The 2021 Telecommunications Security Act (TSA)

🛡️Why Did the UK Introduce the Telecommunications Security Act?

The Telecommunications Security Act (TSA) 2021 makes cyber security a statutory duty for UK public telecoms providers. It updates the Communications Act 2003 with new security obligations and gives Ofcom stronger powers to monitor compliance and enforce standards. The Act reflects the growing scale and sophistication of threats to networks that underpin UK critical national infrastructure and the digital economy.

To help providers understand what “good” looks like in practice, the government published the statutory Telecommunications Security Code of Practice. It sets out around 258 technical guidance measures for meeting the TSA duties and the Electronic Communications (Security Measures) Regulations 2022. These measures are phased in by tier through milestone deadlines from March 2024 to March 2028, rather than imposed all at once.

This article explains what the Telecommunications Security Act 2021 introduced, what it requires of UK providers, and how the Code of Practice translates those requirements into practical security controls.

🔐 Key Requirements for Telecommunications Security Act Compliance

The Telecommunications Security Act 2021 strengthens the UK’s telecoms security framework through a three-layer regime. It (1) adds new overarching security duties into the Communications Act, (2) sets specific enforceable security measures in the Electronic Communications (Security Measures) Regulations 2022, and (3) is supported by a statutory Code of Practice that explains the government’s preferred technical approach for meeting those duties.

In practical terms, providers are expected to meet the Telecommunications Security Act by doing the following:

• Identify and reduce security risks on an ongoing basis: Providers must take appropriate and proportionate steps to understand risks of security compromise, reduce those risks as far as possible, and keep that risk picture current as networks and threats evolve.
• Protect security-critical functions and data: Anything essential to operating or securing the network, such as management systems, signalling platforms, privileged tooling, and sensitive configuration or operational data, must be protected with strong access control, segregation, monitoring, and secure handling.
• Run accountable governance, not just technical controls: Security is treated as a provider duty. The Regulations and Code expect clear senior ownership and decision-making at the right level, especially where risk is being accepted or mitigations are being delayed.
• Manage supplier and third-party risk as part of core compliance: Providers cannot outsource responsibility. They must understand supply chain risk, set security requirements in contracts, monitor supplier activity, and flow down TSA-aligned controls where third parties support their networks or security-critical functions.
• Detect, respond to, and recover from security compromises: Providers must have the capability to identify incidents, respond effectively, limit impact, and recover normal operations, including maintaining resilient backups and recovery plans where proportionate.
• Demonstrate compliance to Ofcom, with evidence: The Code of Practice is statutory guidance rather than law, so providers may take alternative approaches. But if they do, Ofcom can require a clear explanation and evidence that the alternative still meets the legal duties and Regulations.

The Code’s technical guidance measures are phased by tier through milestone deadlines, so providers are not expected to implement everything at once, but to deliver controls in line with their applicable wave.

📆 When Did the TSA Come Into Effect?

The Telecommunications Security Act became law in 2021, but the telecoms security regime did not switch on overnight. The new statutory security duties and the Electronic Communications (Security Measures) Regulations have applied since October 2022. The Telecommunications Security Code of Practice, published in December 2022, then set out the detailed technical measures providers are expected to follow.

Implementation is phased by design. The Code groups its technical guidance into milestone waves, rolled out over several years so providers can deliver the uplift in a structured way rather than all at once.

TSA Timeline

The TSA rolls out through four milestone waves. The timeline below shows when each wave must be live. These are operational deadlines: controls need to be working in practice by each date, not just documented. You’ll also notice 2026 is a deliberate breather year, giving providers space to engineer and embed the heavier 2027 uplift.

Each wave builds in maturity, moving from baseline hygiene in 2024 and deeper hardening in 2025 to a major operational uplift in 2027, before final resilience tightening in 2028.

• 31 March 2024 – Baseline controls: The foundation wave. Focused on core security hygiene across the estate, including access discipline, logging, incident readiness and early supplier assurance. This is the minimum viable baseline the rest of TSA builds on.
• 31 March 2025 – Extended management plane, signalling and supplier measures: Builds on the baseline with deeper hardening of management environments, stronger signalling and routing protections and a more formal supplier security uplift. This wave tightens accountability and reduces exposure at key trust boundaries.
• 2026 – Breather year for delivery: No new milestone lands in 2026. The pause is intentional, reflecting the scale of planning, integration and operational change needed for the 2027 wave. Providers should use this window to build PAM, PAWs, SIEM/SOC capability and telecoms-grade monitoring in steady state.
• 31 March 2027 – Major operational uplift: The step-change year. Expectations move from “controls exist” to “controls operate at scale”. Requirements uplift privileged access, monitoring/SOC capability, threat hunting, signalling edge defence and virtualisation security.
• 31 March 2028 – Final resilience and administrative tightening: The closing wave. Less about new tooling and more about assurance and resilience: tighter restrictions on direct admin access, stronger signalling edge safeguards, end-to-end virtualisation fabric hardening and UK service resilience/data location governance.

