Telecoms Security Laws Map: TSA, FCC, EECC/NIS2 and Asia Pacific

A telecoms operator running networks in several countries answers to security regimes that differ in what counts as a reportable compromise, how fast it must be reported, which vendors are banned and how large the penalties are. This map compares the main telecoms security laws for operators in the UK (Telecommunications (Security) Act 2021), the US (FCC CPNI breach rule and the Covered List under the Secure and Trusted Communications Networks Act), the EU (NIS2, which now covers public electronic communications providers) and Singapore in Asia Pacific. It is for operator CISOs, regulatory affairs teams and vendors selling into telecoms. Each regime has its own deep guide, linked below; this page shows how they line up. Status checked on 27 October 2026 against legislation.gov.uk, the eCFR, the FCC, the European Commission and Singapore's Cyber Security Agency.

Key takeaways

• The UK regime is the most prescriptive: a statutory duty to identify and reduce the risk of security compromises, codes of practice, Ofcom enforcement and penalties up to 10% of relevant turnover.
• The US splits privacy and supply chain: CPNI breaches go to the Secret Service and FBI within seven business days, while the Covered List and equipment authorisation rules exclude named vendors such as Huawei and ZTE.
• In the EU, telecoms now sits under NIS2: providers of public electronic communications networks and services are in scope, with a 24-hour early warning, 72-hour notification and one-month final report pattern.
• Vendor restrictions exist in both the UK and US: UK designated vendor directions and US Covered List entries are national security tools, separate from day-to-day security duties.
• Credentials are the common failure: the Salt Typhoon intrusions relied mainly on stolen network device credentials and shared secrets, which every regime's security duty already covers.

Regulations and frameworks at a glance

Scope: who and what is covered

• UK: the security duties apply to providers of public electronic communications networks and services. "Security compromise" is defined broadly to include harm to availability, performance or functionality, and to signal confidentiality, according to the Explanatory Notes. The Act also lets the Secretary of State issue designated vendor directions (new s.105Z1) where necessary in the interests of national security and proportionate. See the UK Telecommunications Security Act Guide.
• US, CPNI: telecommunications carriers holding customer proprietary network information. A breach is intentional access, use or disclosure of CPNI without authorisation or beyond authorisation (64.2011(e)). See the FCC CPNI and Telecom Data Breach Rule Guide.
• US, Covered List: equipment and services found to pose an unacceptable national security risk, published under the 2019 Act. See the FCC Covered List and Secure Networks Act Guide.
• EU: NIS2 added providers of public electronic communications to its sectors; digital infrastructure was already covered under NIS1. Member States had to transpose by 17 October 2024. See the NIS2 Directive Guide.
• Singapore: the Cybersecurity Act designates critical information infrastructure across sectors including Infocomm; the May 2024 amendments added Systems of Temporary Cybersecurity Concern, Entities of Special Cybersecurity Interest and Foundational Digital Infrastructure.

Key obligations

Mapping duties across regimes

See the NIS2 Implementing Regulation 2024/2690 Guide for the technical measures that apply to some digital infrastructure entities.

Timeline and current status

Moving parts when checked: NIS2 transposition is still uneven across Member States, see the NIS2 Transposition Tracker; the FCC's 2023 expansion of its data breach rules has been litigated, which the CPNI guide tracks; and UK code of practice implementation dates are staged by provider tier, covered in the UK guide. This map does not cover Australia, India, Japan or South Korea, because their current telecoms security texts could not be confirmed from official sources for this version.

Enforcement and penalties

• UK: Ofcom must seek to ensure providers comply with the security duties (s.105M), has assessment powers (ss.105N to 105R) and must publish an enforcement policy (s.105Y). Per the Explanatory Notes, the maximum penalty for security duty contraventions is 10% of relevant turnover, with up to £100,000 per day for continuing contraventions; failures under s.105I carry up to £10 million or £50,000 per day. Designated vendor direction contraventions also carry up to 10% of relevant turnover.
• US: CPNI and Covered List obligations are enforced by the FCC under the Communications Act; the CPNI guide lists recent enforcement actions.
• EU: fines and supervision are set in each Member State's NIS2 law, with management bodies accountable for risk-management measures.
• Singapore: the CSA enforces the Act; penalty details are not restated here.

What it means for AI agents and non-human identities

Telecoms networks run on machine credentials: router and switch local accounts, SNMP community strings, TACACS+ and RADIUS shared secrets, SSH keys, API tokens for orchestration and OSS/BSS integration. In the Salt Typhoon telecom intrusions, Cisco Talos reported that the attackers mostly used valid stolen credentials, took device configurations with SNMP strings and weakly encrypted local passwords, captured authentication traffic to recover shared secrets, and added accounts and SSH keys, with access in one case lasting more than three years. See the Salt Typhoon Threat Actor Profile.

