Commentary on provisions of Act Section 6: Powers of Ofcom to assess compliance with security duties Section 105O: Power of Ofcom to give assessment notices
Subsection (2) provides Ofcom with the power to give providers an assessment notice for the purpose of carrying out an assessment under section 105N. It sets out what an assessment notice may require a provider to do. Examples include carrying out specified tests, arranging for another person to carry out specified tests, and making people available for interview. It also includes permitting authorised persons to enter specified premises for various purposes, such as to observe any relevant operations taking place. The specified premises cannot be domestic premises (subsection (5)).
	Subsection (3) provides that the tests required by an assessment notice can include tests of premises and/or persons involved in the provision of the network or service.
	Subsection (4) provides that a test required by an assessment notice may include tests which risk causing a security compromise, loss to a person or damage to property, but only if the test uses techniques which might be expected to be used by a person seeking to cause a security compromise. This includes ‘penetration testing’ and ‘red teaming exercises’.
	Subsection (6) ensures that an assessment notice may not require the provider to take actions that would violate legal privilege.
	Subsection (7) requires the assessment notice to set out the times at which each duty in the notice must be complied with. An assessment notice cannot require a provider to do anything before the end of the period within which the notice can be appealed, namely two months from the date of the notice in accordance with the Competition Appeal Tribunal Rules 2015. If a provider appeals an assessment notice it does not need to comply with the notice until the appeal is resolved.
	Subsection (10) requires an assessment notice to provide information about the consequences of a failure to comply with it and the right of appeal.
	Subsection (11) permits Ofcom to cancel a notice or make it less onerous by giving notice to the provider.