UK Telecoms Security

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-03-31 in 142 days Code of Practice "Management plane 3" measures should be completed
2. 2028-03-31 in 508 days Management plane 4 measures and the first new measures of the revised Code should be completed
3. 2028-12-31 in 783 days Further new measures in the revised Code of Practice should be completed, including SIM provider checks
4. 2029-12-31 in 1148 days Final group of new measures in the revised Code of Practice should be completed
5. 2026-07-14 Revised Telecommunications Security Code of Practice (version 1.1) issued
6. 2025-03-31 First Code of Practice measures due for Tier 2 providers
7. 2024-03-31 First Code of Practice measures due for Tier 1 providers
8. 2022-10-01 Electronic Communications (Security Measures) Regulations 2022 come into force

1. 2026-07-14
   Telecommunications Security Code of Practice 2026 (version 1.1) RevisionCurrent text

   Revised Code issued after being laid in draft on 3 June 2026; it refines the language and adds guidance on new threats and technologies such as eSIMs. source

   More

   • New measures carry deadlines of 31 March 2028, 31 December 2028 and 31 December 2029.
   • It reinforces that providers should take a risk-based, holistic approach to security.
2. 2022-12-01
   Telecommunications Security Code of Practice (2022) Major version

   First version of the Code of Practice, with technical measures and a tiered implementation timeline. source

3. 2021-11-17
   Telecommunications (Security) Act 2021 Major version

   Received Royal Assent; it replaced the security duties in sections 105A to 105D of the Communications Act 2003 and gave Ofcom new enforcement powers. source

The legal duties apply to public telecoms providers; the Code of Practice sorts them into tiers by relevant turnover.

Security duty

The provider of a public electronic communications network or service must take appropriate and proportionate measures to identify, reduce and prepare for security compromises (section 105A of the Communications Act 2003). source

Tier 1

Public telecoms providers with relevant turnover of £1 billion or more. source

Tier 2

Public telecoms providers with relevant turnover of at least £50 million but under £1 billion. source

Tier 3

Providers with relevant turnover under £50 million that are not micro-entities. source

Providers implement the security measures in the 2022 Regulations, using the Code of Practice as the government's preferred way to show compliance, by tiered deadlines.

Regulations

The Electronic Communications (Security Measures) Regulations 2022 (S.I. 2022/933) set the specific security requirements, in force from 1 October 2022. source

Code of Practice

Detailed guidance for Tier 1 and Tier 2 providers on the government's preferred approach to demonstrating compliance with the Act and the Regulations. source

Departing from the Code

Where Ofcom suspects a provider is not acting in accordance with the Code, it can require the provider to explain why (section 105I). source

Ofcom enforces the security duties, with penalties of up to 10% of relevant turnover and daily penalties for continuing breaches.

Ofcom powers

Sections 96A to 100, 102 and 103 of the Communications Act 2003 apply to contraventions of the security duties (section 105S). source

1. Law text Telecommunications (Security) Act 2021 (as enacted)
2. Law text Electronic Communications (Security Measures) Regulations 2022 (S.I. 2022/933)
3. Guidance Telecommunications Security Code of Practice 2026 (version 1.1)
4. Guidance Explanatory memorandum to the revised Telecommunications Security Code of Practice 2026

1. UK NIS Regulations

   The UK regime for operators of essential services and digital service providers, with a £17 million penalty cap instead of a turnover-based one.

2. NIS2

   The EU directive, which covers public electronic communications providers among many other sectors.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to UK Telecoms Security (RSS)