UK Telecommunications (Security) Act 2021 s105A: s.105A Take appropriate and proportionate measures to identify, reduce and prepare for security compromises

What does s105A require?

Every provider of a public electronic communications network or service must take appropriate and proportionate measures to identify the risks of security compromises, reduce those risks, and prepare for compromises occurring. A security compromise is defined widely: anything compromising availability, performance or functionality; unauthorised access, interference or exploitation (or anything enabling it); loss of confidentiality of signals or of stored data connected with the network or service; loss or unauthorised alteration of signals or stored data; and anything causing a connected compromise in another network or service. Lawful conduct under the listed investigatory powers enactments is excluded, and the duty yields where it would conflict with them (s.105X).