Scope and tiers
Who the Act applies to, and which tier you are in
The Telecoms Security Act applies to providers of public electronic communications networks and services in the UK, with expectations scaled by a three-tier turnover system. Two minutes here settles whether you are caught, exempt, or affected through your customers' contracts.
Last reviewed 13 July 2026 · all sources linked in the text
The gateway question
First: are you a PECN or PECS provider?
The Act's duties attach to providers of public electronic communications networks (PECN) and public electronic communications services (PECS). Network operators, ISPs, and voice or messaging service providers are in; purely private networks are out; plenty of businesses sit in between and need the definitions unpacked.
Then: the tiering system
The Code of Practice places providers into three tiers by relevant UK turnover so that expectations stay proportionate. Micro-entities (two of: turnover under £632,000, balance sheet under £316,000, ten or fewer employees) are exempt from the regulations entirely.
Two-minute check
Which tier are you in?
1. Do you provide a public electronic communications network or service in the UK (a PECN or PECS)?
2. Are you a micro-entity? (Two of: turnover under £632,000, balance sheet under £316,000, 10 or fewer employees)
3. What is your relevant UK turnover from telecoms activity?
Guidance only, based on the tiering system in the Code of Practice; your formal position depends on the statutory definitions and your accounts. Nothing you select leaves this page.
Tier 1
£1bn or more
The largest national-scale providers, whose availability and security is critical to people and businesses across the UK. The code applies in full, with the earliest dates on the most straightforward measures.
Tier 2
£50m to under £1bn
Medium-sized providers. The same code measures apply; only a subset of the most straightforward measures carried later dates than Tier 1. Ofcom actively supervises this tier alongside Tier 1.
Tier 3
Under £50m
Not expected to follow the code by default, but the Act's duties still apply: security measures must be appropriate and proportionate. Flow-down contract clauses from Tier 1 and 2 customers often apply code expectations anyway.
Tier 2 is where most of this site's readers sit: big enough for the code to apply, without a Tier 1 compliance department to absorb it. That is exactly the audience CyPro's compliance services are built for.
Quick answers
Scope and tier FAQs
Who does the Telecoms Security Act apply to?
Providers of public electronic communications networks and services in the UK: fixed and mobile network operators, ISPs and public communications service providers. Obligations scale with size through a three-tier system based on relevant UK turnover, and micro-entities are exempt from the specific regulations.
What counts as relevant turnover?
Turnover from relevant telecoms activity carried out wholly or partly in the UK: providing electronic communications services to third parties, providing networks, services and network access to communications providers, or making associated facilities available. It is measured over the twelve months from 1 January in the last-but-one calendar year before the reporting cycle, matching Ofcom's administrative fees approach.
We are just under a tier boundary. What happens if we grow?
A tier designation sticks until you have been outside its range for at least two years, so a strong year does not instantly move you up (and a weak one does not move you down). New market entrants follow the same timeframes as existing providers in their tier, however recently they joined.
Does the Act reach suppliers and MSPs?
Indirectly, and increasingly firmly. Tier 1 and Tier 2 providers must manage supply chain risk as a core duty, which means TSA-shaped security requirements land in supplier contracts. If you sell into large telecoms networks, expect to evidence code-aligned controls even if the Act does not name you.
More questions answered on the full FAQ page.
Settle it in one call
Not sure where you land?
Scope and tier questions usually take one conversation to resolve. Book a free 45 minute discovery call and get a straight answer for your specific services.