight weeks to put an agent into service on tickets, intervention logs and equipment documentation. The boundary with the NOC is written down: the agent prepares, it does not decide.

03

Microsoft 365 Copilot across large workforces

The programme follows a classification of document spaces, carried out before licences are assigned. Spaces holding subscriber data stay excluded until their regime is settled.

04

WIN TO LUX

Migration from Windows Server to Linux and from Active Directory to FreeIPA, in waves, starting with infrastructure servers. The schedule uses existing network maintenance windows rather than creating new ones.

Applicable frameworks

Three texts. One question.

FISA 702

This US surveillance regime applies to electronic communication service providers. An operator entrusting subscriber data to such a provider has to account for it in its risk analysis.

NIS 2

The European directive places risk management and incident notification obligations on covered entities, electronic communications among them. Responsibility sits with management bodies, not only with the security team.

Law 25 (Quebec), section 17

Since September 2023, transferring personal information outside Quebec requires a documented assessment of the legal regime of the receiving state. For a US provider, that means documenting CLOUD Act exposure.

Start by seeing

No follow-ups. A written answer.

Send us the question holding up a hosting decision and we will answer with the relevant texts cited.

See your external surface