Commentary on provisions of Act Section 4: Informing others of security compromises Section 105K: Duty to inform Ofcom of security compromise
The intention of Section 105K is to increase the reporting of security incidents by providers to Ofcom. This will give Ofcom a better understanding of the security risks across the telecoms industry.
	Subsection (1) places a duty on providers to inform Ofcom as soon as reasonably possible of any security compromise that:
has a significant effect on the network or service; or
involves unauthorised access to or interference with the network or service so that a person is put in a position to bring about a security compromise that could significantly affect the network or service.
	The wording of subsection (1)(b) is designed to ensure the reporting of ‘pre-positioning’ attacks that do not at the time of the attack affect the network or service, but do allow access to a network that could result in future security compromises.
	Subsection (2) states that in determining whether the effect of a security compromise is, or could be, significant a number of factors should be taken into account, such as the number of people who are, or might be, affected.