The Communications Act 2003 Telecoms Security Framework Ofcom’s Regulatory Powers
The Act will provide Ofcom with stronger regulatory powers to enforce the new regime. It sets out new responsibilities for Ofcom to assess providers’ security. Ofcom has a power, going beyond the current audit powers, to issue assessment notices. These will allow Ofcom to assess, or commission others to assess, providers’ compliance. In completing these assessments, Ofcom will take into account any relevant code of practice. Ofcom will be able to complete audits of providers’ security provisions and technical tests of a provider’s security, as well as require providers to complete penetration testing that will simulate tactics that may be used by attackers.
	The Act will provide for a range of penalties should providers contravene their legal duties. These penalties consist of fines to a maximum of 10% of turnover or a daily penalty of £100,000 for continuing offences. Equally there will be increased penalties for security related information offences of up to £50,000 per day or a maximum of £10 million.
	To ensure the Government can oversee the regime, Ofcom will be able to share information with the Government. For example, it can notify the Government about security incidents or the risks of security incidents. The Act also makes provisions for Ofcom to report on telecoms providers’ security to the Secretary of State. These reports will set out the extent to which providers are complying with new security obligations and are acting in accordance with the code of practice, as well as any action that Ofcom has taken in response to security compromises. Telecoms security will also be included in Ofcom’s periodic infrastructure report.