UK Telecommunications (Security) Act 2021 M16: M16.01 to M16.22, M20.01 Security monitoring and analysis: skilled analysts, threat hunting, 13-month logs, near real-time analysis within five minutes and anomaly models

Use skilled dedicated resources (in-house or outsourced) to analyse security activity and hunt threats; keep asset and monitoring systems current with normal behaviour baselines; tell monitoring teams about security-relevant changes; monitor interfaces between network function groups; treat logging systems as network oversight functions, protect log integrity, attribute actions on log data, synchronise time and alarm when logs stop; retain security critical function logs for 13 months; deploy network and host sensors; collect access events; enrich logs; audit configurations automatically; process logs in near real time (within five minutes); review access logs against tickets; investigate anomalies promptly; and model normal traffic (M16). Use automated tools to prioritise events for manual analysis (M20). Due: M16: Tier 1 and Tier 2 by 31 March 2027; M20: Tier 1 and Tier 2 by 31 March 2028.