A concept/framework not a distribution ?

Hello,
Let me first introduce myself:
I am Manager for Information Security and Data Protection/Privacy at a Telco
in Germany.

An outfitter of some of our new VoIP Equipment answered to my question about
system-Security and hardening,
that i must not be worried about it why they are using Carrier-Grade-Linux
and it is high-secure by design.
I search along the internet and googled a little about CGL and came to the
conclusion,
that CGL is not a distribution but a framework or better a sum of
requirements a distribution have to meet to be a Carrier-Grade-Linux.
And so the security part have to be done from the "distribution"
Can some untangle that for me ?

With kind regards
Holger