What those milestones mean by tier

A tier is simply the TSA’s way of scaling obligations in proportion to a provider’s size and risk profile. Tiers are defined by a provider’s relevant annual turnover, so larger operators are held to the highest bar first, with smaller providers following later or only where flow-down applies. In practice, the tiers break down as:

• Tier 1: largest providers (about £1bn+ turnover)
• Tier 2: mid-sized providers (about £50m–£1bn)
• Tier 3: smaller providers (under £50m, but not micro-entities)
• Micro-entities: very small providers that are exempt from the mandatory TSA measures

Tier 1 providers
Tier 1 includes providers with annual relevant turnover of £1 billion or more. Tier 1 operators must meet every milestone on the dates above. They are also expected to set the security baseline for the sector and to assure that critical suppliers supporting their networks meet Telecommunications Security Act-aligned controls.

Tier 2 providers
Tier 2 covers providers with relevant turnover between £50 million and £1 billion. Tier 2 providers follow the same milestone waves, but the Code gives longer timeframes than Tier 1 for some measures. That extra time is real, but it is not absolute. If you supply services that support a Tier 1 network or security-critical function, Tier 1 supply chain expectations can require the relevant controls to be met earlier for that service.

Tier 3 providers
Tier 3 includes providers under £50 million turnover that are not micro-entities. Tier 3 providers are not required to follow the Code’s milestone timetable by default. However, they still sit within the wider telecoms security framework, and they may be expected to meet Telecommunications Security Act-aligned controls through contracts where they support Tier 1 or Tier 2 networks.

Micro-entities
Micro-entities are the only providers fully exempt from the Code’s mandatory measures. Even so, micro-entities can still face Telecommunications Security Act-aligned expectations through customer due diligence or contractual flow-down if they support higher-tier services.

The TSA vs the old telecoms security framework

While the Telecommunications Security Act builds on the Communications Act 2003, it changes the shape of telecoms security regulation in the UK. The pre-Telecommunications Security Act framework relied on broad security duties and Ofcom’s general enforcement powers. It did not set out a dedicated, telecoms-specific security regime with detailed technical expectations.

Under the Telecommunications Security Act, telecoms security is now regulated through a clearer and more enforceable structure:

• Telecoms-specific statutory security duties: Providers must take appropriate and proportionate measures to identify risks of security compromise, reduce those risks, prepare for compromises, and respond and mitigate harm when they occur. This is a higher and more explicit duty set than existed before.
• Enforceable security measures, not just principles: The Electronic Communications (Security Measures) Regulations 2022 turn those duties into specific legal requirements. The old regime did not have an equivalent set of telecoms-security regulations.
• A statutory Code of Practice with detailed technical measures: The Telecommunications Security Act is supported by a statutory Code that sets out the government’s preferred technical approach to meeting the duties and Regulations. The previous framework did not include a mandatory technical Code of this kind.
• Tiering and phased milestones: The Code measures are tiered by relevant turnover and phased through milestone waves from March 2024 to March 2028. Before the Telecommunications Security Act, there was no sector-wide, tiered timetable for implementing telecoms security controls.
• Clearer supply chain obligations: The Telecommunications Security Act makes supplier risk management an explicit part of compliance. Higher-tier providers are expected to assure that critical suppliers supporting their networks meet Telecommunications Security Act-aligned controls, which drives security uplift beyond the regulated core.
• Stronger, proactive Ofcom oversight: Ofcom can require evidence of compliance, assess providers against the duties and Regulations, and enforce against failures using a dedicated telecoms security penalties regime. Oversight is designed to be evidence-led and proactive rather than relying on incidents to expose gaps.

