Government proposes tougher cybersecurity rules for telecoms

The Telecommunications (Security) Act became law in November last year, putting stronger legal duties on public telecoms providers to defend their networks from cyber threats. 

The government has now launched a public consultation on draft regulations, which outline the measures telecoms providers would need to take to fulfil their duties under the act. It will also lead to the development of a draft code of practice, which focuses on how providers can comply with the regulations.

Under the proposals, telecoms companies would have to protect data stored by their networks and services, and tools which monitor and analyse their networks and services. They’d also be required to monitor public networks to identify potentially dangerous activity and have a deep understanding of their security risks.

The proposals, developed with the National Cyber Security Centre (NCSC), aim to embed good security practices in providers’ long term investment decisions and the day-to-day running of their networks and services.

Its consultation seeks views on plans to place telecoms providers into three tiers via a new code of practice according to size and importance to UK connectivity. This will ensure steps to be taken under the code are applied proportionately and do not put an undue burden on smaller companies.

Commenting on the news, NCSC’s technical director Dr Ian Levy said: “Modern telecoms networks are no longer just critical national infrastructure, they are central to our lives and our economy.

“As our dependence on them grows, we need confidence in their security and reliability which is why I welcome these proposed regulations to fundamentally change the baseline of telecoms security.

“The NCSC has worked closely with DCMS and industry to propose and advise on the most effective measures that telecoms operators can take to ensure the resilience of UK broadband and mobile networks, now and into the future.” 

Overall, the Telecommunications (Security) Act is designed to strengthen the overarching legal duties on providers of UK public telecoms networks and services. 

Companies which fail to comply with the act could face fines of up to 10% of turnover or, in the case of a continuing contravention, £100,000 per day. Ofcom will monitor and assess the security of telecoms providers.