Newsletters

Earlier this year, the CRA Working Group submitted technical feedback on key draft CRA standards, prEN 18330, prEN 40000-1-3 and prEN 50764 and published a blog outlining TCA’s observations and feedback.

Currently, the Working Group has a number of initiatives underway. Members are exploring a formal liaison between TCA and CEN TC 224 WG 17. This is the CRA-related Working Group leading the development of harmonized standards for essential cybersecurity requirements affecting hardware devices, with its scope covering identity management systems, privileged access management software, and authentication and access control readers. TCA’s  CRA Working Group is also exploring a partnership with ETSI for the purpose of greater engagement on harmonised standards for critical products. Alongside this, the Group has developed a proposal for CEN-CENELEC for the creation of a guidance document for the application of the CRA standard to eUICCs. Finally, the Working Group is commencing development of a white paper which will highlight the applicability of the CRA guidance to the wider telecoms industry.

The eUICC Working Group continues to evolve the TCA eUICC Profile Package: Interoperable Format (IPP) Technical Specification – which is used in every single eSIM deployed in the field to standardise the format for remotely loading eSIM profiles – to meet new market requirements.

Development of Version 3.5 of the IPP Technical Specification is ongoing. Expected to be published in Q3 2026, the latest version focuses on supporting 3GPP Release 19, including the MILENAGE-256 algorithm set. Due to ongoing discussions and engagement, including with relevant groups within 3GPP and GSMA, support for Long Term Key Update Process (LTKUP) will now be addressed in Version 3.6.

The associated IPP Test Specification provides globally standardised test cases to ensure the eSIM profile is correctly loaded. It is integrated into the GlobalPlatform-approved test suite, which is part of the GSMA Consumer and IoT eSIM compliance programmes and referenced in GSMA’s Test Specifications.

In February 2026, the group published Version 3.4 of the IPP Test Specification, enabling the testing products which implement Version 3.4.1, Version 3.3.1, Version 3.2, Version 3.1, Version 2.3.1, Version 2.2, or Version 2.1 of the IPP Technical Specification. The latest Test Specification contained 22 new test cases, and is expected to be referenced in the latest GSMA Consumer and IoT Test Specifications.

The group is now developing Version 3.5 of the Test Specification to address implementations based on Version 3.5 of the corresponding Technical Specification. It is expected to be published in 2026.

A key focus of the Interoperability Working Group in 2026 has been exploring opportunities to enhance eSIM applet security. Various educational resources have been released outlining the key security recommendations from Stepping Stones for Java Card Developers to ensure eSIM applet assets are sufficiently protected. The group has also been engaging with industry partners – including GSMA and GlobalPlatform – to identify secure and efficient approaches to Java Card applet vetting.

In parallel, the TCALoader tool has been updated to add Bitecode Verification (BCV) execution for packages compiled by the tool and to include a notice to the user to only download packages that satisfy the BCV. The updated tool is expected to be released in 2026.

Elsewhere, the group is working on the latest instalment of its acclaimed ‘Stepping Stones’ series to provide recommendations for increasing interoperability between the eUICC and eIM. The aim is to publish the paper by the end of 2026.

The IoT Remote SIM Provisioning Working Group is now finalising a technical paper exploring the SGP.32 ecosystem. The paper outlines the considerations posed by architectural changes, the introduction of new entities, new and inherited concepts, and key data exchanges; offers technical guidance to address key operations and deployment scenarios; and explains the role of the supporting testing and compliance programme.

The paper is due to be published in Q3 2026.

In May, the Sustainability Working Group published the first industry-led, common lifecycle assessment methodologies to provide developers with a consistent and reliable approach for determining the environmental impact of SIM and eSIM products.

Looking ahead, TCA is committed to evolving and enhancing the methodologies to proactively address market and regulatory developments. All organisations across the SIM and eSIM industry committed to climate leadership are encouraged to participate in the Sustainability Working Group to play a proactive role in shaping their ongoing development.

Read our blog to learn about TCA’s position relative to the CRA and the key considerations we have raised for policymakers and standardisation bodies to support the correct and consistent mapping of secure element (SE) technologies to CRA obligations here.

To provide developers with a consistent and reliable approach for determining the environmental impact of SIM and eSIM products, TCA has published the first industry-led, common lifecycle assessment methodologies. The methodologies are available to TCA members here and can also be accessed by any industry participant by contacting info@trustedconnectivityalliance.org.

Download this infographic to learn how TCA’s common lifecycle assessment methodologies provide a consistent and reliable approach for determining the environmental impact of SIM and eSIM products here.

Download our infographic to view the key security recommendations from Stepping Stones for Java Card Developers to ensure eSIM applet assets are sufficiently protected here.