TheArtOfService
Back to Frameworks

Telecommunications Sector Security Reforms (TSSR)

Self-Assess
Australia
v2018
6 domains
12 controls

The Telecommunications Sector Security Reforms, enacted through Part 14 of the Telecommunications Act 1997, require carriers and carriage service providers to protect Australian telecommunications networks from national security risks. Commenced September 2018. Administered by the Department of Home Affairs.

Verified

Telecommunications Sector Security Reforms (TSSR) is a compliance framework from Australia with 6 domains and 12 controls that map to 105 other frameworks. The largest domains are TSSR: Network Information Protection (3 controls), TSSR: Notification Obligation and Ministerial Powers (3 controls), TSSR: Security Obligation (3 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Information Sharing

1 controls
Controls in the Information Sharing domain of Telecommunications Sector Security Reforms (TSSR) — 1 controls
CodeTitle
AUTSSR-3Information Sharing and Direction Authority

Security Capability

1 controls
Controls in the Security Capability domain of Telecommunications Sector Security Reforms (TSSR) — 1 controls
CodeTitle
AUTSSR-2Security Capability Plan and Risk Management

Security Obligation

1 controls
Controls in the Security Obligation domain of Telecommunications Sector Security Reforms (TSSR) — 1 controls
CodeTitle
AUTSSR-1Security Obligation and Notification

TSSR: Network Information Protection

3 controls
Controls in the TSSR: Network Information Protection domain of Telecommunications Sector Security Reforms (TSSR) — 3 controls
CodeTitle
TSSR-INFO-1Network Data Protection
TSSR-INFO-2Stored Communications Security
TSSR-INFO-3Lawful Interception Capability

TSSR: Notification Obligation and Ministerial Powers

3 controls
Controls in the TSSR: Notification Obligation and Ministerial Powers domain of Telecommunications Sector Security Reforms (TSSR) — 3 controls
CodeTitle
TSSR-NOT-1Changes to Networks and Facilities
TSSR-NOT-2Security Incident Notification
TSSR-NOT-3Ministerial Direction Power

TSSR: Security Obligation

3 controls
Controls in the TSSR: Security Obligation domain of Telecommunications Sector Security Reforms (TSSR) — 3 controls
CodeTitle
TSSR-SEC-1Security Capability Obligation
TSSR-SEC-2Competent Supervision and Effective Control
TSSR-SEC-3National Security Risk Management

Your Compliance Coverage

If you comply with Telecommunications Sector Security Reforms (TSSR), you already cover:

Security of Critical Infrastructure Act 2018 (SOCI)

42%

5 controls mapped

Compare →

NIST SP 800-53 Rev 5

42%

5 controls mapped

Compare →

ISO/IEC 27011:2024

33%

4 controls mapped

Compare →

+ 102 more: ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence (33%), SOC for Cybersecurity - Cybersecurity Risk Management Examination (25%)

