Summary

  • Ofcom proposes common mobile-security reporting thresholds, including one rural cell site affected for eight hours; the consultation closed on 4 August, but the revised policy remains pending.
  • A postcode match makes the site countable. It does not establish how many customers lost service, whether another network remained available, or why restoration took as long as it did.

A regulator can count a failed cell site more easily than it can count the people who depended on it. Ofcom’s draft section 105Y policy turns that difference into a reporting rule: a mobile network operator would report a security compromise affecting at least one rural cell site for eight hours or more. The trigger may expose outages that a customer-count threshold misses. It is not, by itself, a measurement of the outage’s social impact or a finding that the operator’s network was insufficiently resilient.

Ofcom published the consultation on 12 May 2026, closed it on 4 August and published responses on 1 October. Its page still lists the matter as “Pending Statement (Closed)”. The 2022 policy therefore remains the operative statement until Ofcom issues a final replacement. The proposed table is a draft, not a new rule already in force. Ofcom consultation status and documents

The draft uses several routes into reporting. For mobile network operators (MNOs) and mobile virtual network operators (MVNOs), it proposes a threshold of at least 10,000 affected customers or 25% of the provider’s customers on the affected service for eight hours, plus a separate threshold of 100,000 affected customers for any duration. For MNOs, it adds at least 25 affected cell sites for two hours, at least 150 sites for any duration, and at least one rural site for eight hours. The customer definition turns on whether the main functions of the network or service are unavailable because of the security compromise. A rural site is classified by matching the postcode of its physical location to Ofcom’s rural dataset. Draft Annex 7, Table 2

That is a useful distinction in incident triage. Customer counts can vary by time and are difficult to observe in real time; a site identifier gives the regulator a more stable unit for comparing reports. But the unit is a proxy. The rural label describes where equipment stands, not necessarily the settlement, road corridor, emergency service or business served by its coverage. The draft incident form asks for customer estimates and affected-site identifiers where available; it also says that emergency roaming does not remove the need to account for potential effects on access to emergency services. These fields can improve an account, but they do not make the postcode a customer-impact map. Draft 72-hour form

Ofcom’s rationale is that rural users may have fewer alternative communications options, and a single site can matter disproportionately. That is a reason to collect evidence, not proof that every qualifying outage has the same consequence. BT supports clearer and more consistent reporting but argues that a mast’s rural postcode may misstate the community affected, that difficult access and engineer travel can extend restoration, and that shared sites may produce duplicate reports from multiple operators. UKCTA separately says a 25% customer threshold can be reached by a small provider even when the absolute number of affected users is low, and asks for a reasonable-efforts approach where service providers depend on a third-party network. These are stakeholder positions, not independent measurements of outage harm. BT response · UKCTA response

The draft also retains qualitative reporting considerations, including emergency-service access, potential loss of life, significant cyber incidents and certain media or cross-provider effects. A numerical rural threshold therefore sits inside a broader security-reporting framework; it does not replace it. Nor should a reporting threshold silently become an engineering target. Ofcom’s 2024 resilience guidance and the existing statutory security duties concern how providers manage security and resilience; a notification criterion answers a narrower question about when Ofcom should receive a report.

The policy question is not whether rural outages matter. It is whether a location-based trigger can improve Ofcom’s view without being mistaken for a complete impact assessment. That depends on what the report records alongside the postcode: affected technologies and services, estimated users, emergency-call access, shared infrastructure, cause, restoration steps and uncertainty. Until Ofcom publishes its statement, operators should treat the thresholds as proposed, preserve their current reporting obligations and prepare to test how site-level records reconcile with customer and community evidence. Source documents: Ofcom’s consultation analysis · cell-data reporting standard · Network and Service Resilience Guidance.