UK Telecommunications (Security) Act 2021 r10: reg.10 Govern security from board level: policy, incident categorisation, risk reporting, post-incident review and insider risk

Providers must manage the people responsible for security appropriately, in particular by establishing and regularly reviewing a security policy that includes incident management at varying severities, a standard way of categorising incidents, channels for reporting risks to an appropriate governance level, and post-incident reviews considered at that level to inform policy; and by giving a person or committee at board level responsibility for supervising the policy and managing those responsible. Providers must also identify and reduce the risk of compromise from unauthorised conduct by people involved in providing the network or service.