Cybersecurity Policy Report, Expanded Cyber Incident Reporting Obligations for Mobile Operators Proposed in U.K., (May 12, 2026)
Mobile network operators in the United Kingdom would face expanded obligations to report cybersecurity incidents and outages under revisions proposed today by the U.K.’s Office of Communications (Ofcom).
Under proposed changes to Ofcom’s “general statement of policy,” the threshold for reporting “critical” incidents would be lowered from 3 million “user-hours lost” to 1.5 million, with user-hours lost defined as the number of customers affected by a service impact multiplied by the duration of the service impact.
In addition to the user-hours lost metric, incidents would be reportable depending on the number of cell sites affected, Ofcom proposed.
“While the number of cell sites within a set geographical area does not provide an exact number of customers affected, which can fluctuate depending on a number of variables (time of day, for instance), we believe it nonetheless represents a good proxy for the significance of a security compromise insofar as it affects customers,” Ofcom said.
“Therefore, alongside revising the thresholds based on customer numbers, we are proposing to introduce a requirement to report mobile outages affecting a large geographic area. For semi-urban and urban areas, we are proposing that this would include outages where twenty-five or more cell sites in the same area have failed, and for rural areas, we are proposing that this would mean outages at one cell site or more,” it said.
The proposed changes reflect changes in the U.K. telecom sector since Ofcom last updated its enforcement framework for the Telecommunications (Security) Act 2021, it said. “The framework has been in force for more than three years. During this period, we have received detailed information from around 40 providers on their implementation of more than 130 different security measures, alongside incident reports from a wider set of providers,” Ofcom explained.
“Drawing on this practical experience, we believe changes to our guidance are now necessary to further improve the quality and consistency of incident reports, particularly in relation to mobile services and services in rural areas,” it said.
U.K. telecom law requires significant incidents to be reported within 72 hours, and that won’t change, Ofcom said. Reporting obligations for wireline operators also won’t change, it said. The rules apply to cyber incidents as well as outages attributable to technical problems or physical damage.
Ofcom’s proposal to differentiate between rural and nonrural areas reflects the challenges of service delivery in rural areas, it said.
“Rural areas typically have a lower density of cell sites compared to urban areas, therefore resulting in a lesser likelihood of overlap between cell sites when compared with urban areas. It is therefore more likely that the loss of service from even a single cell site could completely isolate a rural community from all mobile coverage, including the ability to make emergency calls,” it noted.
Another proposed change would require mobile virtual network operators (MVNOs) to follow the same reporting rules as facilities-based mobile network operators (MNOs).
“We are proposing to clarify that where communications providers are reliant on a third party, such as an MVNO relying on an MNO to provide the network, those communications providers are still expected to collect the relevant information and include it in any report and cannot rely on their third party to report on their behalf,” Ofcom said.
“Overall, we consider that the proposed changes to our security reporting thresholds would better reflect security compromises that have a significant effect on the operation of the network or service, including providing a better picture of the problems that communications providers are facing, which can then help us seek to address those problems,” Ofcom said.
Comments on the proposal are due Aug. 4 and can be submitted via a response form or e-mailed to [email protected].
News: InternationalLegislation DataSecurity