UK Telecommunications (Security) Act 2021 M10a: M10.01 to M10.19 Third party supplier contracts: records, shared responsibility, control of data, 48-hour incident notice, 30-day root cause and managed service exit

Record suppliers, their subcontractors and major components; express security needs in contracts with a documented shared-responsibility model and aligned incident processes; retain control and oversight of network and user data, give suppliers only what they need, avoid transferring control and protect data that leaves your control over encrypted, authenticated channels; oblige suppliers to notify security incidents (including in their own development or corporate networks) within 48 hours, find and report root causes within 30 days and fix failings, with mitigation and a penalty-free break clause if they do not; flow security measures down to third party administrators; keep the right to vet and remove administrator staff; and keep enough in-house expertise and an exit plan to re-tender or bring managed services back in-house. Due: New contracts after 31 March 2024 (Tier 1) or 31 March 2025 (Tier 2); all contracts by 31 March 2027.