The Telecommunications Security Code of Practice provides technical guidance for public telecoms providers on how they can comply with their security requirements as set out in the Telecommunications (Security) Act 2021 and the Electronic Communications (Security Measures) Regulations 2022.

A full impact assessment was carried out for the telecoms security framework when it came into effect in 2022. The estimated cost of the framework on Tier 1 and Tier 2 public telecoms providers was assessed in the frameworks impact assessment (The Electronic Communications (Security Measures) Regulations 2022).

A full Regulatory Impact Assessment was not prepared for the revised Code of Practice. The revised Code provides additional guidance on how public telecommunications providers may demonstrate compliance with existing statutory security duties under the Act. The updates to the Code do not introduce new statutory duties or regulatory requirements and do not constitute a regulatory provision under the Better Regulation Framework.

An assessment on the costs to industry of the proposed updates to the Code was carried out, details of which are included in the explanatory memorandum. Indicative estimates suggest potential one-off implementation costs in the order of £1.9 million to £3.2 million per provider, with ongoing annual costs of approximately £285,000 to £445,000 per provider. When considered in the context of the scale and revenues of the UK telecommunications sector, the Government considers these costs to be relatively minor.

Ofcom, the independent regulator, is responsible for regulating the UK’s wholesale telecoms market. As part of this, it has powers to impose pricing remedies on Openreach to promote competition and protect consumers. The Government’s Statement of Strategic Priorities for Telecommunications steers Ofcom to closely monitor Openreach’s commercial terms and pricing to ensure fair competition, whilst supporting investment, economic growth and the roll out of high-quality digital infrastructure. My department engages with Ofcom regularly on matters related to this market.

On 1 June 2026, Openreach notified Ofcom of its proposed wholesale offers. This was in accordance with Ofcom’s requirement for Openreach to provide at least 120 days’ notice of wholesale discounts. To inform its assessment of the offers, Ofcom has published a Call for Inputs to determine whether the discounts raise any competition concerns and is expected to reach a decision after the summer.

Ofcom, the independent regulator, is responsible for regulating the UK’s wholesale telecoms market. As part of this, it has powers to impose pricing remedies on Openreach to promote competition and protect consumers. The Government’s Statement of Strategic Priorities for Telecommunications steers Ofcom to closely monitor Openreach’s commercial terms and pricing to ensure fair competition, whilst supporting investment, economic growth and the roll out of high-quality digital infrastructure. My department engages with Ofcom regularly on matters related to this market.

On 1 June 2026, Openreach notified Ofcom of its proposed wholesale offers. This was in accordance with Ofcom’s requirement for Openreach to provide at least 120 days’ notice of wholesale discounts. To inform its assessment of the offers, Ofcom has published a Call for Inputs to determine whether the discounts raise any competition concerns and is expected to reach a decision after the summer.

Between 16 December 2025 and 10 March 2026, we consulted a new National Planning Policy Framework. The consultation on the revised framework, which can be found on gov.uk here, included a new section intended to replace Chapter 10 of current Framework on supporting high-quality telecommunications infrastructure.

We are currently analysing the feedback received and will publish our response in due course.

Between 16 December 2025 and 10 March 2026, we consulted a new National Planning Policy Framework. The consultation on the revised framework, which can be found on gov.uk here, included a new section intended to replace Chapter 10 of current Framework on supporting high-quality telecommunications infrastructure.

We are currently analysing the feedback received and will publish our response in due course.

The Secretary of State for Housing, Communities and Local Government has not had any meetings with the Secretary of State for Science, Innovation and Technology to discuss planning reforms relating to permitted development rights and the National Planning Policy Framework for telecommunications infrastructure.

The Telecommunications Security Code of Practice provides technical guidance for public telecoms providers on how they can comply with their security requirements as set out in the Telecommunications (Security) Act 2021 and the Electronic Communications (Security Measures) Regulations 2022.

The government is committed to continuously evaluating the effectiveness of the UK’s telecoms security framework, and the Draft Revised Code of Practice strengthens security guidance to public telecoms providers to reflect evolving technology and emerging security threats.

The government ran a consultation on proposed updates to the Telecommunications Security Code of Practice 2022 from 28 August 2025 to 22 October 2025, and an additional cost survey which ran from 25 November 2025 until 28 January 2026.

Cost related feedback received from the consultation, and the additional cost survey, informed the resulting assessment on costs to industry included in the explanatory memorandum for the Draft Revised Code of Practice, published on GOV.UK on 3 June.

Indicative estimates suggest potential one-off implementation costs of the proposed updates to the Code being in the order of £1.9 million to £3.2 million per provider. Estimates for the ongoing annual costs are approximately £285,000 to £445,000 per provider. The Government considers these costs to be relatively minor, given the critical importance of good security and the current scale and revenues of the UK telecommunications sector.

