The Telecoms Security Act for small ISPs and altnets: where ISO 27001 fits

If you run a small ISP, altnet or wireless ISP, the telecoms security rules apply to you. The Telecommunications (Security) Act 2021 put security duties into the Communications Act 2003 for every provider of a public electronic communications network or service, and Ofcom monitors and enforces them. What changes with size is the detail: the Electronic Communications (Security Measures) Regulations 2022 don't apply to micro-entities, and the Telecommunications Security Code of Practice sets expectations by tier, with the smallest tier not expected to follow its measures.

ISO 27001 isn't compliance with any of this. It's a management system standard, and the Code doesn't refer to it. But an ISO 27001 information security management system (ISMS) gives a small team a structure to manage its security duties, keep evidence that it has, and answer the security questionnaires business customers send. This guide explains the rules, the tiers, and where an ISMS helps.

This guide is general information as of October 2026, not legal advice. Check the current legislation, the Code and Ofcom's guidance (linked below) for your own position.

What the Act actually requires

The Act works by inserting new sections into the Communications Act 2003. The ones a small provider needs to know:

• Section 105A: the general duty. Providers of a public network or service must take measures that are "appropriate and proportionate" to identify and reduce the risks of security compromises, and to prepare for them happening. A "security compromise" is broad: it includes anything that compromises the availability, performance or functionality of your network or service, not only attacks.
• Section 105B: specified measures. The government can set out specific measures in regulations. That's what the 2022 regulations do.
• Section 105C: responding to compromises. You must take measures to prevent or reduce the effects of a compromise when one happens.
• Section 105J: telling users. Where there's a significant risk of a security compromise, you take reasonable and proportionate steps to tell affected users about the risk, what they can do about it, and who to contact.
• Section 105K: telling Ofcom. You inform Ofcom as soon as reasonably practicable of any security compromise with a significant effect on your network or service. Significance depends on how long it lasts, how many users it affects, the area it covers and how badly users are disrupted.

Ofcom can assess compliance, require information and enforce. According to the government's publication of the regulations, providers that fail to comply could face fines of up to 10% of turnover, or £100,000 a day for a continuing contravention. Ofcom's general statement of policy under section 105Y explains how it approaches monitoring and enforcement and which compromises it normally expects to be reported, and how.

The 2022 regulations

The Electronic Communications (Security Measures) Regulations 2022 came into force on 1 October 2022. They set out the specific measures under section 105B, under these headings:

Regulation 16 says none of regulations 3 to 15 apply to a provider that is a micro-entity, using the Companies Act 2006 test for micro-entities. If you're a very small operator, check whether you qualify. But note what the exemption covers: the specific measures in the regulations. The general duty in section 105A, and the duties to report to Ofcom and tell users, are in the Act itself.

The Code of Practice and the tiers

The Telecommunications Security Code of Practice is guidance on how providers can meet their duties under sections 105A to 105D. It was first published on 1 December 2022, and version 1.1 was issued on 14 July 2026. It isn't law in itself, but Ofcom must take it into account where it's relevant, and so must courts and tribunals.

The Code sorts providers into tiers by relevant turnover in the relevant period:

The Tier 3 line is the one most small ISPs and altnets care about, and it's easy to misread. The Code says the smaller Tier 3 providers aren't expected to follow its measures, but that they must still take appropriate and proportionate measures to comply with their duties under the Act and the regulations. "Not expected to follow the Code" doesn't mean "no security duties". It means you decide what's appropriate and proportionate for your network, and you need to be able to explain that decision if Ofcom asks.

You can still use the Code as a reference, picking the measures that fit your risks. That's a reasonable way to show your thinking, as long as you record why you've chosen what you have.

What this means in practice for a small provider

For a team of a few engineers, the duties come down to some questions you should be able to answer with records, not memory:

• Who's accountable? Someone senior owns security, and decisions are made and recorded, not left to whoever's on shift.
• What are your risks? You know what your network is made of, which functions are critical, what could compromise them (including power, upstream and supplier failures) and what you're doing about each risk.
• Who else has access? Suppliers, contractors and managed service providers with access to your network are known, controlled and reviewed.
• Are you patching? You know what's out of support and you track updates to completion.
• What happens in an incident? There's a process for handling it, deciding whether it meets Ofcom's reporting thresholds, telling users where needed, and learning from it afterwards.
• Can you recover? Backups, configurations and recovery plans exist and have been tested.
• Do you review it? The arrangements are checked and improved on a schedule.

None of this needs a compliance department. It needs a system that keeps it in one place, reminds owners when things are due, and leaves an audit trail.

Where ISO 27001 fits

ISO/IEC 27001:2022 is the international standard for an ISMS. You set a scope, assess your risks, choose controls, and run the system with internal audits and management reviews. An independent certification body can then audit and certify it.

Be clear about what it isn't. Holding ISO 27001 doesn't mean you comply with the telecoms security framework, a certificate isn't a substitute for the duties, and the Code's network-specific measures go into far more technical detail than ISO 27001 does. But the two line up well, because the duties are about managing risk, and ISO 27001 is a way of managing risk:

Run an ISMS properly and most of what you'd need to show Ofcom already exists as a risk, a policy, a task with an owner or an incident record. List the Act and the regulations in your ISMS as legal requirements (Annex A 5.31), and your risk assessment then has to consider them.

Your business customers will ask anyway

The regulator isn't the only one asking. Offices, schools, councils and other businesses buying connectivity send security questionnaires: who's responsible for security, how you control access to your network, what you do in an outage, which suppliers can reach their traffic. Some ask for ISO 27001 by name, especially in the public sector and larger companies.

That's where an ISMS pays back for a small provider. The records you keep for your security duties are the same records you answer questionnaires from, so your answers agree with each other and don't depend on one engineer remembering. See our guide to customer security questionnaires.

A worked example

Example Fibre Ltd is fictional, and only shows how the pieces fit. Imagine Example Fibre is a regional altnet with 30 staff and relevant turnover well under £50 million, so it's a Tier 3 provider. It isn't expected to follow the Code's measures, but it still has the general duty, must report significant compromises to Ofcom, and is subject to the regulations. It runs an ISMS with the Act listed as a legal requirement, a risk register covering its core network, power and upstream transit, supplier reviews for its field contractors and network management provider, and an incident process with an "Ofcom reportable?" decision step. When a housing association tender asks about its security, the answers come from those records.

How ClearIMS helps

ClearIMS helps you build and run an ISO 27001 ISMS with the team you already have. It works like a virtual ISMS manager: each incident can have its own randomly generated email address, so the thread with your upstream supplier is filed against the incident, AI summarises what comes in and suggests tasks, and owners are chased about overdue actions. AI drafts customer security questionnaire answers from your approved records, with sources. Everything stays a draft until a named person approves it; the AI never approves anything, and ClearIMS doesn't give you a regulator's opinion or report to Ofcom for you. Read more about ClearIMS for ISPs and altnets.

We make the software. Your certification is yours, awarded by your certification body.

Book a 20-minute call, or apply for a founding place.