Telecommunications Sector Security Reforms (TSSR)
Australia's telecommunications security obligations, known as the Telecommunications Sector Security Reforms (TSSR): enacted in 2018 in Part 14 of the Telecommunications Act 1997 and, since 4 April 2025, carried in Part 2D of the Security of Critical Infrastructure Act 2018 and the TSRMP Rules 2025. Carriers and carriage service providers with 20,000 or more active services or Commonwealth customers must protect their assets for security and against all hazards, maintain competent supervision and effective control, keep a risk management program meeting a named cyber framework (maturity level two for carriers), and carriers must notify Home Affairs of changes likely to weaken security, with ministerial directions as a last resort.
Telecommunications Sector Security Reforms (TSSR) is a compliance framework from Australia with 5 domains and 20 controls that map to 95 other frameworks. The largest domains are SOCI Act Part 2A and TSRMP Rules Part 3: telecommunications risk management program – Telecommunications Sector Security Reforms (TSSR) (13 controls), SOCI Act Part 2D Division 3 and TSRMP Rules Part 4: notification of changes – Telecommunications Sector Security Reforms (TSSR) (3 controls), SOCI Act Part 2D Division 2: obligation to protect the asset – Telecommunications Sector Security Reforms (TSSR) (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
SOCI Act Part 2A and TSRMP Rules Part 3: telecommunications risk management program – Telecommunications Sector Security Reforms (TSSR)
| Code | Title |
|---|---|
| telecommunications-sector-security-reforms-tssr::30AC-30AD | 30AC and 30AD with TSRMP Rules s 7: adopt, maintain and comply with a risk management program |
| telecommunications-sector-security-reforms-tssr::30AE-30AF | 30AE, 30AF and 30AKA(3) and (5): review the program regularly and keep it up to date |
| telecommunications-sector-security-reforms-tssr::TSRMP-10 | TSRMP Rules s 10: matters to weigh before adopting the program |
| telecommunications-sector-security-reforms-tssr::TSRMP-11(2) | TSRMP Rules s 11(2): cyber and information security hazard process |
| telecommunications-sector-security-reforms-tssr::TSRMP-11(3) | TSRMP Rules s 11(3) and (5): baseline cyber framework for every relevant asset |
| telecommunications-sector-security-reforms-tssr::TSRMP-11(4) | TSRMP Rules s 11(4) and (5): uplifted cyber framework for carrier assets |
| telecommunications-sector-security-reforms-tssr::TSRMP-12 | TSRMP Rules s 12: personnel hazards |
| telecommunications-sector-security-reforms-tssr::TSRMP-13(2) | TSRMP Rules s 13(1) to (3): background checks and notice when a check is no longer needed |
| telecommunications-sector-security-reforms-tssr::TSRMP-13(4) | TSRMP Rules s 13(4): what a suitability assessment must consider |
| telecommunications-sector-security-reforms-tssr::TSRMP-14 | TSRMP Rules s 14: supply chain hazards |
| telecommunications-sector-security-reforms-tssr::TSRMP-15 | TSRMP Rules s 15: physical security and natural hazards |
| telecommunications-sector-security-reforms-tssr::TSRMP-8 | TSRMP Rules s 8: the nine specified material risks |
| telecommunications-sector-security-reforms-tssr::TSRMP-9 | TSRMP Rules s 9: general requirements of the program |
SOCI Act Part 2D Division 2: obligation to protect the asset – Telecommunications Sector Security Reforms (TSSR)
| Code | Title |
|---|---|
| telecommunications-sector-security-reforms-tssr::30EB(2) | 30EB(2): protect the asset for security and against all hazards |
| telecommunications-sector-security-reforms-tssr::30EB(3)(b) | 30EB(3)(b): maintain competent supervision of and effective control over the asset |
SOCI Act Part 2D Division 3 and TSRMP Rules Part 4: notification of changes – Telecommunications Sector Security Reforms (TSSR)
| Code | Title |
|---|---|
| telecommunications-sector-security-reforms-tssr::30EC(2) | 30EC(2): notify the Secretary of changes likely to harm the capacity to protect the asset |
| telecommunications-sector-security-reforms-tssr::30EC(7) | 30EC(4) to (7): answer the Secretary's further-information notices |
| telecommunications-sector-security-reforms-tssr::TSRMP-17 | TSRMP Rules s 17: content of a change notification |
SOCI Act Part 2D Division 4: ministerial directions – Telecommunications Sector Security Reforms (TSSR)
| Code | Title |
|---|---|
| telecommunications-sector-security-reforms-tssr::30EF(5) | 30EF(5): comply with a Minister's direction on use or supply of a carriage service |
SOCI Act s 30AG: annual report – Telecommunications Sector Security Reforms (TSSR)
| Code | Title |
|---|---|
| telecommunications-sector-security-reforms-tssr::30AG(2) | 30AG(2): annual risk management program report, with the telecommunications content |
Your Compliance Coverage
If you comply with Telecommunications Sector Security Reforms (TSSR), you already cover:
Security of Critical Infrastructure Act 2018 (SOCI)
16%
5 controls mapped
Compare →NIST SP 800-53 Rev 5
16%
5 controls mapped
Compare →ISO/IEC 27011:2024
13%
4 controls mapped
Compare →+ 92 more: SOC for Cybersecurity - Cybersecurity Risk Management Examination (9%), Singapore Government Instruction Manual on ICT&SS Management (IM8) (9%)
See all 95 mapped frameworks ↓Maps to 95 other frameworks
Coverage is not the same as your position
This page shows what Telecommunications Sector Security Reforms (TSSR) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Telecommunications Sector Security Reforms (TSSR) and who does it apply to?
Telecommunications Sector Security Reforms (TSSR) is a compliance framework from Australia with 5 domains and 20 controls. Australia's telecommunications security obligations, known as the Telecommunications Sector Security Reforms (TSSR): enacted in 2018 in Part 14 of the Telecommunications Act 1997 and, since 4 April 2025, carried in Part 2D of the Security of Critical Infrastructure Act 2018 and the TSRMP Rules 2025. Carriers and carriage service providers with 20,000 or more active services or Commonwealth customers must protect their assets for security and against all hazards, maintain competent supervision and effective control, keep a risk management program meeting a named cyber framework (maturity level two for carriers), and carriers must notify Home Affairs of changes likely to weaken security, with ministerial directions as a last resort. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Telecommunications Sector Security Reforms (TSSR) actually require?
Telecommunications Sector Security Reforms (TSSR) has 20 controls organised across 5 domains. The largest domains are SOCI Act Part 2A and TSRMP Rules Part 3: telecommunications risk management program – Telecommunications Sector Security Reforms (TSSR) (13 controls), SOCI Act Part 2D Division 3 and TSRMP Rules Part 4: notification of changes – Telecommunications Sector Security Reforms (TSSR) (3 controls), SOCI Act Part 2D Division 2: obligation to protect the asset – Telecommunications Sector Security Reforms (TSSR) (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Telecommunications Sector Security Reforms (TSSR) do I already cover?
Telecommunications Sector Security Reforms (TSSR) maps to 95 other compliance frameworks. The top mapping partners are Security of Critical Infrastructure Act 2018 (SOCI) (16% coverage), NIST SP 800-53 Rev 5 (16% coverage), ISO/IEC 27011:2024 (13% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Telecommunications Sector Security Reforms (TSSR)?
Start your Telecommunications Sector Security Reforms (TSSR) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Telecommunications Sector Security Reforms (TSSR) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 20 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required