Underlying cost data from individual providers has not been published, to protect commercial confidentiality and mitigate the risk of exposing vulnerabilities in UK telecoms networks.

I refer the hon. Member to the answer given to Questions UIN 124803 on 20 April 2026.

I refer the hon. Member to the answer given to Questions UIN 124803 on 20 April 2026.

The government recognises the importance of resilient communications networks and services. Telecommunications providers are required to take appropriate and proportionate measures to identify, reduce, prepare for and recover from risks to the security and resilience of their networks and services under the Communications Act 2003, as amended by the Telecommunications (Security) Act 2021. The government works closely with Ofcom and industry to strengthen telecommunications resilience and to ensure providers are able to manage a range of risks, including cyber threats, through appropriate resilience and security measures. These measures may include maintaining different communications architectures and modes of delivery, although this is not, in general, legally mandated.

The Government works closely with communications providers, Ofcom, the energy sector and other partners to ensure the resilience and security of the UK's communications infrastructure. Communications providers are responsible for the resilience of their networks and services and have statutory obligations to identify, reduce and manage risks that could affect the security and availability of services. Ofcom oversees compliance and has powers to monitor, investigate failures and take enforcement action where appropriate. The Government is also supporting collaboration between the electricity and telecommunications sectors to reduce the likelihood of telecommunications disruption during power outages and, where disruption occurs, minimise the number of people affected and the duration of any impact. In the event of a national power outage or a large-scale cyber incident affecting broadband networks, plans are in place to ensure the public can continue to receive critical information. This includes the use of BBC Radio 2 and BBC Radio 4, which would continue to broadcast key public advice. In the event of a prolonged broadband outage, critical information can also be communicated through alternative channels, including Emergency Alerts, which do not require a broadband connection to operate.

On 6 September 2024, Ofcom published updated Network and Service Resilience Guidance setting out the measures communications providers should take to improve network resilience. In February 2025, Ofcom published a technical report on mobile power resilience and undertook further analysis of mobile network resilience. Building on this work, Ofcom updated its Resilience Guidance in June 2026, clarifying its expectations for mobile network operators' backup power arrangements and sharing its findings with Government to support wider policy development.

The Telecommunications (Security) Act 2021 established a strengthened framework for the security and resilience of public telecommunications networks and services, introducing enhanced security duties on providers to protect their networks and services against cyber attack and reduce the risk and impact of security compromises. The framework is supported by the Telecommunications Security Code of Practice, which was updated in 2026 to reflect evolving threats, technologies and operational practices.

The Government works closely with communications providers, Ofcom, the energy sector and other partners to ensure the resilience and security of the UK's communications infrastructure. Communications providers are responsible for the resilience of their networks and services and have statutory obligations to identify, reduce and manage risks that could affect the security and availability of services. Ofcom oversees compliance and has powers to monitor, investigate failures and take enforcement action where appropriate. The Government is also supporting collaboration between the electricity and telecommunications sectors to reduce the likelihood of telecommunications disruption during power outages and, where disruption occurs, minimise the number of people affected and the duration of any impact. In the event of a national power outage or a large-scale cyber incident affecting broadband networks, plans are in place to ensure the public can continue to receive critical information. This includes the use of BBC Radio 2 and BBC Radio 4, which would continue to broadcast key public advice. In the event of a prolonged broadband outage, critical information can also be communicated through alternative channels, including Emergency Alerts, which do not require a broadband connection to operate.

On 6 September 2024, Ofcom published updated Network and Service Resilience Guidance setting out the measures communications providers should take to improve network resilience. In February 2025, Ofcom published a technical report on mobile power resilience and undertook further analysis of mobile network resilience. Building on this work, Ofcom updated its Resilience Guidance in June 2026, clarifying its expectations for mobile network operators' backup power arrangements and sharing its findings with Government to support wider policy development.

The Telecommunications (Security) Act 2021 established a strengthened framework for the security and resilience of public telecommunications networks and services, introducing enhanced security duties on providers to protect their networks and services against cyber attack and reduce the risk and impact of security compromises. The framework is supported by the Telecommunications Security Code of Practice, which was updated in 2026 to reflect evolving threats, technologies and operational practices.

The government recognises the importance of maintaining public communications during disruptions affecting telecommunications networks. Telecommunications providers are required to take appropriate and proportionate measures to identify, reduce, prepare for and recover from risks to the resilience of their networks and services, under the Communications Act 2003, as amended by the Telecommunications (Security) Act 2021. The department works closely with industry, Ofcom and other government departments through established resilience and emergency response arrangements to prepare for, respond to and recover from major telecommunications incidents, while continuing to strengthen the resilience of the UK's telecommunications infrastructure.