I was involved in some RF*s on Amdocs side for a bunch of telecoms in USA, Europe and Asia a few years ago. Security requirements were very long and rather rea

I was involved in some RF*s on Amdocs side for a bunch of telecoms in USA, Europe and Asia a few years ago. Security requirements were very long and rather reasonable, to a point that it was pain in the ass to follow all of it. Part of what we had to submit was deployment architecture that included security architecture that was reviewed by security teams. We also had some meetings with security teams which were more like serious interrogations (they just could go with waterboarding to speed up things). We even had as result of those discussion to alter somewhat product architecture (not "lets stick in tls". actual changes in how system works and interacts) in order to enable more secure deployment and operations. But those were Tier 1 telecoms. Smaller one probably less strict but I don't know as I didn't deal with them