Understanding the TSA Framework
The Telecommunications (Security) Act 2021 came into force on 1 October 2022, creating a new security framework for UK public electronic communications networks and services. It works alongside the Electronic Communications (Security Measures) Regulations 2022 and an Ofcom-issued Code of Practice.
The framework establishes three key obligations:
- General security duty — Take appropriate and proportionate measures to identify security risks and reduce their occurrence and impact
- Specific security duties — Comply with detailed requirements set out in regulations
- Breach notification — Report significant security incidents to Ofcom
Tier Classification
Providers are classified into three tiers based on their annual relevant turnover and the criticality of their services:
| Tier | Revenue Threshold | Mandatory Measures | Recommended Measures | Example Providers |
|---|---|---|---|---|
| Tier 1 | >£1 billion | 65 (all) | 0 | BT, Virgin Media O2, Vodafone, Three |
| Tier 2 | £50m – £1bn | 52 | 13 | Sky, TalkTalk, Hyperoptic, Cityfibre |
| Tier 3 | <£50 million | 38 | 27 | Regional ISPs, Channel Partners, Resellers |
Security Measures by Category
The Code of Practice groups measures into these categories. Here's what applies to each tier:
A. Governance & Risk Management
A1. Security Responsibility
Designate a person responsible for security at board level. Mandatory: All Tiers
A2. Risk Assessment
Conduct regular security risk assessments covering network, services, and supply chain. Mandatory: All Tiers
A3. Security Strategy
Maintain documented security strategy reviewed annually. Mandatory: All Tiers
A4. Independent Audit
Commission external security audits. Mandatory: Tier 1 & 2 | Recommended: Tier 3
B. Network Security
B1. Network Segmentation
Implement logical separation between network functions. Mandatory: All Tiers
B2. Access Control
Role-based access with multi-factor authentication for admin functions. Mandatory: All Tiers
B3. Zero Trust Architecture
Implement zero trust principles for network access. Mandatory: Tier 1 | Recommended: Tier 2 & 3
B4. Patch Management
Critical patches within 14 days, others within 30 days. Mandatory: All Tiers
C. Supply Chain Security
C1. Vendor Assessment
Assess security of suppliers before and during contracts. Mandatory: All Tiers
C2. High-risk Vendors
Exclude designated high-risk vendors from core network by 2027. Mandatory: All Tiers
C3. Supply Chain Audit
Regular audits of critical supplier security. Mandatory: Tier 1 | Recommended: Tier 2 & 3
D. Monitoring & Incident Response
D1. Security Monitoring
24/7 monitoring capability for security events. Mandatory: All Tiers
D2. Incident Response
Documented incident response procedures tested annually. Mandatory: All Tiers
D3. Breach Notification
Notify Ofcom within 72 hours of significant incidents. Mandatory: All Tiers
D4. SOC Capability
Dedicated Security Operations Centre. Mandatory: Tier 1 | Recommended: Tier 2 & 3
Implementation Timeline
Tier 3 Quick Compliance Checklist
For smaller providers (most resellers and channel partners), focus on these 38 mandatory measures:
- Board-level security owner — Designate responsibility (can be combined with other duties)
- Annual risk assessment — Document network risks and mitigations
- Security policy — Written policy covering all 38 areas
- Access control — MFA for admin access, role-based permissions
- Patch management — Documented process, critical patches <14 days
- Network segmentation — Separate management from customer traffic
- Monitoring — Log security events, retain 12 months minimum
- Incident response — Documented procedures, annual testing
- Vendor security — Assess suppliers, contractual security clauses
- Breach notification — Process to notify Ofcom within 72 hours
Ofcom Enforcement Powers
Ofcom has significant enforcement powers under TSA:
- Information requests — Ofcom can require providers to supply information about security compliance
- Inspections — Physical and remote inspections of network security
- Directions — Require specific security improvements within set timeframes
- Financial penalties — Up to 10% of relevant annual turnover
- Daily penalties — £100,000/day for continuing non-compliance
- Suspension — Suspend entitlement to provide services (extreme cases)
Part of the UK Telecom Compliance Hub
Return to the main compliance guide for the complete framework covering Ofcom GC, PECR, UK GDPR, and more.
Need TSA Compliance Support?
Heimdell Tech Ai provides automated compliance monitoring and documentation for Tier 2 and Tier 3 providers. Reduce your compliance burden by 80%.
Request Assessment