UK Telecommunications (Security) Act 2021 M15: M15.01 to M15.13 Network oversight functions: patched, rebuilt from known-good state, on trusted platforms, managed only from privileged workstations and monitored

Lock down and patch network oversight functions in proportion to risk; rebuild them from a known-good state every 24 months and the workstations or jump boxes that administer them every year; run them on trusted platforms, never in physically insecure locations; have them managed by a minimal set of trusted users, from privileged access workstations through dedicated management functions on a separate management plane, with pre-authorised access; monitor changes in real time and watch for exploitation; and let them reach services only over internal interfaces. Due: Tier 1 and Tier 2 by 31 March 2027.