Legislation	Maximum Fine	Based on Turnover	Applicability
Communications Act 2003 security regime (Old)	No telco-specific security fine cap. Ofcom enforced via its general Communications Act penalty powers.	No explicit turnover-based cap for telecoms security duties.	Applied to PECN and PECS providers under broad security duties, with no tiering, milestones, or statutory technical Code.
Telecommunications Security Act 2021 (New)	Up to 10% of relevant turnover plus daily fines up to £100,000. Separate £10 million cap plus £50,000 daily fines for information and Code-related failures.	Penalty caps are set in proportion to relevant turnover.	Applies to all PECN and PECS providers. Code measures are tiered by turnover, phased through milestones from March 2024 to March 2028, and flowed down to critical suppliers.

Together, these changes move the UK telecoms security regime from broad, high-level duties under the Communications Act to a tiered, technically defined, and proactively enforced framework built for modern network threats.

👀 Who Has to Comply With This New Regulation? 

The Telecommunications Security Act is telecoms-specific, so its scope is clearer than most cross-industry cyber laws. In short, if you run a public telecoms network or service in the UK, you are in scope. Your tier then determines how quickly you must meet the Code of Practice measures.

Here’s the practical way to work it out.

You are IN SCOPE if…

1. You provide a public telecoms network or service in the UK.
   The TSA applies to providers of:
   • PECNs (Public Electronic Communications Networks): public-facing telecoms networks such as mobile, broadband, fibre or voice networks.
   • PECS (Public Electronic Communications Services): publicly available telecoms services delivered over those networks, such as internet access, mobile voice or messaging.
2. You fall into Tier 1, Tier 2 or Tier 3 under the Code’s turnover model.
   Your tier sets which milestone waves apply to you and the deadlines you must meet.
   The Code groups public providers by annual relevant turnover:
   • Tier 1: £1 billion or more
   • Tier 2: £50 million to £1 billion
   • Tier 3: under £50 million, but not a micro-entity
3. You support a Tier 1 or Tier 2 provider through a critical supply-chain role.
   Even if you are smaller, Telecommunications Security Act expectations can be flowed down contractually if your service is essential to operating or securing a higher-tier network. Typical examples include managed network operations, privileged maintenance access, core or signalling platforms, or other services that affect security-critical functions.

You are OUT OF SCOPE if…

1. You are a micro-entity.
   Micro-entities are the only providers fully exempt from the Code’s mandatory measures. Micro-entity status follows the UK company-size definition, meaning a very small provider meeting at least two of the micro-entity thresholds for turnover, balance sheet size and employee count.
2. You do not provide a public PECN or PECS.
   If you are not offering a public telecoms network or service, the Telecommunications Security Act duties and Code timetable do not apply to you directly.
3. You are Tier 3 and you do not support higher-tier services.
   Tier 3 providers are not required to follow the Code by default. If you are not supporting Tier 1 or Tier 2 networks in a way that triggers flow-down, the phased Code milestones do not apply to you in law.

The Importance of TSA Compliance for Businesses

Telecommunications Security Act compliance is not just about avoiding regulatory issues. It is about protecting the networks that the UK depends on every day, and proving you can operate them securely in a threat landscape that is getting tougher and more targeted.

Regulatory exposure is now real and measurable

• The Telecommunications Security Act introduced turnover-based penalties and stronger Ofcom enforcement powers. That means security gaps can lead to fines that scale with your business, not a flat ceiling you can absorb. For Tier 1 and Tier 2 providers, the Code milestones are also a formal timetable that Ofcom will assess against.

Security maturity is becoming a commercial differentiator

• Large customers, investors and insurers are already treating Telecommunications Security Act alignment as a marker of credibility. Providers that can evidence strong controls, clean supplier assurance, and milestone readiness are more likely to pass due diligence quickly and win work in regulated supply chains.

Your suppliers are part of your compliance story

• Under the Telecommunications Security Act, you remain accountable for risks introduced through third parties. If a critical supplier cannot meet Telecommunications Security Act-aligned controls, you inherit that exposure. Good supplier assurance is not optional. It is a core part of protecting your network and meeting the regime.

Operational resilience improves when controls are done properly.

• The measures required by the Telecommunications Security Act reduce the likelihood of large-scale outages, compromise of security-critical systems, and prolonged recovery times. Compliance done well strengthens day-to-day operations, not just audit posture

🚨 Enforcement and Penalties

The Telecommunications Security Act creates enforceable security duties for UK public telecoms providers, backed by the Security Measures Regulations and a statutory Code of Practice. If providers fall short, Ofcom can intervene and the impacts can be financial, operational and reputational.

Who enforces the Telecommunications Security Act?

