The Telecommunications (Security) Act and the Bill
The Telecommunications (Security) Act 2021 regulates public telecoms networks through Ofcom. The Cyber Security and Resilience Bill (CSRB) excludes those networks from its digital and managed service categories, but a telecoms group can still be caught through its other services.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
Telecoms networks already have their own security law. The Telecommunications (Security) Act 2021 added duties to the Communications Act 2003, enforced by Ofcom. The Cyber Security and Resilience Bill (CSRB) is a separate regime, and it deliberately avoids treating a public telecoms network or service as a digital or managed service.
But a telecoms group can still be caught by the Bill through other parts of its business.
How the two regimes compare
| Telecoms security regime | Cyber Security and Resilience Bill | |
|---|---|---|
| Legal home | Communications Act 2003, as amended | NIS Regulations 2018, as amended |
| Who it covers | Public electronic communications networks and services | Essential services, digital and managed services, data centres, load controllers and critical suppliers |
| Regulator | Ofcom | Depends on the category, such as Ofcom for data centres and the Information Commission for RDSPs and RMSPs |
| Detail | Regulations and a code of practice | Secondary legislation and regulator guidance |
| Reporting | As soon as reasonably practicable | 24 hours and 72 hours |
| Maximum fine | Reported at up to 10% of relevant turnover, plus up to £100,000 a day | Up to the greater of £17 million and 4% of turnover, under the regular bands |
| Vendor powers | Designated vendor directions | Part 4 directions, with further vendor powers proposed |
The penalty figures for telecoms come from the Government's Telecoms Security Bill factsheet, so check the current statute before you rely on them.
What the Bill says about telecoms
The Bill states that a person does not provide a relevant digital service or a managed service merely by providing a public electronic communications network or service. Those terms have the meaning used in section 151(1) of the Communications Act 2003.
The carve-out is tied to that specific activity. It doesn't exclude a company just because it is a telecoms business.
When a telecoms business could still be caught
Managed services. If you sell managed IT, SD-WAN management, managed firewalls or similar services that give you ongoing access to customer systems, ask whether that part of the business meets the RMSP test.
Cloud and hosting. A cloud computing service you sell could be an RDSP activity.
Data centres. Running a data centre above the rated IT load thresholds could make you an operator of essential services.
Digital infrastructure. The NIS Regulations already include subsectors such as DNS services and internet exchange points where thresholds are met.
Critical supplier designation. A regulator can designate someone supplying goods or services directly to a regulated organisation, if the test is met. Check the final text if this relates to a telecoms service.
Customer requirements. Regulated customers may ask you to support their own security duties by contract.
Reporting: expect different clocks
Under section 105K of the Communications Act 2003, a provider must inform Ofcom as soon as reasonably practicable of a security compromise with a significant effect on the network or service, or one that could enable a further significant compromise. Significance considers duration, users, area and disruption.
The Bill has fixed periods instead. So a group with both telecoms and managed services needs a process that works out which regime applies. One incident could trigger both, with different reports to different regulators. It could also trigger UK GDPR.
A practical plan for telecoms groups
- Map services to regimes. List each product and mark whether it is a network or service, a managed service, a cloud service, data centre or something else.
- Identify the legal entity. Duties attach to the person providing the service, so group structure matters.
- Reuse telecoms controls. Controls built for the telecoms code may provide useful evidence, but they don't automatically satisfy another regime. Map them to the CAF outcomes or to regulator guidance when published.
- Add the 24-hour route. "As soon as reasonably practicable" processes may not guarantee a 24-hour notification.
- Review shared platforms. An incident on a shared platform could affect telecoms and managed services at the same moment.
- Check contract wording. Customers may ask how you meet their duties.
- Align supplier records. Vendor restrictions under both regimes depend on knowing what you use and where.
See telecommunications under the Bill for more sector detail.
Sources
Frequently asked questions
Providing a public network or service does not by itself make a company an RDSP or RMSP. Other services, such as managed IT, cloud or data centres, can still be caught.
Ofcom, under the Communications Act 2003 as amended by the Telecommunications (Security) Act 2021.
As soon as reasonably practicable for security compromises with a significant effect, or those that could enable one, under section 105K.
No. Existing controls can be useful evidence, but each regime has its own requirements.