UK Telecommunications (Security) Act 2021 M10c: M10.36 to M10.54 Equipment suppliers and patching: security declarations, secure deployment guidance, support periods, vulnerability fixes and 14-day patching of exploited flaws

Require network equipment suppliers to provide a security declaration signed off at an appropriate level (with product line differences and evidence behind any certification), secure deployment guidance, support for the contract period written into the contract, and timely fixes for vulnerabilities; record supplier failures; deploy equipment secure by default to the supplier's recommended configuration or risk-assess deviations; mitigate equipment risks; update supported equipment and deploy security patches in proportion to risk under Table 2, and within 14 days where a vulnerability is exposed and actively exploited; keep equipment compliant after upgrades; and verify suppliers have a vulnerability disclosure policy. Due: New contracts after 31 March 2024 (Tier 1) or 31 March 2025 (Tier 2); all contracts by 31 March 2027.