UK Telecommunications (Security) Act 2021 M11: M11.01 to M11.42 Management plane: formal change, ticketed time-bound privileged access, break-glass controls, segregated management plane and hardened privileged access workstations

Make operational changes through a formal change process; hold persistent secrets in hardware-protected central storage; grant privileged access only temporarily against a ticket, revoked automatically when it closes, from least-privilege role templates; use single-use break-glass credentials and clean up after emergencies; record all privileged sessions; administer equipment through a central element manager, with no direct element-to-element management traffic, a management plane segregated by supplier and between access and core, and MFA and authorisation functions treated as network oversight functions; and use privileged access workstations with restricted internet, no corporate email or messaging, secure boot and full disk encryption, application control, 14-day security patching, documented design and secure build, separation of duties, protective monitoring and controlled data import. Due: Tier 1 and Tier 2 by 31 March 2027.