The telecoms security code of practice 2026 is the current UK guidance for public telecoms providers on meeting statutory security duties. Issued by the Department for Science, Innovation and Technology on 14 July 2026, it followed statutory parliamentary scrutiny UK Parliament statement, July 2026. The underlying security regulations have applied since 1 October 2022 Electronic Communications (Security Measures) Regulations 2022. The revised Code does not make every phased measure immediately due.
- Scope: Detailed Code guidance addresses Tier 1 and Tier 2 public telecoms providers; wider statutory duties also apply to public network and service providers.
- Key dates: Version 1.1 was issued on 14 July 2026; phased implementation dates extend to 31 March 2028 Ofcom security report, March 2026.
- Regulator: Ofcom monitors compliance with telecoms security duties and receives reports of specified security compromises.
- Changes: Revised guidance clarifies privileged access, testing, encryption and data protection, and addresses public cloud and application programming interfaces.
- Penalties: Breaching security duties can attract a fine of up to 10 per cent of relevant turnover Ofcom telecoms security powers.
- Out of scope: Detailed Tier 1 and Tier 2 guidance does not make smaller public telecoms providers exempt from statutory security duties.
🔍 What is the telecoms security code of practice 2026?
The Telecommunications Security Code of Practice 2026 explains how public telecoms providers can demonstrate compliance with UK security duties. Version 1.1 replaced the original Code on 14 July 2026 Department for Science, Innovation and Technology Code, July 2026. It is guidance issued under sections 105E and 105F of the Communications Act 2003, not a replacement for the Act or the binding regulations.
The Telecommunications (Security) Act 2021 inserted the security duties into the Communications Act 2003. Section 105A requires providers to take appropriate and proportionate measures to identify and reduce security risks and prepare for compromises Telecommunications (Security) Act 2021. The Electronic Communications (Security Measures) Regulations 2022 specify security measures for providers of public electronic communications networks or services. Those regulations, rather than the Code alone, establish binding requirements.
The Code gives providers a practical route through those obligations. Its Section 3 maps technical and procedural guidance to the regulations and sets implementation timeframes for specified providers Department for Science, Innovation and Technology Code, July 2026. Not following a Code measure does not, by itself, create court or tribunal liability. A provider must still comply with its statutory duties and be ready to explain a different approach to Ofcom.
Key Takeaway
The Act and regulations create the duties. The Code explains the government’s preferred approach to demonstrating compliance.
👥 Who must follow the telecoms security code of practice 2026?
The Telecommunications Security Code of Practice 2026 gives detailed guidance to the largest UK public telecoms providers, while statutory security duties reach further. Tier 1 covers providers with relevant turnover of at least £1 billion. Tier 2 covers those with at least £50 million but less than £1 billion Department for Science, Innovation and Technology explanatory memorandum.
Turnover determines which tier’s detailed implementation guidance a provider should examine. It does not decide, on its own, whether the Communications Act 2003 or the Electronic Communications (Security Measures) Regulations 2022 apply. The regulations cover providers of public electronic communications networks or public electronic communications services Electronic Communications (Security Measures) Regulations 2022. A smaller provider should assess what it supplies, rather than assume it is outside the framework.
The revised Code applies across England, Wales, Scotland and Northern Ireland. The Department for Science, Innovation and Technology describes it as the government’s preferred approach for Tier 1 and Tier 2 providers to demonstrate compliance Department for Science, Innovation and Technology explanatory memorandum. Ofcom’s incident-reporting guidance also addresses communications providers more broadly. Providers below Tier 2 should therefore distinguish detailed Code measures from duties and reporting obligations that may still apply.
🗓️ When do the revised measures apply?
The revised telecoms security code of practice 2026 has been the current Code since 14 July 2026. The underlying regulations have been in force since 1 October 2022 Electronic Communications (Security Measures) Regulations 2022. Publication of version 1.1 did not reset the framework or make every phased Code measure due on the day of issue.
The implementation dates for measures in the original Code span 31 March 2024 to 31 March 2028, according to Ofcom’s security report Ofcom security report, March 2026. Providers need to check the timeframe attached to each applicable measure in Section 3 of the current Code, alongside the binding duty it supports. A single organisation-wide deadline will not accurately describe a phased programme.