Ofcom is reposible for enforcement and can:

• Require information and evidence to assess compliance
• Carry out compliance assessments and inspections
• Issue directions to remedy failures
• Impose monetary penalties for breaches of the duties or Regulations

The Code of Practice is statutory guidance rather than law. Providers can take an alternative approach, but Ofcom can require a clear explanation and evidence that it still meets the legal duties and Regulations.

What are the penalties?

The Telecommunications Security Act introduces a dedicated telecoms security penalty model:

• Breaches of the security duties or Security Measures Regulations:
  • Fines up to 10 percent of relevant turnover, plus daily penalties up to £100,000 for ongoing non-compliance.
• Information or Code-related failures (for example not providing required information, or not explaining a material departure from the Code):
  • Fines up to £10 million, plus daily penalties up to £50,000 while the failure continues.

This model makes telecoms security a senior accountability issue, not a best-efforts technical exercise.

What triggers enforcement?

Ofcom action is most likely where it sees material or repeated failure to meet the Telecommunications Security Act framework, including:

1. Lack of appropriate and proportionate technical and organisational measures
2. Gaps affecting security-critical functions, such as privileged access, monitoring, signalling protection, or virtualised infrastructure controls
3. Weak control of risks introduced by critical suppliers
4. Inadequate capability to detect, respond to, and mitigate security compromises
5. Failure to provide compliance evidence, or to justify significant departures from the Code

Additional Insights from Industry Analysis and Global Context

Government can tighten the regime over time
The TSA framework is designed to evolve. Government keeps the regime under review and the statutory Code of Practice is expected to be updated as threats and technologies change. Providers should plan for the technical bar to rise over time rather than stay fixed.

Supply chain assurance is now a core security duty
Supplier risk is treated as a first-class issue. Providers are expected to assess suppliers, set security requirements in procurement and contracts, and continuously assure critical third parties supporting networks or security-critical functions.

Proportionality is delivered through tiering and milestones
Turnover-based tiering keeps obligations proportionate. Tier 1 and Tier 2 providers must follow the milestone waves, Tier 3 is not required to follow the Code by default, and micro-entities sit outside the Regulations. Flow-down can still pull specific services into higher-tier standards.

Compliance should be treated as continuous, not one-off
Ofcom monitors compliance on an ongoing basis and feeds into government reviews of telecoms security. Providers should expect recurring evidence, reassessment and improvement, not a single milestone push.

Global context
Internationally, telecoms is increasingly regulated as critical national infrastructure. Voluntary standards are giving way to mandatory security duties, tighter supply chain controls and sharper enforcement. The TSA is the UK’s telecoms-specific version of that trend, backed by enforceable Regulations and a statutory Code.

• EU (NIS2): Telecoms providers are classed as “essential entities”, with mandatory risk management, supply chain controls, strict incident reporting timelines and significant penalties enforced nationally.

• Australia (SOCI): Telecoms is treated as critical infrastructure, requiring formal, government-overseen risk management programmes covering cyber and supply chain risk for critical assets.

• North America: Canada’s Bill C-26 updates telecoms law and adds a dedicated cyber security framework with risk management and stronger government powers. In the US, telecoms sits within broader critical infrastructure rules, with momentum towards mandatory controls and incident reporting via CIRCIA-linked regulation.

🪜 4 Practical Steps to Become Compliant

1. Confirm your scope, tier and which Code measures apply

Start by confirming you are a PECN or PECS provider and therefore in scope of the Telecommunications Security Act security duties and Regulations. Then confirm your tier using relevant turnover, because that sets your milestone dates. The Code measures are tiered and not all apply to every provider, so map which measures apply to your networks and services before you build a plan.

2. Lock in senior accountability and the skills to deliver

The Telecommunications Security Act makes telecoms security a provider duty with clear senior ownership. Set named executive accountability for TSA compliance, assign a delivery lead, and make sure you have the specialist capability to execute the measures. You need enough in-house competence to challenge suppliers, approve secure configurations, and oversee security-critical functions rather than outsourcing the risk.

3. Run a focused Telecommunications Security Act gap and risk assessment

Assess your current posture against the TSA duties, the Security Measures Regulations, and the Code measures for your tier. Your risk process should be threat-informed, updated as the network changes, and produce a clear list of gaps and priorities. Validate key controls through proportionate testing and assurance so you know what is genuinely operating versus what is only documented.

