The UK Telecoms Security Act (TSA) turned telecom security from a self-regulated afterthought into a legal obligation backed by fines of up to 10% of global turnover. Ofcom enforces it. The NCSC advises on it. And if your network handles voice, data, or connectivity for UK users, you need to comply with it.
Table of contents
What the TSA Is and Why It Exists
The Telecoms Security Act received Royal Assent in November 2021. Before the TSA, telecom security in the UK was largely self-regulated – operators followed general cybersecurity practices with minimal oversight. The rise of state-sponsored threats, supply chain vulnerabilities (particularly around 5G vendors like Huawei), and attacks targeting telecom infrastructure forced the government to act.
The TSA shifts telecom security from reactive to proactive. Operators must continuously assess and address risks rather than respond after breaches happen. The Act gives Ofcom direct enforcement powers and creates a legal framework that holds operators accountable for the security of their networks.
Who Must Comply
The TSA applies broadly across the telecom ecosystem:
- Public telecom network providers (mobile and broadband operators)
- Private network providers offering business or organizational networks
- Equipment suppliers providing hardware and software for telecom networks
- Managed service providers offering security or infrastructure management
The infrastructure covered includes 5G networks, broadband and mobile networks, cloud-based telecom services, and data centers and interconnects. If you are involved in telecom service delivery, network management, or infrastructure provision, the TSA applies to you.
Compliance Timeline
The TSA follows a phased rollout based on operator size:
- November 2021 – TSA becomes law
- October 2022 – Telecoms Security Requirements (TSRs) published
- March 2024 – Tier 1 operators (revenue over 1bn) must implement initial measures (M1-M5)
- March 2025 – Tier 2 operators (revenue over 50m or CNI) must implement initial measures; Tier 1 completes M6-M9
- March 2027 – Full compliance for all providers across all contracts (M10+)
The Telecoms Security Requirements
The TSRs define the specific security measures operators must implement. At a high level, they cover five areas:
1. Network security – encryption for data in transit and at rest, access controls for critical network components, asset inventory of all externally-facing systems.
2. Network integrity – regular penetration testing and security audits (at least every two years per M1.02), secure software development practices, exposed edge restrictions.
3. Supply chain security – restrictions on high-risk vendors, mandatory risk assessments for all suppliers, NCSC vendor assessment guidance, end-of-life equipment tracking and replacement planning.
4. Access control – regular privilege reviews (M2.01), logging of all privileged access (M2.02), encrypted authenticated protocols, default password elimination, MFA with locally-generated second factors for security-critical functions (M6.03), unique credentials per user (M6.02).
5. Incident reporting – security incidents reported to Ofcom within strict timeframes, coordination with the NCSC for threat intelligence, regular incident response drills.
For the full list of technical measures, see the official Section 3: Technical guidance measures.
Pentesting Under the TSA
Penetration testing is explicitly required under TSR measure M1.02: security testing on externally-facing systems must be performed at least every two years, and after any significant change. For third-party equipment, M8.01-M8.04 require security testing before procurement, including negative testing and fuzzing of equipment interfaces.
In practice, TSA compliance demands several types of testing:
- External pentesting – simulating external attackers targeting network perimeters
- Internal pentesting – identifying insider threats and misconfigurations within the network
- Wireless and IoT testing – securing telecom Wi-Fi networks and connected infrastructure
- Cloud security testing – validating security of virtualized telecom services
- Red team assessments – full-scale attack simulations testing real-world resilience
Testing must be repeatable, performed independently of the equipment supplier, and clearly applicable to the provider’s specific deployment (M8.03). Vendors cannot mark their own homework.
This is not a one-time exercise. Telecom providers should conduct pentests at least annually or after major network upgrades, incorporate results into risk assessments and compliance reports, remediate findings promptly and retest to confirm fixes, and use results to inform long-term security strategy.
Penalties for Non-Compliance
Ofcom has real teeth under the TSA:
- Fines up to 10% of global annual turnover – with tiered penalties based on severity and frequency of violations
- Public disclosure – Ofcom can publicly report non-compliance findings, directly damaging an operator’s reputation
- Increased regulatory scrutiny – non-compliant operators face more frequent audits and inspections
- Restricted market access – potential exclusion from government contracts and enterprise deals
- License suspension or revocation – in extreme cases, Ofcom can prevent an operator from providing telecom services entirely
For Tier 1 operators with billions in revenue, 10% of turnover represents a potentially existential penalty. The TSA is designed to make non-compliance more expensive than compliance.
Relationship with Other Frameworks
The TSA does not exist in isolation. It aligns with several other frameworks, and compliance overlap means operators can often satisfy multiple requirements with the same controls:
- National Cyber Security Strategy (NCSS) – both aim to strengthen UK cyber resilience; the TSA is the telecom-specific implementation
- NIS Directive – covers multiple sectors including telecoms; the TSA provides sector-specific detail on top of NIS requirements
- ISO 27001 – the TSA’s risk management and audit requirements map directly to ISO 27001’s ISMS principles
- GDPR – both require security controls, incident reporting, and data protection; TSA secures infrastructure while GDPR safeguards personal data
- Cyber Essentials and NCSC CAF – complementary frameworks that reinforce the broader security strategy
How FORTBRIDGE Can Help
FORTBRIDGE provides penetration testing services tailored to TSA compliance. We test telecom networks, cloud infrastructure, APIs, and third-party integrations against the specific TSR measures – delivering reports that map directly to the requirements Ofcom expects to see.
Contact us today to discuss how we can help secure your telecom infrastructure and meet TSA compliance requirements.
References
Telecommunications Security Code of Practice – Section 3: Technical guidance measures
About Post Author
