Mavenir Secures First BSI NESAS 5G Core Certification, Full Portfolio by Q3 2026

Germany’s push to harden critical telecom infrastructure reached a milestone as Mavenir’s 5G core function clears the BSI’s rigorous NESAS evaluation. This certification isn’t just a regulatory checkbox—it’s a blueprint for embedding security by design in the 5G core, and it will shape procurement decisions across Europe’s surveillance-conscious market.

The certification of Mavenir’s 5G Packet Core Network Repository Function (NRF) under Germany’s BSI NESAS scheme marks a turning point in telecom security compliance. On June 15, 2026, Mavenir announced it had become the first tier-1 network software infrastructure provider to receive the BSI NESAS cybersecurity certificate for a critical 5G core network component. The achievement not only validates the company’s cloud-native, AI-driven software design but also signals a new era in which national security mandates directly shape procurement in the telecom supply chain.

“

The certification of Mavenir’s 5G Packet Core Network Repository Function (NRF) under Germany’s BSI NESAS scheme marks a turning point in telecom security compliance.

The NESAS (Network Equipment Security Assurance Scheme) framework, jointly developed by 3GPP and GSMA, was adopted by Germany’s Federal Office for Information Security (BSI) as a cornerstone of its Telecommunications Act (TKG) and BSI Act (BSIG) amendments. Effective January 1, 2026, these laws require that all critical components deployed in public 5G networks hold a BSI NESAS certificate, covering both the product’s security properties and the vendor’s development and lifecycle processes. By securing this first certification, Mavenir positions itself at the forefront of a regulatory wave that is likely to sweep across Europe and beyond.

The NRF is a foundational element of the 5G Service-Based Architecture, responsible for service discovery and registration—making it a high-value target for threat actors. Fabian Hodouschek, Head of Certification at BSI, underscored the national security stakes, stating that the certificate “makes an important contribution to securing Germany’s mobile telecom networks.” The endorsement removes a significant barrier for mobile network operators (MNOs) that must now prove their vendors meet these standards before deployment. For Mavenir, this translates into a clear first-mover advantage in one of the world’s most security-conscious telecom markets.

Mavenir’s ascendancy is rooted in its software-centric, cloud-native approach. Unlike legacy hardware vendors, Mavenir builds network functions as containerized microservices designed to run on generic cloud infrastructure. This architecture inherently aligns with the NESAS process, which scrutinizes secure development, testing, and patching workflows. Omar Shahdad, Mavenir’s SVP of Operations, noted that the certification validates the company’s ability to meet “the most rigorous national cybersecurity standards” while delivering industry-leading 5G software. The achievement also answers lingering questions about whether virtualized, software-only cores could satisfy state-level security regimes—a doubt that has slowed cloud adoption in critical telecom environments.

The certificate currently covers only the NRF, but Mavenir is racing to complete certification for its full Packet Core and IP Multimedia Subsystem (IMS) portfolio by the end of Q3 2026. That timeline is ambitious but critical: competitors such as Ericsson, Nokia, and emerging Open RAN players will view the NRF certification as a template and accelerate their own applications. The gap between Mavenir’s first-mover status and its full-portfolio coverage represents both a window of competitive differentiation and a risk if delays emerge. Should Mavenir meet its Q3 target, it will become the only major software vendor with a completely certified 5G core suite under Germany’s rules, potentially locking in operator relationships for years.

Beyond Germany, the implications ripple outward. The European Commission’s 5G Cybersecurity Toolbox has urged member states to impose stricter requirements on equipment vendors, and the BSI NESAS model is viewed as a benchmark. Countries such as France, Italy, and the Netherlands have been monitoring Germany’s implementation closely. A BSI certificate could therefore serve as a passport for Mavenir to other European tenders, reducing duplicative audits and lowering time-to-market. For operators, choosing pre-certified software becomes not just a compliance exercise but a strategic risk-management decision.