UK Telecommunications (Security) Act 2021 M2: M2.01 to M2.06, M6.01 to M6.05 Privileged access basics: review, logging, secure protocols, unique accounts, MFA and no default or hardcoded accounts

Review privileged rights routinely under a role-based least privilege model; log all privileged access over secure, encrypted, authenticated protocols; disable unneeded management protocols and change default passwords at initialisation (M2). Store non-persistent credentials centrally; give every privileged user a unique, unshared account; for accounts able to change security critical functions use a locally generated second factor; give break-glass accounts unique strong credentials per device; and disable default and hardcoded accounts (M6). Due: M2: Tier 1 by 31 March 2024; Tier 2 by 31 March 2025; M6: Tier 1 and Tier 2 by 31 March 2025.