Skip to content

Consultation now open on updating the Telecoms Security Code of Practice 

28 August 20252 min read
News
Consultation now open on updating the Telecoms Security Code of Practice 

DSIT has launched a formal consultation on updates to the Telecommunications Security Code of Practice. This follows extensive feedback from providers, Ofcom and the NCSC since the Telecommunications (Security) Act 2021 (TSA) came into force, alongside the impact of new technologies and a changing threat landscape. 

From its introduction, the Code was designed to be a “live” document – to be updated to reflect emerging risks and technological change. But this review is the first major update since the Code and accompanying Electronic Communications (Security Measures) Regulations 2022 came into effect, and is therefore a major opportunity for members to feedback to DSIT on the TSA.  

Drivers for change 

The government cites three main reasons for revisiting the Code now: 

  • Volume of feedback: providers and regulators have identified areas where the Code lacks clarity or alignment with industry practice. 

  • Evolving technologies: the increasing adoption of eSIMs, widespread use of APIs, and growing automation in networks all present new risks that the current Code does not fully address. 

  • Threat landscape: heightened hostile-state cyber activity against telecoms globally, and the need to ensure the Code reflects the latest NCSC guidance and the updated Cyber Assessment Framework (CAF v4.0). 

Key proposals 

The consultation puts forward a range of amendments and additions, grouped under three themes: 

1. Greater clarity 

  • Updated definitions and glossary terms. 

  • Clearer guidance on security critical functions, third-party administrators, and service accounts. 

2. Holistic, risk-based approach 

  • Stronger emphasis that the Code should be implemented end-to-end, not treated as isolated technical measures. 

  • New references to early implementation of measures where feasible, rather than waiting for regulatory deadlines. 

3. New or strengthened measures 

  • A structured approach to Privileged Access Workstations (PAWs), aligned with NCSC and ETSI guidance. 

  • Guidance on eSIM provisioning and SIM-swap protection. 

  • New controls for network APIs to reduce exposure and harden authentication. 

  • Expectations for securing automation pipelines, including validation of inputs and outputs. 

  • Expanded measures on testing, with a move towards continuous, automated, and risk-based approaches. 

  • Updates to Annex C to align with the NCSC’s CAF v4.0. 

Consultation process 

The government is seeking input specifically on the proposed updates, not on the wider Code. Responses will help shape the next iteration of the framework and ensure guidance remains practical, proportionate and effective in light of current threats. 

The consultation closes on 22 October 2025. Submissions must be made via the government’s online portal. 

techUK – Have your say 

Join techUK’s Telecoms Security and Diversification Working Group to have your say on our response to this consultation on proposed changes to the TSA Code of Practice. This working group will be our main forum through which our engagement with DSIT and submission will be shaped. Feel free to reach out to the team below if you have any urgent questions.