United Kingdom

Europe

The UK's Telecommunications Security Act 2021 (TSA) and its Telecommunications Security Regulations (TSR) 2022 form the strongest prescriptive telecom-security framework in Europe. Ofcom enforces; the Code of Practice sets the technical bar.

Regulator: Ofcom + NCSC

Primary frameworks: Telecommunications Security Act 2021, Telecommunications Security Regulations 2022, TSR Code of Practice, NCSC guidance

TSR Code of Practice

The Code sets tiered requirements (Tier 1 largest operators, Tier 2 medium, Tier 3 smallest) with specific signaling-security measures for SS7, Diameter, and 5G including deployment of signaling firewalls, roaming controls, and monitoring.

High-risk vendor removal

The TSA gives the Secretary of State powers to require removal of specified vendors from designated network parts. Enforcement timelines run through 2027 for full removal from the network core.

Incident reporting

Ofcom requires reportable-incident notification within specified windows. Signaling attacks that affect service or cause data loss qualify.

Enforcement

Ofcom can fine up to 10% of global turnover or GBP 100,000 per day for continuing breach. Enforcement action to date has been focused on removal-plan compliance.

Key takeaways

• The UK is currently the most prescriptive Western jurisdiction on operator signaling security.
• Tier assignment sets the technical bar — Tier 1 controls are essentially aligned with GSMA FS.11/FS.19/FS.20.
• Ofcom audits look at implementation evidence, not policy documents.