The UK Government has published the Revised Telecommunications Security Code of Practice 2026 (Version 1.1), establishing comprehensive technical and procedural security measures for public telecommunications providers. This Code is legally linked to the Telecommunications (Security) Act 2021 and the Electronic Communications (Security Measures) Regulations 2022, and aims to address evolving cyber threats and technological advancements in the telecom sector.

The Code mandates a risk-based, holistic approach to network and service security, covering areas such as network and system security, risk management, vendor and supply chain security, incident reporting, and national resilience. It introduces a tiering system that differentiates requirements and implementation timelines based on the provider's commercial scale, with stricter and faster obligations for larger operators.

A notable feature is Annex B, which details the Vendor Security Assessment (VSA) process, setting rigorous criteria for the evaluation and ongoing monitoring of vendors, manufacturers, and integrators. The Code also specifies obligations for secure management of privileged access, protection of critical functions, SIM and eSIM security, and robust backup and recovery procedures.

Implementation deadlines are phased from 2024 to 2029, and Ofcom is empowered to monitor compliance, enforce remedial actions, and impose financial penalties for non-compliance. The Code will be periodically reviewed and updated to reflect new threats and technologies, with input from the National Cyber Security Centre (NCSC) and industry consultation.

This regulatory framework significantly strengthens the security and resilience of the UK's critical telecom infrastructure, directly impacting operators, manufacturers, service providers, and the broader supply chain.

This is a High Impact regulatory development. The Code of Practice is mandatory for large and medium-sized public telecoms providers and introduces detailed, enforceable security requirements across the entire telecommunications ecosystem.

Key reasons for High Impact:

• Legally binding technical and procedural security measures for networks, services, and supply chain.
• Strict obligations for vendor assessment, privileged access management, SIM/eSIM security, and incident reporting.
• Tiered implementation deadlines affecting all major operators and their suppliers.
• Ofcom empowered to enforce compliance and issue financial penalties.
• Direct impact on product approval, procurement, operation, and ongoing compliance for a wide range of devices and services.

Who is affected?

• Public telecoms operators (PECN/PECS)
• Network equipment manufacturers and suppliers
• SIM/eSIM vendors
• System integrators and managed service providers
• Testing laboratories and cybersecurity service providers

Conclusion:

All major stakeholders in the UK telecom sector must review and update their compliance programs, procurement processes, and technical controls to meet the new Code of Practice requirements. Failure to comply may result in enforcement actions and significant business disruption.