HANSARD
Revised Telecommunications Security Code of Practice
- I am repeating the following written ministerial statement made today in the other place by my noble Friend, the Parliamentary Under-Secretary of State for Digital Economy, Baroness Lloyd of Effra.The Government have today issued the revised telecommunications security code of practice, under sections 105E and 105F of the Communications Act 2003.The draft revised code of practice was laid before Parliament on 3 June 2026, and the statutory period required under section 105F of the Communications Act 2003 has now ended without either House having resolved not to approve it.The UK telecoms supply chain review 2019 identified the need to establish an enhanced legislative framework for telecoms security. In response, the Government established a stronger telecoms security framework, which consists of:The Telecommunications (Security) Act 2021—primary legislation which established new duties on public telecoms providers to prevent security compromises within their networks and services.The Electronic Communications (Security Measures) Regulations 2022—secondary legislation setting out specific cyber security requirements with which the public telecoms providers must comply.The Telecommunications Security Code of Practice 2022—technical guidance on how providers can comply with the requirements set out in the regulations.The UK’s future prosperity rests on the public electronic communications networks and services—PECN and PECS—that provide our telecoms and internet connectivity. It is important therefore that the telecoms security framework keeps pace with the scale of the threat to UK telecoms networks and services, adapting to evolving threats to network security and new innovations in telecoms technology.This revised code updates some areas of the technical guidance provided within the “Telecommunications Security Code of Practice 2022” to:Provide further clarity on specific security measures: in response to feedback from providers, the revised code includes updates intended to give clearer direction to support compliance with legal duties in the legislation. This includes clearer guidance on the use of privileged access workstations, approaches to security testing, and the encryption and protection of data.Reflect evolving technology: since 2022, increased use of certain technologies warrants updated technical guidance to support safe adoption. The revised code includes new security guidance on the secure use of public cloud, automation, and application programming interfaces.Reflect emerging security threats: recent hostile state linked attacks underline growing risks. Guidance to public telecoms providers must evolve to help ensure providers respond appropriately. The revised code includes updates to reflect the need for providers to take appropriate and proportionate steps to protect their networks against such threats.