The June 2026 parliamentary document was a draft, not the final Code. UK Parliament recorded that scrutiny ended without either House rejecting it before the government issued the revision UK Parliament statement, July 2026. A separate Ofcom consultation on changes to supervisory and incident-reporting guidance had closed by November 2026, but its final statement remained pending Ofcom section 105Y consultation. Those proposed changes should not be presented as current requirements.
Key Takeaway
Use version 1.1 for current guidance, then check each measure’s applicable timeframe. Keep Ofcom’s pending policy changes separate.
🧩 What changed in the telecoms security code of practice 2026?
The telecoms security code of practice 2026 updates technical guidance; it does not replace the security duties in the Communications Act 2003 or the Electronic Communications (Security Measures) Regulations 2022. The government revised the guidance following advice from the National Cyber Security Centre and feedback from Ofcom and industry Department for Science, Innovation and Technology consultation response.
For providers, the main areas to revisit are privileged access workstations, security testing, encryption and data protection. UK Parliament also identified new guidance on secure public cloud use and application programming interfaces (APIs) UK Parliament statement, July 2026. These topics matter when privileged users manage network infrastructure, suppliers connect to systems or network functions run on externally hosted infrastructure.
A sensible comparison starts with the controls already mapped to the 2022 regulations, then checks what version 1.1 clarifies or adds for each applicable measure. The original Code dates from 1 December 2022; version 1.1 was issued on 14 July 2026 Department for Science, Innovation and Technology Code, July 2026. We would not treat every revised paragraph as a new statutory obligation or assume an existing control satisfies the clarified guidance without review.
✅ What must providers do and demonstrate to Ofcom?
Providers must meet applicable statutory security duties and be able to explain how their controls address them. The telecoms security code of practice 2026 helps Tier 1 and Tier 2 providers map that explanation to detailed measures. Ofcom’s procedural guidance describes how it expects to monitor compliance and enforce the framework Ofcom guidance for communications providers.
Evidence should connect a legal obligation to the relevant Code measure, an operational control and its owner. We suggest keeping decisions about scope, proportionality and departures from Code guidance together with records showing the control operates. The table separates binding duties from guidance and practical evidence; its examples are preparation steps, not an additional statutory checklist.
| Area | Requirement or guidance | What to document |
|---|---|---|
| Security risks | Communications Act 2003, section 105A: appropriate and proportionate measures Telecommunications (Security) Act 2021 | Risk decisions, control ownership and preparation for compromises |
| Technical measures | Applicable 2022 regulations and mapped Section 3 Code guidance | Control mapping, implementation status and applicable timeframe |
| Suppliers | Regulation 7: appropriate and proportionate measures with third-party suppliers Ofcom clarification on supplier security | Due diligence, access arrangements and contractual information-sharing |
| Incident reporting | Report specified security compromises to Ofcom as soon as reasonably practicable Ofcom incident-reporting guidance | Assessment, escalation decision and reporting record |
Supplier oversight deserves particular attention. Regulation 7(4)(a)(ii) addresses a supplier that is itself a network provider and receives access to the primary provider’s network, service or sensitive data. Ofcom monitoring that supplier does not remove the primary provider’s responsibility. Ofcom points to pre-contract information gathering and contractual information-sharing as possible measures Ofcom clarification on supplier security.
Incident assessment also needs a clear decision route. Ofcom’s guidance covers specified compromises, including qualifying unauthorised access that could enable a further compromise affecting network or service operation Ofcom incident-reporting guidance. Teams should record why an event is or is not reportable, who makes that decision and how a report reaches Ofcom.
🚨 What penalties can Ofcom impose?
Ofcom can penalise breaches of statutory telecoms security duties, but a departure from the telecoms security code of practice 2026 is not automatically a breach. The Telecommunications (Security) Act 2021 says failure to follow a Code provision does not, by itself, create court or tribunal liability Telecommunications (Security) Act 2021. Providers still need a defensible explanation of how they meet the underlying duty.
