Telecommunications Security Act

Executive Briefing

For Organisational leaders and Security professionals across the UK telecoms sector, March 2027 is a key milestone for the Telecommunications (Security) Act (TSA) and it isn’t about achieving a compliance certificate. It’s about demonstrably resilient network architecture – an ability to withstand the evolving realities of modern threats.

The TSA, implemented through the Electronic Communications (Security Measures) Regulations 2022 and guided by the Telecommunications Security Code of Practice, fundamentally reshapes how public telecoms providers approach security. Version 1.1 of the Code, released July 2026, reinforces a risk-based approach essential for navigating today’s complex threat landscape.

The Shift: From Static Compliance to Dynamic Resilience

Born from the UK Telecoms Supply Chain Review (July 2019), the TSA recognised that existing security frameworks were insufficient for securing next-generation networks like 5G and full-fibre infrastructure. It established a three-layered framework: legislation (TSA), detailed regulations (Security Measures Regulations), and practical guidance (Code of Practice).

But March 31st, 2027 isn’t a blanket compliance deadline. It marks key implementation dates for measures concerning third-party suppliers and the network management plane. The critical question facing security leaders isn’t “Are we compliant?” but:

Can we definitively demonstrate that our networks, management planes, privileged access controls, and supplier ecosystems are designed and operated to manage today’s – and tomorrow’s – threats?

Two Key Focus Areas for 2027:

1. Operationalising Third-Party Security

By March 2027, specified third-party supplier measures must be implemented in all contracts. This demands more than questionnaires and annual reviews. The Code requires:

• Documented shared responsibility models
• Clearly defined security requirements within contracts
• Robust incident management processes between provider and supplier
• Strict control over network access and data protection, even when off-site

The challenge: Do you truly control your security posture when critical network capabilities rely on external operators? Supplier risk must now extend into the architecture itself. Key questions to address include:

• Who has access? What can they change? Which systems are accessible?
• Are subcontractors involved, and how is their access governed?
• How is access controlled, logged, and monitored?
• Can you exit or replace a critical managed service if necessary?

2. Strengthening the Management Plane

The new measures place significant emphasis on securing the management plane – the core systems controlling your network. Requirements include:

• Formal change processes (except in emergencies)
• Restricted access to privileged credentials and secrets
• Segregation of management-plane systems
• Comprehensive logging and monitoring of privileged activity

The challenge: For security architects, this demands a fundamental review: Who can modify the network, from where, using what identity, and through which system – and can we prove it? A mature architecture maps the complete privileged access path (Identity → Authentication → Privileged Access → Management Platform → Network Device → Change → Logging → Monitoring). The goal is to prevent compromise of a single credential leading to network-wide breaches.

Beyond Implementation: A Holistic Approach

The biggest risk isn’t technical; it’s organisational. Treating TSA as solely a compliance exercise owned by the security assurance function misses the point. The legislation demands a holistic, risk-based approach integrated into every facet of telecoms operations. This means connecting TSA directly to:

• Security architecture
• Technology investment decisions
• Identity and privileged access management
• Network engineering practices
• Supplier management strategies
• Vulnerability & Incident Management
• Board-level risk oversight

The ultimate question: Can you demonstrate security outcomes, not just point to policies?

Five Priorities for Telecoms Security Leaders (Before March 2027):

1. Map TSA Requirements: Align requirements with your specific networks, systems, and ownership structures.
2. End-to-End Management Plane Mapping: Identify all access routes into critical infrastructure.
3. Supplier Integration: Treat suppliers as extensions of your architecture – understand their access & controls.
4. Build Evidence: Document evidence alongside each control implementation (Risk → Control → Architecture → Owner → Evidence → Test → Exception).
5. Start Now: Remediation for architectural or supplier dependencies requires time and cannot be left to the last minute.

The TSA represents a fundamental shift in expectations. Organisations prepared to demonstrate robust security outcomes—protected management planes, controlled privileged access, securely managed credentials, accountable suppliers, and verifiable evidence—will be best positioned for success.

If Ofcom asked you today to demonstrate how your most privileged users, suppliers, and management systems could affect the security of your network…how quickly and confidently could you answer?

Authoritative sources

UK Government

Factsheet 4: Ofcom and Telecoms Security – GOV.UK

Factsheet 2: New Telecoms Security Framework – GOV.UK

Telecommunications Security Code of Practice 2026 (version 1.1) – GOV.UK