There is emerging guidance and community insight on how TM Forum's Framework-including eTOM, SID, and TAM-can be adapted to meet the specific requirements of the UK Telecommunications Security Act (TSA).
points:
1. Alignment of Framework with UK TSA Layers
The UK TSA introduces a three-layer security framework:
Layer 1: Overarching security duties (via amendments to the Communications Act 2003)
Layer 2: Specific security measures (Electronic Communications Security Measures Regulations 2022)
Layer 3: Technical guidance (Code of Practice issued by DCMS and NCSC) 1
Framework adaptation can support these layers as follows:
eTOM (Business Process Framework)
Can be mapped to TSA's operational and governance requirements.
Processes like Security Management, Risk Management, and Service Assurance are directly relevant.
eTOM's Operations Support & Readiness (OSR) and Enterprise Management domains can be extended to include TSA-specific controls such as patching, monitoring, and incident response.
SID (Information Framework)
Helps define and manage security-related data entities, such as:
Network elements
Access controls
Vulnerability records
SID can be extended to model security posture, compliance status, and audit trails-critical for TSA reporting and oversight.
TAM (Application Framework)
Useful for identifying and categorizing applications that support TSA compliance (e.g., SIEM, PAM, vulnerability scanners).
TAM can be adapted to highlight security-critical applications and their interdependencies, aiding in risk assessment and remediation planning.
------------------------------
Chirag Raval
Lead Consultant
Infosys Ltd
------------------------------