See all 105 mapped frameworks ↓

Maps to 105 other frameworks

12 total controls
Security of Critical Infrastructure Act 2018 (SOCI)
5 source controls mapped|7 target controls covered
42%
NIST SP 800-53 Rev 5
5 source controls mapped|7 target controls covered
42%
ISO/IEC 27011:2024
4 source controls mapped|6 target controls covered
33%
ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence
4 source controls mapped|2 target controls covered
33%
SOC for Cybersecurity - Cybersecurity Risk Management Examination
3 source controls mapped|5 target controls covered
25%
Singapore Government Instruction Manual on ICT&SS Management (IM8)
3 source controls mapped|4 target controls covered
25%
ISO 19011
3 source controls mapped|1 target controls covered
25%
ISO 27017
2 source controls mapped|4 target controls covered
17%
Virginia CDPA
2 source controls mapped|1 target controls covered
17%
Uruguay DPL
2 source controls mapped|2 target controls covered
17%
UK GDPR (UK General Data Protection Regulation)
2 source controls mapped|2 target controls covered
17%
UK AI Regulation Framework
2 source controls mapped|2 target controls covered
17%
Texas Data Privacy Act
2 source controls mapped|2 target controls covered
17%
Taiwan PDPA
2 source controls mapped|1 target controls covered
17%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
2 source controls mapped|2 target controls covered
17%
ISO 27018
2 source controls mapped|4 target controls covered
17%
Barbados Data Protection Act 2019
2 source controls mapped|3 target controls covered
17%
ISO/IEC 27400:2022
2 source controls mapped|3 target controls covered
17%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
2 source controls mapped|8 target controls covered
17%
NIST SP 800-190
2 source controls mapped|4 target controls covered
17%
ISO/IEC 23894:2023
2 source controls mapped|4 target controls covered
17%
Saudi Arabia PDPL
2 source controls mapped|4 target controls covered
17%
NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices
2 source controls mapped|2 target controls covered
17%
Bahrain PDPL
2 source controls mapped|4 target controls covered
17%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
2 source controls mapped|2 target controls covered
17%
ASD Strategies to Mitigate Cyber Security Incidents
2 source controls mapped|3 target controls covered
17%
APRA CPS 234
2 source controls mapped|4 target controls covered
17%
ISO 27019
2 source controls mapped|4 target controls covered
17%
TISAX - Trusted Information Security Assessment Exchange
2 source controls mapped|3 target controls covered
17%
PCI P2PE
2 source controls mapped|6 target controls covered
17%
PCI SSF
2 source controls mapped|6 target controls covered
17%
NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements
2 source controls mapped|4 target controls covered
17%
EASA Part-IS - Information Security in Aviation
2 source controls mapped|6 target controls covered
17%
IEC 62443
2 source controls mapped|4 target controls covered
17%
FFIEC IT Examination Handbook
2 source controls mapped|6 target controls covered
17%
ISO 22320:2018
2 source controls mapped|4 target controls covered
17%
SSAE 18 - Attestation Standards (SOC Reporting)
2 source controls mapped|3 target controls covered
17%
API 1164
2 source controls mapped|4 target controls covered
17%
Annex 11 to EU GMP - Computerised Systems
2 source controls mapped|2 target controls covered
17%
ISO 28001:2007 Supply Chain Security Management
2 source controls mapped|2 target controls covered
17%
NIST SP 1800-32
2 source controls mapped|4 target controls covered
17%
FFIEC Cybersecurity Assessment Tool (CAT)
2 source controls mapped|3 target controls covered
17%
APRA CPS 230 Operational Risk Management
2 source controls mapped|4 target controls covered
17%
PCI PIN Security
2 source controls mapped|6 target controls covered
17%
NIST Cybersecurity Framework 2.0
2 source controls mapped|6 target controls covered
17%
South Korea ISMS-P
2 source controls mapped|2 target controls covered
17%
UNESCO Recommendation on the Ethics of AI
1 source controls mapped|1 target controls covered
8%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
1 source controls mapped|3 target controls covered
8%
US Consumer Product Safety Commission (CPSC) - Connected Product Safety
1 source controls mapped|1 target controls covered
8%
TEFCA - Trusted Exchange Framework and Common Agreement
1 source controls mapped|1 target controls covered
8%
ISO 27799
1 source controls mapped|3 target controls covered
8%
GDPR
1 source controls mapped|3 target controls covered
8%
Nebraska Data Privacy Act
1 source controls mapped|2 target controls covered
8%
Sweden Data Protection Act (Dataskyddslag, 2018:218)
1 source controls mapped|2 target controls covered
8%
Azerbaijan Law on Personal Data (2010)
1 source controls mapped|2 target controls covered
8%
UK Age Appropriate Design Code (Children's Code)
1 source controls mapped|2 target controls covered
8%
ISO 13485
1 source controls mapped|3 target controls covered
8%
ISO 26000:2010
1 source controls mapped|1 target controls covered
8%
Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014)
1 source controls mapped|1 target controls covered
8%
South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics
1 source controls mapped|1 target controls covered
8%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
1 source controls mapped|1 target controls covered
8%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
1 source controls mapped|1 target controls covered
8%
Uganda Data Protection and Privacy Act (2019)
1 source controls mapped|3 target controls covered
8%
US ITAR and EAR - Export Control and Data Security
1 source controls mapped|1 target controls covered
8%
ISO/IEC 27010:2015
1 source controls mapped|1 target controls covered
8%
SOC 2
1 source controls mapped|2 target controls covered
8%
ASIS SPC.1-2009 - Organizational Resilience Standard
1 source controls mapped|1 target controls covered
8%
NIST SP 800-171
1 source controls mapped|1 target controls covered
8%
BSI IT-Grundschutz
1 source controls mapped|3 target controls covered
8%
SANS Incident Handler's Handbook and PICERL Methodology
1 source controls mapped|3 target controls covered
8%
Canada ITSG-33 - IT Security Risk Management
1 source controls mapped|1 target controls covered
8%
APPI
1 source controls mapped|2 target controls covered
8%
COSO Internal Control - Integrated Framework (2013)
1 source controls mapped|1 target controls covered
8%
NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management
1 source controls mapped|1 target controls covered
8%
ITIL 4
1 source controls mapped|1 target controls covered
8%
AICPA Privacy Management Framework (PMF)
1 source controls mapped|1 target controls covered
8%
NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity
1 source controls mapped|1 target controls covered
8%
ISO 20000-1
1 source controls mapped|1 target controls covered
8%
UK Open Banking Standard
1 source controls mapped|1 target controls covered
8%
ISO/IEC 30111:2019
1 source controls mapped|1 target controls covered
8%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
1 source controls mapped|1 target controls covered
8%
UK Telecommunications (Security) Act 2021
1 source controls mapped|1 target controls covered
8%
ISO 20400:2017 - Sustainable Procurement
1 source controls mapped|1 target controls covered
8%
ICAO Annex 17 - Aviation Security (AVSEC)
1 source controls mapped|1 target controls covered
8%
IEC 62304:2015 Medical Device Software Lifecycle Processes
1 source controls mapped|3 target controls covered
8%
IEC 60601-1 - Medical Electrical Equipment Safety
1 source controls mapped|3 target controls covered
8%
Aged Care Quality Standards 2019 (repealed edition)
1 source controls mapped|1 target controls covered
8%
AML/CTF Act 2006 (Australia)
1 source controls mapped|1 target controls covered
8%
ISO 27005
1 source controls mapped|3 target controls covered
8%
SASB Standards
1 source controls mapped|3 target controls covered
8%
ISO 37000:2021 - Governance of Organizations
1 source controls mapped|2 target controls covered
8%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
1 source controls mapped|3 target controls covered
8%
Singapore AI Governance Framework
1 source controls mapped|1 target controls covered
8%
APRA SPS 220 Risk Management (Superannuation)
1 source controls mapped|1 target controls covered
8%
Authorised Economic Operator (AEO) Programmes - Global Standards
1 source controls mapped|1 target controls covered
8%
AS9100D - Aerospace Quality Management System
1 source controls mapped|1 target controls covered
8%
ISO 31000
1 source controls mapped|3 target controls covered
8%
BS 65000:2014 - Guidance on Organizational Resilience
1 source controls mapped|2 target controls covered
8%
Kuwait National Cybersecurity Framework
1 source controls mapped|1 target controls covered
8%
IAIS Insurance Core Principles (ICPs)
1 source controls mapped|2 target controls covered
8%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
1 source controls mapped|1 target controls covered
8%
Solvency II
1 source controls mapped|3 target controls covered
8%
ISO/IEC 27003:2017
1 source controls mapped|2 target controls covered
8%
FBI CJIS Security Policy
1 source controls mapped|1 target controls covered
8%
ISO/IEC 38500:2024 - Governance of IT
1 source controls mapped|1 target controls covered
8%
Compare Telecommunications Sector Security Reforms (TSSR) with Security of Critical Infrastructure Act 2018 (SOCI)

