Commentary on provisions of Act Section 1: Duty to take security measures Section 105A: Duty to take security measures
Subsection (1) requires providers to take steps to identify and reduce the risks of security compromises occurring and prepare for the occurrence of security compromises.
	Security measures for the purpose of identifying the risk of security compromises would include the provider carrying out a risk assessment in relation to its network or service.
	Security measures for the purpose of reducing the risk of security compromises would include measures taken in the design of the network or service (such as segregation of the most sensitive controls from the rest of the network).
	Security measures for the purpose of preparing for the occurrence of security compromises would include measures such as retaining copies of information that would enable the running of functions that are most critical to a network or service in the event that these were compromised. Other measures may address the secure operation of the network or service. This could take the form of having procedures in place to monitor the network for abnormalities so that security compromises can be identified and remedied as quickly as possible.
	Subsection (2) defines "security compromise". The definition is broad and includes (among other things) anything that compromises the availability, performance or functionality of the network or service, or that compromises the confidentiality of the signals conveyed by means of the network or service. It also covers any unauthorised access to, interference with or exploitation of the network or service. Exploitation would include the misuse of a network or service’s functionality in unintended or unauthorised ways or for unintended or unauthorised purposes (for instance by using functionality that supports the provision of interpersonal communications services for other purposes, such as espionage).
	Subsection (3) provides that the definition of security compromises does not include anything that occurs as the result of certain kinds of conduct. This includes, for example, conduct that is required or authorised under enactments such as the Investigatory Powers Act 2016, ensuring that the Act does not adversely affect lawful activity carried out by law enforcement authorities or by the intelligence services which could otherwise fall within the definition of security compromise.
	Subsection (4) lists enactments for the purpose of subsection (3), and includes enactment that makes provision which is in the interests of national security, has effect for the purpose of preventing or detecting crime or preventing disorder, or makes provision which is in the interest of the economic well-being of the UK as far as those interests are relevant to national security.