UK Telecommunications (Security) Act 2021 r8a: reg.8(1), (2) Reduce unauthorised access: multi-factor authentication, two-person changes, no default credentials, automated changes

What does r8a require?

Providers must take appropriate measures against unauthorised access, in particular: ensure responsible persons understand the network or service; require multi-factor authentication for accounts able to change security critical functions; have significant or manual changes proposed by one authorised person and approved by another responsible person before they are made; avoid default credentials (and treat any used as public); store access information securely; and make changes to security critical functions through automated functions where possible.