What is Telecommunications Sector Security Reforms (TSSR) and who does it apply to?

Telecommunications Sector Security Reforms (TSSR) is a compliance framework from Australia with 6 domains and 12 controls. The Telecommunications Sector Security Reforms, enacted through Part 14 of the Telecommunications Act 1997, require carriers and carriage service providers to protect Australian telecommunications networks from national security risks. Commenced September 2018. Administered by the Department of Home Affairs. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Telecommunications Sector Security Reforms (TSSR) actually require?

Telecommunications Sector Security Reforms (TSSR) has 12 controls organised across 6 domains. The largest domains are TSSR: Network Information Protection (3 controls), TSSR: Notification Obligation and Ministerial Powers (3 controls), TSSR: Security Obligation (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Telecommunications Sector Security Reforms (TSSR) do I already cover?

Telecommunications Sector Security Reforms (TSSR) maps to 105 other compliance frameworks. The top mapping partners are Security of Critical Infrastructure Act 2018 (SOCI) (42% coverage), NIST SP 800-53 Rev 5 (42% coverage), ISO/IEC 27011:2024 (33% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Telecommunications Sector Security Reforms (TSSR)?

Start your Telecommunications Sector Security Reforms (TSSR) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Telecommunications Sector Security Reforms (TSSR) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 12 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required