The government has introduced new telecoms security legislation in Parliament, along with a draft code of practice. The Electronic Communications (Security Measures) Regulations 2022 which are published on 5 September 2022, will come into force on 1 October 2022. These Regulations impose certain security requirements on suppliers of public electronic communications networks or public electronic communications services.
The government has introduced in Parliament the new Electronic Communications (Security Measures) Regulations 2022, as well as a draft Telecommunications Security Code of Practice. The legislation and code are designed to counter threats to the security of the United Kingdom’s public telecommunications networks and services. They were created in collaboration with the National Cyber Security Centre (NCSC), the United Kingdom’s national technical authority for cyber security, and Ofcom, the telecoms regulator.
The Regulations outline particular security measures that public telecommunications operators must implement in addition to the broad legislative obligations set forth in sections 105A and 105C of the Communications Act 2003 (as modified by the Telecommunications (Security) Act 2021). These safeguards are intended to guarantee that public networks and services use suitable and reasonable security measures. Failure to comply with the requirements might result in fines of up to 10% of revenue or, in the case of a persistent violation, £100,000 per day.
The proposed code of practice includes recommendations on how providers might comply with the rules. It defines adequate telecommunications security by outlining important ideas underlying the rules and specific technical advisory steps that providers may take to show compliance with their legal obligations. The draft code has been put before Parliament in accordance with section 105F of the Communications Act of 2003. We intend to produce and publish the code of practice when it has been subjected to Parliamentary review for forty sitting days.