A method and apparatus for managing service lists receives a service list and a security layer identifier at a device. The service list comprises at least two service identifiers. The method and apparatus determines whether the security layer is authorized for the device, and, for each service identified in the service list, when the security layer is authorized for the device the method and apparatus acquires each service in the service list that is not already installed in the device and enables each service in the service list that is not already enabled in the device.