As part of the agreement, TMobile has to harden IT security and show proof (e.g., CISO who reports regularly to feds, adoption of Zero Trust, adoption of minimal data retention policy). Why TMobile must have their hand held like this is beyond me.