UK’s Telecommunications Security Act (TSA) Code of Practice

In response to escalating geopolitical tensions and increasing cyber threats, the UK government has introduced the Telecommunications Security Act (TSA) as part of efforts to bolster national telecommunications security. The TSA is formulated to protect critical infrastructures and emphasizes the crucial importance of Privileged Access Management (PAM) in mitigating potential threats. It imposes stringent compliance deadlines on telecommunications providers, necessitating prompt adoption of robust PAM solutions. This article examines the complexities of the TSA, analyzing its ramifications and providing recommendations for achieving compliance.

What is the Telecommunications Security Framework (TSF)?

At the core of the Telecommunications Security Framework (TSF) lies the Telecommunications Security Act 2021 (TSA), which establishes a legal framework for the contemporary protection of telecommunications infrastructures. The TSA delineates obligations and entitlements for organizations and regulators, necessitating telecom providers to identify security vulnerabilities and implement adequate safeguards against breaches. It enforces mandatory reporting and mitigation strategies, impacting telecom companies across three tiers, underscoring the imperative practices for stringent security measures.

Who Does the TSA Impact?

The scope of the TSA encompasses telecommunications companies, particularly those offering public electronic communications networks (PECN) and services (PECS). Additionally, it extends its purview to the telecommunications supply chain to address the heightened integration of third parties. Companies subject to these regulations are categorized into three tiers based on their commercial magnitude:

Tier 1: Comprising major national public telecom providers with turnovers exceeding £1 billion.

Tier 2: Encompassing medium-sized providers with turnovers ranging from £50 million to £1 billion.

Tier 3: Including smaller providers with turnovers less than £50 million, excluding micro-enterprises.

When Does TSA Come Into Force?

The Telecommunications Security Act (TSA) enforces distinct commencement dates for telecom providers based on their tier classification. Tier 1 providers are mandated to comply by March 31st, 2024, while Tier 2 providers are granted an extension until March 31st, 2025. Although Tier 3 providers are not obligated, adhering to the Code of Practice (CoP) is advisable to ensure compliance, especially in collaborations with Tier 1 or 2 providers.

What is the cost of Non-compliance With the TSA?

Non-compliance with the TSA attracts substantial penalties. Providers failing to fulfill their security obligations may face fines of up to 10% of their relevant turnover. Persistent non-compliance could result in daily fines of £100,000. Moreover, refusal to furnish requisite information or clarify non-compliance with the CoP could lead to fines of up to £10 million, with daily penalties of £50,000 for persistent breaches.

How Kron can help?

The realm of TSA compliance is expansive. To streamline discussion, we'll spotlight key domains where assistance from Kron solutions can facilitate the journey towards compliance. Let’s explore the areas for assistance in the following blog post. (Kron Privileged Access Management (PAM) for Achieving TSA Compliance)