• UK "pre-positioning": the Explanatory Notes say reportable compromises include activity that enables future compromise without immediate impact. A planted SSH key or rogue local account is exactly that.
• Network automation and AI agents: orchestration platforms and AI operations agents hold credentials to thousands of devices; treat them as privileged identities with scoped, short-lived access. See the Telecoms Identity Security Guide.
• CPNI access by systems: billing, CRM and support bots that read CPNI need named identities and logged access so a breach determination can be made quickly.

Compliance steps

1. Map entities to regimes: list each licensed entity and service by country and record which of the regimes above applies.
2. Harmonise incident thresholds: build one triage process that tests each incident against UK "significant effect", NIS2 "significant incident" and US CPNI breach definitions in parallel.
3. Set the clock to the shortest deadline: the NIS2 24-hour early warning usually drives the process; record the US "reasonable determination" time separately.
4. Inventory network device credentials: local accounts, SNMP, AAA shared secrets and SSH keys, with owners and rotation dates.
5. Screen vendors: check equipment and software against the Covered List and any UK designated vendor directions before procurement.
6. Prepare evidence for each regulator: Ofcom assessments, FCC records kept at least 2 years, and NIS2 supervisory documentation.
7. Review automation identities: scope orchestration and AI agent credentials and monitor their use.

Decision guidance

• One programme or several: multinational operators usually do best with one control framework mapped to every regime, plus a thin local layer for reporting routes and deadlines. Running separate programmes per country duplicates evidence and lets the weakest one set the real standard.
• Which regime to design to: the UK duties and codes are the most detailed on network security measures; NIS2 sets the tightest common reporting clock; the US rules are narrower but carry the clearest vendor exclusions. Designing to the UK measures and the NIS2 clock covers most of the others.
• Smaller providers: NIS2 applies to medium and large entities, and UK code of practice timelines are staged by provider tier, so smaller operators often face lighter or later duties; confirm your tier rather than assume.
• Vendors selling into telecoms: expect operators to pass their duties down by contract, including credential handling, remote support access and notification to the operator within hours.

Common failure patterns

• Shared device credentials: the same local admin password or SNMP community string across thousands of devices, so one leaked configuration opens the estate.
• Static AAA shared secrets: TACACS+ and RADIUS keys that are never rotated and travel in recoverable form.
• Three clocks, no owner: separate teams for Ofcom, the CSIRT and the FCC, each assuming another is reporting.
• Vendor checks only at purchase: no re-screening when the Covered List or a designated vendor direction changes.
• Ignoring quiet compromises: treating an added SSH key with no outage as non-reportable, when the UK notes describe pre-positioning as a compromise.
• Unlogged support access: vendor and managed service engineers on shared accounts, so the provider cannot show who changed what.

Detection and measurement

• Credential uniqueness: share of network devices with unique local credentials and SNMPv3 instead of community strings.
• Secret rotation age: median age of AAA shared secrets and device SSH keys.
• Unexpected account or key additions on network devices detected per month and time to investigate.
• Reporting readiness: time from detection to triage decision in exercises, against the 24-hour NIS2 early warning.
• Vendor screening coverage: share of installed equipment and software checked against current restriction lists.

Framework mapping

Practitioner checklist

• Every entity and service is mapped to the regimes that apply.
• One incident triage process tests UK, EU and US thresholds at the same time.
• Regulator contact routes (Ofcom, national CSIRT, FCC central reporting facility, CSA) are documented and tested.
• Network device credentials and shared secrets are inventoried and rotated.
• Procurement checks the Covered List and UK designated vendor directions.
• Breach and notification records are kept for at least 2 years.
• Planted keys and new local accounts are detected and treated as possible pre-positioning.
• Automation and AI agent credentials are scoped, short-lived and logged.

Standards and references

• legislation.gov.uk: Telecommunications (Security) Act 2021
• legislation.gov.uk: Telecommunications (Security) Act 2021 Explanatory Notes, commentary
• eCFR: 47 CFR 64.2011 Notification of customer proprietary network information security breaches
• FCC: List of Equipment and Services Covered by Section 2 of the Secure Networks Act
• European Commission: NIS2 Directive
• EUR-Lex: Directive (EU) 2022/2555 (NIS2)
• Cyber Security Agency of Singapore: Cybersecurity Act

Related NHI Mgmt Group resources: UK Telecommunications Security Act Guide · FCC CPNI and Telecom Data Breach Rule Guide · Telecom Network Security Guide · NIS2 Directive Guide. This guide summarises telecoms security laws in the UK, US, EU and Singapore and is not legal advice.