The Communications Act 2003 Telecoms Security Framework Responsibilities of Telecoms Providers
The Government plans to provide the UK with one of the most robust telecoms security frameworks in the world. Telecoms companies – providers of public electronic communications networks and services (see definitions in Annex A) – are already required to implement general security protections under the existing 2003 Act provisions. The Government intends to build on these practices to remedy the flaws identified in the Telecoms Supply Chain Review.
	To do this, the Act sets out new duties on telecoms providers to raise the bar for security. It requires telecoms providers, overseen by Ofcom, to design and manage their networks to protect against existing and future threats to the UK’s network security. This means identifying, reducing and eliminating risks to networks and services. Public telecoms networks and services will be protected by the provider safeguarding their availability and confidentiality, and making them secure from unauthorised interference.
	Where security compromises do occur, the impact on end-users can be substantial and potentially damaging. The Act therefore places duties on providers to take appropriate and proportionate action to ensure that the effects of compromises are limited, and to act to remedy the impact on networks and services.
	While networks are owned and operated by different companies, there are common measures that can be taken to level up security protections across all networks and services. Analysis was conducted during the Telecoms Supply Chain Review, including in-depth contributions from and interviews with telecoms providers, vendors and other industry representatives. This engagement, plus the practical findings of threat-based, intelligence-led penetration testing and industry-submitted reports of breaches, identified the areas posing greatest risk to networks and services. This has been supplemented by NCSC threat analysis that determines the security outcomes most needed to prevent security flaws.
	The Act makes provision for the Secretary of State to make regulations, setting out common security outcomes and the actions to be taken to meet them. This includes the ability to make regulations that provide for measures to be taken to prevent security compromises, and – where specific compromises are detailed in the regulations – measures to remedy the effects of compromises on the network or service. Such regulations may include, for example, specific security requirements that ensure networks and services are securely built, managed and overseen, and that vendor procurement and ongoing management support security.
	The UK has a competitive telecoms market which spans large, multinational companies through to small and micro businesses. Reflecting this diversity, Ofcom as the communications regulator and NCSC as the expert technical security authority provide support and advice, tailored to different types of provider, on appropriate detailed measures to secure their networks and services. The Government therefore recognises that guidance can provide clarity and certainty to providers for achieving compliance with legal obligations. The Act makes provision for the Secretary of State to issue a new telecoms security code of practice, that will set out to certain types of provider the detailed and specific security measures they should take to comply with the law. These codes will be based on NCSC best practice security guidance, and the Government will consult publicly on their initial implementation and subsequent revision. The codes of practice will be admissible in legal proceedings, and a court or tribunal must consider them where they are in force and where a provision is relevant to the proceedings.
	The European Electronic Communications Code Directive (EECC) included provisions relating to telecoms security. Some of these reflected the previous EU framework for electronic communications and were already transposed in UK law. Others are being given effect through the Act. These address the obligations on providers to report a range of security incidents to Ofcom. This will give Ofcom the information that they need to understand security across the industry.