Insights
IoT SIM supplier evaluation checklist: questions to ask before you sign
Use a published checklist, and know its limits
GSMA CLP.14 describes itself as a checklist for supplier agreements between IoT service providers and their network operator partners. It is non-binding, national law can overrule it, and it leaves the security of CMP data-sharing APIs to general best practice.
If your supplier is not itself the network operator, ask which answers come from the upstream operator and which from the supplier, and who is accountable for each. Keep the answers with the contract.
Subscription scope and least privilege
CLP.14 recommends assessing which services an IoT service needs and provisioning only those. Its examples include data-only subscriptions without voice or SMS, limiting devices that talk to one platform to known IP ranges or domains, and fixed dialling lists where voice or SMS is used.
Ask for the written service scope of each plan and whether unused services and open internet access can be excluded. A narrower subscription reduces both misuse risk and unexpected charges.
Card, remote management and eSIM evidence
CLP.14 says operators should support remote over-the-air management of the UICC following ETSI and 3GPP specifications, and should offer non-removable machine form factor UICCs where devices face physical tampering. Ask which OTA functions are available and what the device must support for them to work.
Ask for the exact card format and its ETSI TS 102 671 environmental class string. For eSIM, ask which GSMA specification and version the device and service support, and check its status on the GSMA index, which distinguishes active versions from those with an expiry date.
Networks, roaming and device behaviour
GSMA explains that roaming relies on commercial agreements and that visited networks differ in bands, IP version and power-saving parameters. Request a per-country list of usable networks and technologies, the roaming arrangement and any limits on long-term use.
CLP.14 also notes that operators can monitor devices and isolate those generating excessive signalling or interference. Ask how you would be notified, what triggers a suspension and how service is restored, so a firmware fault does not silently take a fleet offline.
The eight questions and the evidence to request
Send these questions with your device model, countries and quantities. Quanqiu IoT answers them per project in writing; nothing on this page states that a particular plan includes a given function.
| Question | Evidence to request |
|---|---|
| Which services does each subscription include (data, SMS, voice)? | Written service scope per plan; confirmation that unused services can be excluded |
| Can traffic be limited to our platform IP ranges or domains? | Description of the allowlist option and how it is changed |
| Is remote (OTA) management of the UICC supported? | The OTA scope and the specifications it follows |
| Which card format and environmental class is offered? | Format and the ETSI TS 102 671 class string of the exact card |
| For eSIM, which GSMA specification and version? | Specification, version and its current status |
| Which networks and technologies are usable in each country? | Per-country list; roaming arrangement and any long-term-use limits |
| How are misbehaving devices handled? | Notification and suspension procedure, contacts and timelines |
| How is CMP access protected? | Encryption, password policy, multi-factor options and user roles |
Frequently asked questions
Does a supplier have to comply with GSMA CLP.14?
No. CLP.14 is a non-binding GSMA guideline written for network operators. Its value for a buyer is as a structured list of questions to include in a supplier agreement.
Why exclude SMS or voice if our devices only use data?
CLP.14 recommends least privilege: provision only the services the IoT service needs. Removing unused services narrows the ways a subscription can be misused.
What evidence should I ask for about eSIM?
Ask which GSMA eSIM specification and version the device and service support, then check its status on the GSMA specification index, which separates active versions from expiring ones.
Official references
Related reading
More insights
Send your device model, countries, quantities and these eight questions to Quanqiu IoT for written answers.
Discuss your project