TECHNICAL
Physical security is part of the TSA framework The Telecom Security Act 2021 and its Code of Practice require operators to take appropriate measures to prevent disruption to networks and services. (UK Government, 2021; UK Government, 2022).
A balanced approach to telecom security Cybersecurity remains essential. But it does not address all the risks covered by the TSA. UK telecom compliance requires a balanced approach, where physical and digital security work together to protect critical infrastructure, maintain service continuity, and meet regulatory expectations. Physical security is not about adding complexity. It is about ensuring that security strategies reflect how telecom networks operate - in the real world. Quick checklist for TSA physical security readiness A practical way to assess alignment with TSA expectations is to review whether the following foundations are in place:
monitoring and resilience planning to keep infrastructure operational.
n Detecting incidents and responding effectively:
Operators need to monitor networks for anomalies, swiftly contain incidents and report compromises to affected parties and Ofcom to minimise impact. n Providing comprehensive audit trails: Providers must maintain accurate, secure audit records that capture access, changes and security‑relevant events, supporting investigations and regulatory reporting obligations. Physical security is therefore not an additional consideration. It is a core element of UK telecom compliance.
These measures include:
n Preventing unauthorised physical access: Providers must use strict physical controls, such as secure entry systems and surveillance, to limit access to sensitive sites and reduce risks of tampering or interference. n Protecting critical equipment and facilities: Operators must safeguard core network equipment and facilities
through hardening measures and secure configurations to maintain service integrity and prevent unauthorised modification.
What this means in practice?
To make the linkage clearer, the table below illustrates how key TSA requirements explicitly connect to physical security measures expected from telecom operators.
n Managing environmental risks: Providers should assess and mitigate environmental hazards, like fire, flooding or extreme weather, using
n Perimeter secured and monitored
n Multi-factor access in place for sensitive sites
How TSA requirements link to physical security TSA focus area Where it appears
What it means for operators
n Assets locked and tracked digitally
Access Control
Code of Practice 2 (UK Gov, 2022) Annex C (UK Gov, 2022); NCSC A3 (2021) Security Measures Regulations (2022); Ofcom Guidance (2023)
Multi-factor authentication, visitor logs, escort policies. Lock servers, tamper-evident seals, anti-theft measures. Fire suppression, HVAC, flood protection, backup power. CCTV with retention, intrusion detection systems. Backup sites, physical segregation of redundant paths.
n Environmental safeguards tested and maintained
Asset Protection
n CCTV and intrusion detection operational
Environmental Safeguards
n Backup sites and redundancy verified
Monitoring & Surveillance
Code of Practice – Monitoring (2022)
n Incident response drills completed
Incident Response
Code of Practice – Recovery (2022); Ofcom Resilience (2023)
n Compliance reporting available when required
REFERENCES 1. Telecommunications Security Code of Practice (E02781980) – Sections: Prevention of unauthorised access, Monitoring and analysis, Preparing for remediation and recovery. 2. Telecom Security Act 2021 – General security duties and compliance framework. 3. Electronic Communications (Security Measures) Regulations 2022 – Physical security obligations for telecom providers. 4. NCSC Principle A3 Asset Management – Asset identification and protection requirements. 5. OFCOM Physical Security Standards & Network Resilience Guidance – Sections: Physical infrastructure guidance, Operational processes. 6. EC-RRG Resilience Guidelines – Sections: 7.1 Physical design considerations, 8 Business Continuity and Emergency Planning. 7. CAPSS Guidance – Integration of IT and physical security systems for resilience
This kind of structured approach helps operators demonstrate compliance clearly, while also strengthening day-to-day operational resilience.
www.abloy.co.uk
Volume 48 No.2 MAY 2026
101
Made with FlippingBook - Online magazine maker