Consultation: Proposals to update our General Statement of Policy under section 105Y of the Communications Act 2003

We are proposing to update our guidance for communications providers regarding how we exercise our functions to seek to ensure that they comply with their duties under the security framework.

This guidance explains how we will go about our supervisory and enforcement activity and sets out our expectations for communications providers about which security compromises to report, as well as the process for reporting them.

The Telecommunications Security Act established a robust framework to safeguard public electronic communications networks and services across the UK. Under this legislation, Ofcom is responsible for several key functions, including publishing a statement outlining our general policy. This statement helps guide communications providers on how Ofcom will carry out its responsibilities. The initial guidance was released in 2022, before the new measures took effect. Now with more than three years of practical experience under the security framework, we have a clearer understanding of its impact and effectiveness. This insight has led us to propose updates that will improve the consistency of security compromise incident reporting, especially for mobile services, and reflect the evolution of our approach to supervising provider compliance, which continues to strike a balance between a wide range of security measures and focused attention on the areas of greatest risk. Of particular note to mobile network users are our proposals for mobile incident and rural reporting, which recognise that outages in urban and rural areas affect users differently.

Overall, these revisions are designed to further strengthen the resilience of the UK’s telecommunications networks, enhance understanding of sector-wide risks, and keep our regulation focused and effective.

Responding to this consultation

Please submit responses using the response form no later than 5pm 4 August 2026.