For non-compliance with security duties, Ofcom says it can impose a fine of up to 10 per cent of relevant turnover. A continuing failure can attract £100,000 per day Ofcom telecoms security powers. These are maximum penalties, not automatic charges for each missed Code measure. The legal issue is whether the provider has complied with its security duties.
Information requests carry a separate risk. Ofcom says failing to provide information, or refusing to explain a departure from a code, can attract a penalty of up to £10 million or £50,000 per day for a continuing failure Ofcom telecoms security powers. Keep the reasoning behind alternative controls accessible. An explanation assembled only after a request may be harder to support than one documented when the decision was made.
🧭 How should UK providers prepare?
UK providers should map their services, tier and existing controls against the telecoms security code of practice 2026 before changing their security programme. Start with the telecoms security legislation overview, then assign each applicable Section 3 measure an owner, timeframe and evidence location. The telecoms security code of practice 2026 is most useful as a measure-by-measure working document, not a one-off policy update.
Prioritise gaps affecting network access, supplier oversight and incident decisions. A cyber security audit can help test whether documented controls work in practice, while a security strategy and roadmap can sequence remediation against applicable dates. Ofcom had assessed the first 67 of 258 measures in the original Code when it published its latest security report Ofcom security report, March 2026.
Keep adjacent guidance distinct. Ofcom’s Network and Service Resilience Guidance addresses resilient architecture, design and operational models across public networks and services Ofcom Network and Service Resilience Guidance. It may inform a provider’s resilience review, but it is not a substitute for the Code mapping. Our telecoms milestone discussion and security standards overview provide further context; neither replaces checking the current regulatory text.
❓ Frequently asked questions
Is the Telecommunications Security Code of Practice legally binding?
No. The Code is guidance on demonstrating compliance with binding duties in the Communications Act 2003 and the Electronic Communications (Security Measures) Regulations 2022. Section 105H says failing to follow a Code provision does not, by itself, create court or tribunal liability Telecommunications (Security) Act 2021. A provider still needs to meet its statutory duties and explain a different approach.
What are the turnover thresholds for Tier 1, Tier 2 and Tier 3?
Tier 1 begins at £1 billion in relevant turnover. Tier 2 covers at least £50 million but less than £1 billion Department for Science, Innovation and Technology explanatory memorandum. Do not treat a position below Tier 2 as an exemption: statutory duties depend on whether the organisation provides a public electronic communications network or service.
What is the next telecoms security Code deadline?
There is no single next deadline for every provider. The telecoms security code of practice 2026 sets timeframes for specified measures, so the next applicable date depends on the provider and measure. Dates in the original phased programme extend to 31 March 2028 Ofcom security report, March 2026. Check Section 3 of version 1.1 against the organisation’s implementation record.
Do small telecoms providers have to follow the Code?
Smaller providers should not assume they are outside the telecoms security framework. The telecoms security code of practice 2026 sets out a detailed preferred approach for Tier 1 and Tier 2 providers Department for Science, Innovation and Technology explanatory memorandum. The Electronic Communications (Security Measures) Regulations 2022 apply to providers of public electronic communications networks or services. The first question is whether the organisation meets that statutory description.
What telecoms security incidents must be reported to Ofcom?
Providers must report specified security compromises to Ofcom as soon as reasonably practicable. Ofcom’s guidance includes qualifying unauthorised access that could enable a further compromise affecting network or service operation Ofcom incident-reporting guidance. Assess the event against the reporting criteria rather than waiting for a service outage. Record the decision and the time of any report.
Are providers responsible when a regulated network supplier has access?
Yes. Under regulation 7(4)(a)(ii), a primary provider must consider appropriate and proportionate measures where a supplier is itself a network provider with access to its network, service or sensitive data. Ofcom monitoring the supplier separately does not exempt the primary provider Ofcom clarification on supplier security. Due diligence and contractual information-sharing may form part of its approach.
Did Ofcom’s proposed reporting changes take effect with the revised Code?
No. The revised Code and Ofcom’s proposed changes to its supervisory and incident-reporting guidance are separate. As of November 2026, Ofcom’s consultation had closed but its final statement remained pending Ofcom section 105Y consultation. Providers should follow current reporting requirements while watching for a final Ofcom statement.
Contact Us
