UK Telecommunications (Security) Act 2021
Telecommunications Security Code of Practice v1.1 (July 2026): measure groups and their Tier 1 and Tier 2 dates – UK Telecommunications (Security) Act 2021

UK Telecommunications (Security) Act 2021 M21: 01 to M21.07 Retaining national resilience: UK-located oversight functions, UK capability, offshore data governance and one month of UK connectivity without international links

What does M21 require?

Plan contingencies for new countries being added to the Schedule; normally locate network oversight function equipment in the UK operated by UK-based staff; retain a UK-based technical capability that understands the network and its risks; list offshore data locations and manage their risk; take decisions to hold offshore the data of more than 100,000 UK subscribers, operation of large parts of the network or oversight functions at board level in writing; be able to maintain UK fixed and mobile data connectivity to UK peering points, mobile voice and text messaging for one month if international connections are lost; and be able to transfer into the UK functions needed to keep operating. Due: Tier 1 and Tier 2 by 31 March 2028.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Telecommunications Security Code of Practice v1.1 (July 2026): measure groups and their Tier 1 and Tier 2 dates – UK Telecommunications (Security) Act 2021

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.