The UK Telecoms Supply Chain Review 2019 identified the need to establish an enhanced legislative framework for telecoms security, which was introduced through the Telecommunications (Security) Act 2021.
The Telecommunications (Security) Act 2021 (the ‘2021 Act’) amended the Communications Act 2003 (the ‘2003 Act’) to establish a new telecoms security framework to improve the security and resilience of public telecoms networks and services.
The 2003 Act, as amended, includes:
- Overarching security duties on public telecoms providers to identify and reduce the risk of security compromises occurring, prepare for the occurrence of security compromises, prevent adverse effects arising from a security compromise that has occurred, and to remedy or mitigate such adverse effects.
- Powers for the Secretary of State to make regulations setting out specific security measures to be taken by public telecoms providers.
- Powers for the Secretary of State to issue codes of practice giving guidance on the measures to be taken by public telecoms providers to meet their legal obligations.
- Provisions to ensure the telecoms regulator, Ofcom, can effectively monitor and enforce public telecoms providers’ compliance with their legal obligations under the 2003 Act (as amended).
The Electronic Communications (Security Measures) Regulations 2022 (the ‘Regulations’) and the Telecommunications Security Code of Practice (the ‘Code of Practice’) were established using these powers.
They are intended to address risks to the security of the UK’s public telecoms networks and services. They have been developed in conjunction with the National Cyber Security Centre (‘NCSC’), the UK’s national technical authority for cyber security, and Ofcom, the telecoms regulator.
The Regulations came into force on 1 October 2022. They set out specific security measures that public telecoms providers must take in addition to the overarching legal duties in sections 105A and 105C of the 2003 Act (as amended by the 2021 Act).
The Code of Practice was issued in December 2022. It provides detailed guidance to large and medium-sized public telecoms providers (i.e. those with a relevant turnover in the relevant period of more than or equal to £50 million) on the government’s preferred approach to demonstrating compliance with the duties in the 2003 Act and the requirements within the Regulations.
In July 2026, the Revised Telecommunications Security Code of Practice 2026 (version 1.1) was published. This document provides up to date guidance addressing risks posed by evolving security threats and new innovations in telecoms technology.