The UK’s communications networks are essential to everyday life. People rely on them to contact friends and family, access online services, make payments and call the emergency services. Businesses and public services also depend on them to operate effectively.
Communications providers need to manage risks including severe weather, power disruption, cyber-attacks, software failures and operational issues, as well as dependencies on wider infrastructure such as power, cloud services, data centres and suppliers.
Today, we have published advice to help consumers prepare for severe weather and communications outages. Alongside that advice, this blog explains Ofcom’s role in supporting resilient communications networks and services, including overseeing how communications providers identify, prepare for and reduce resilience risks.
Resilience does not mean eliminating every possible risk, but providers must manage risks in a way that reflects the nature of their networks and services, the customers who rely on them, and the potential impact of disruption.
How we oversee network and service resilience
Government sets the legislative and policy framework for telecoms resilience, including through the Communications Act 2003 and the Telecommunications (Security) Act 2021. Ofcom is responsible for monitoring providers’ compliance with their resilience and security obligations.
The table below summarises how we do this in practice.
|
What we do |
What this means in practice |
|
Communicate clear expectations upfront |
We publish guidance explaining how we expect providers to comply with their obligations. This includes taking appropriate and proportionate measures to identify and reduce risks, prepare for incidents and security compromises, maintain the availability, performance and functionality of their networks and services, minimise the impact of disruptions when they occur, and report significant incidents. |
|
Monitor how providers are meeting their obligations |
We gather and assess information from providers, including information about incidents, risks and dependencies. This helps us understand how providers are identifying, managing and preparing for resilience risks. |
|
Engage with providers, government and expert bodies |
We work with communications providers, government (including the National Cyber Security Centre), other regulators (domestic and international) and expert bodies to build our understanding of risks, including cross-sector dependencies such as power. |
|
Investigate and enforce where appropriate |
Where we identify potential non-compliance, we can investigate and, where appropriate, take enforcement action. We also use evidence from incidents and wider market developments to decide whether our guidance or supervisory approach needs to evolve. |
Resilience is a shared responsibility
Good telecoms resilience cannot be delivered by Ofcom alone. Communications providers are responsible for designing, operating and restoring their networks and services. Government sets the overall legislative and policy framework. Other sectors, particularly energy, also play an important role because communications networks depend on them to operate effectively.
In practice, this means our role varies depending on the type of risk. For example, for weather-related or operational incidents, we gather evidence, assess how providers prepared and responded, and use lessons learned to inform future supervision. For cross-sector dependencies, such as power, we work with government, industry and other regulators to improve understanding and identify where further coordination may be needed.
Our approach will continue to evolve as the risk landscape changes. We will work with government, industry, other regulators and expert bodies to strengthen our understanding of resilience risks, support effective preparedness and make sure providers are meeting their obligations.