hich PDU session/application. This is enabled by network slice selection policies (NSSPs) that the PCF provides to the UE based on operator policies. This mechanism provides operators with fine-grained control to ensure that specific applications running on the UE are served by the right network slice. In summary, 5GS network slicing is an incremental next step that builds on top of con- cepts that were already introduced in earlier 3GPP system generation. 5GS network slic- ing increases deployment flexibility and isolation for session-related network functions, extends slicing into the RAN, and provides operators with new UE policies to influence the selection of network slices that applications running on the UE should be associated with. 3.2.7 Private Networks 3.2.7.1 Overview Private networks address various use cases, for example, to enable 5G-based industrial automation for which hosting the entire network on site (e.g. in a factory) is key to 3 5G System Overview addressing data privacy needs and reliability concerns of many industries or to provide private cellular network coverage in rural or even offshore scenarios. Tools to enable 5G-based private networks were added in different releases. Release-15 focused on authentication for private networks and added support for the Exten- sible Authentication Protocol (EAP) (Aboba et al. 2004). EAP is a framework that enables private networks to use authentication methods other than the cellular network-specific 5G Authentication and Key Agreement (5G AKA) and SIM cards for storage of the related identifiers and credentials (3GPP TS 33.501, 2019). Based on the EAP framework, private networks can for instance use the EAP-TLS method to leverage certificates for mutual authentication (for an illustration of EAP-TLS for 5GS, see Annex B of 3GPP TS 33.501, 2019). Support of EAP-TLS is especially beneficial if 5G is added as another networking technology in scenarios where certificate-based authentication is already used, for example, EAP-TLS for device authentication