Summary

  • A statutory review asks the government to assess the impact and effectiveness of sections 1–13 of the Telecommunications (Security) Act 2021, then publish a report for Parliament.
  • Ofcom recorded 625 incident reports in 2024–25, down from 1,526 the previous year, but attributed much of the resilience-report decline to reporting categories, the PSTN-to-VoIP transition and broader provider improvements as well as any change in underlying risk.

The number that looks like an answer

The incident count fell sharply. That is a useful signal, but it is not yet an answer to the question the government has to settle: what did the Act change?

Ofcom’s December 2025 report counted 625 incidents reported between October 2024 and September 2025: 616 resilience incidents and nine cyber-security incidents. In the previous reporting year it counted 1,526: 1,518 resilience incidents and eight cyber incidents. The largest movement is in resilience notifications, not cyber reports.

Ofcom itself warns against a simple reading. It says the fall had several drivers: some providers changed their internal incident-priority categories; the move from copper PSTN to fibre-enabled voice meant fewer customers were affected and more incidents fell below reporting thresholds; and providers cited improvements across the industry. Each may change the number of reports without showing what the Act caused.

The government’s evidence call, open from 17 August through 23:59 on 12 October 2026, makes that distinction explicit. Under section 14 of the 2021 Act, the Secretary of State must review the impact and effectiveness of sections 1–13 and lay a report before Parliament. The call asks respondents to leave out improvements that would have occurred as normal security work, under earlier obligations or through wider commercial decisions. That is a request for evidence of additional effect, not a referendum on whether telecom security matters.

Rules, guidance and oversight

The Act amended the Communications Act 2003. It places overarching duties on public telecoms providers to reduce security risks, prepare for compromises, limit adverse effects and remedy them. The 2022 Security Measures Regulations prescribe specific requirements. A Code of Practice explains the government’s preferred route to compliance; its 2026 revision, version 1.1, was published in July.

Those layers do different jobs. The statutory duty and regulations establish obligations. The Code is guidance rather than a separate binding rule, although Ofcom and courts must take relevant code provisions into account in specified functions. Ofcom monitors providers and can use statutory powers; the Secretary of State conducts the review, with input from Ofcom and the National Cyber Security Centre (NCSC). Parliament receives the resulting report.

That allocation matters when the review measures “effectiveness”. A provider’s completed control or a regulator’s information request is evidence of implementation. It is not, by itself, evidence of fewer compromises, smaller outages or faster recovery.

Progress with a denominator

Ofcom’s first report, covering October 2022 to October 2024, said it was too early to draw firm conclusions, though early indications were broadly positive. Its December 2025 report described progress in asset management, backup restoration tests and incident management. It had completed two information-request rounds covering 67 of the Code’s 258 measures.

The same report identified gaps. Ofcom said just under half of Tier 1 providers and 10% of Tier 2 providers might not be applying relevant supply-chain measures properly when their supplier is itself a regulated telecom. More than half of Tier 1 and a quarter of Tier 2 providers appeared to find meaningful security testing before equipment contracts uneconomic or impractical. These are regulator observations about the providers and measures it reviewed, not a finding about every UK network.

The denominator matters. Ofcom listed seven Tier 1 providers with relevant turnover of at least £1bn and 31 Tier 2 providers between £50m and £1bn. Tier 3 providers below £50m are not expected to follow the Code. The review should keep those boundaries visible rather than present a Tier 1/2 monitoring sample as the entire sector.

Nor should a fall in reports be treated as a fall in cyber risk. Four of the nine cyber incidents in 2024–25 were likely below Ofcom’s mandatory reporting threshold. Eight reports in one year and nine in the next cannot establish whether the underlying threat rose, fell or stayed level. Notifications measure incidents that crossed defined reporting rules, not every intrusion or near miss.

What the review can still test

A useful report can pair implementation evidence with outcomes: whether like-for-like incident rates changed after accounting for provider category, customer exposure and technology migration; how long services were impaired; how many customers were affected; and whether restoration became faster. It can show progress by provider tier and Code version, disclose the limits of incident thresholds, and distinguish mandatory reports from below-threshold signals.

It can also trace the specific gaps Ofcom has raised. Were supplier contracts and oversight improved where a telecom provider buys from another telecom provider? Did meaningful security testing move earlier in procurement, or did firms adopt an alternative that Ofcom considers equivalent? Have the changes introduced by Code 1.1 been tested in practice? That revision arrived after Ofcom’s 2024–25 reporting period, so its longer-run effect is not established by those figures.

Ofcom said it did not use its Security Act enforcement powers in the 2024–25 reporting year. Two penalties for resilience breaches in the same report were issued under separate General Conditions. A review should preserve that legal distinction, then explain whether compliance was achieved through monitoring, remediation, deterrence or other means.

Sources