4. Build a remediation plan control by control and evidence it as you go

Supplier risk matters under the TSA, but the key test is whether each required control is operating in practice. For every applicable Code measure, assess your current position, define the gap, and set a remediation plan with owners and delivery dates aligned to the milestone waves. Where a control depends on a supplier, flow it into contracts and delivery plans, then collect evidence of operation as you implement, because Ofcom can ask for proof at any point and expect justification for any departure from the Code.

👉 4 Ways to Get Started

1. Do it yourself

If you already have the people, budget and telecoms security expertise in-house, you can deliver Telecommunications Security Act compliance internally. This route suits larger operators with mature security and network engineering teams who can handle the tooling, integrations, operating model changes and evidence production.

Be realistic about the lift. Telecommunications Security Act delivery is not just buying products. It involves architecture change, process redesign, supplier assurance and ongoing compliance evidence.

2. Use an individual contractor

A specialist contractor can add short-term capacity and hands-on expertise for discrete pieces of work such as PAM design, SIEM onboarding, privileged access hardening, or Code evidence packs.

The risk is that Telecommunications Security Act is broad and telecoms-specific. One person rarely covers everything from signalling and virtualisation to supplier governance and Ofcom assurance. Contractors work best when scope is tightly defined and overseen by an internal owner.

3. Bring in a virtual CISO (vCISO)

A vCISO gives you senior security leadership without hiring full-time. They can confirm scope and tier, shape your roadmap, prioritise milestone delivery, and keep the programme aligned to the TSA duties and Code measures. You still do much of the implementation, but you avoid guessing what “good” looks like or mis-sequencing the work.

A strong vCISO provider should also bring access to telecoms-aware specialists for complex controls and regulatory evidence.

4. Use a managed Cyber-as-a-Service model

If you want an end-to-end route, a managed service can deliver both the build and the run of Telecommunications Security Act-aligned capabilities. This is often the most practical option for smaller or mid-sized telcos who need 24/7 monitoring, SIEM operations, threat hunting, PAM and supplier assurance without creating a full internal security function.

You get a packaged operating model aligned to the TSA duties and milestone waves, with ongoing monitoring and compliance evidence handled as part of service delivery.

🎯 Conclusion

The Telecommunications Security Act is not just another compliance exercise. It is a structural shift in how the UK protects public telecoms networks, moving security from best-efforts engineering to a clear, enforceable national standard.

Providers need to act now to:

• Understand which TSA duties and Code measures apply to their services and tier
• Close gaps ahead of the remaining milestone waves
• Strengthen supplier assurance so third-party risk does not derail compliance
• Build evidence that controls are operating in practice, not just planned

To explore how your organisation can align with the Telecommunications Security Act and its Code of Practice, speak to a cyber security expert or read the Telecommunications Security Act in full.

Staying ahead of the TSA is not just a legal imperative. If approached strategically, it strengthens resilience, builds trust with customers and Tier 1 partners and becomes a real competitive advantage.

📣 News and Updates

December 2025

• In December, industry and legal commentary examined the draft Code in more detail, focusing on how its proposals might be interpreted and applied by regulators once finalised.
• Commentary during the month highlighted operational and governance challenges in evidencing TSA compliance across complex, software-driven and multi-supplier telecoms environments.
• By the end of December, analysis increasingly reflected the view that high-level policy compliance alone may be insufficient, with greater emphasis likely to be placed on demonstrable controls and assurance.

November 2025

• Post-consultation discussion of the draft Telecommunications Security Code of Practice focused on how proposed updates would apply to modern telecoms networks, signalling that operators should expect closer scrutiny of how existing TSA duties are met in practice.
• Ofcom’s 2025/26 Plan of Work, referenced throughout November commentary, confirmed that telecoms security and TSA compliance remain active regulatory priorities.
• Together, these developments reinforced that operators should treat the draft Code as an important reference point, even before finalisation, when reviewing current compliance approaches.

October 2025

• After DSIT’s consultation on updating the Telecommunications Security Code of Practice under the Telecommunications (Security) Act 2021 closed on 22 October, November coverage focused on the draft’s tougher expectations for modern telco networks. The proposed updates emphasise stronger supplier assurance, tighter privileged/admin access to management planes and clearer controls for virtualised and API-driven components such as eSIM and automation.
• Ofcom’s 2025/26 Plan of Work kept TSA compliance high on the enforcement agenda, so November discussion treated the draft Code as the near-term benchmark operators will be assessed against once DSIT finalises the refresh. The message to industry was straightforward: TSA duties stay the same, but the practical bar for proving compliance is being raised.