UK Telecommunications (Security) Act 2021 r3a: reg.3(1) to (4) Design, redesign and maintain the network to reduce security risk, and record risks and exposure yearly

Network providers must design and build new parts, redevelop existing parts, and maintain the network so as to reduce the risk of security compromises. In particular they must identify and reduce risks for the network and each function, having regard to whether it holds sensitive data, is a security critical function, where its equipment or data is located and how exposed it is to incoming signals; make a written record of those risks at least every 12 months; identify and record the network's exposure to incoming signals; and keep those records for at least 3 years.