The need to support Critical Infrastructure Regulation came up in the ODA Security and Privacy team ( now closed) we are expecting to pick up Telecom and other regulation in the AI and Data Security and GRC ( Governance Regulation Compliance) team.
In addition to comments from Chirag Raval.
Original Message:
Sent: Sep 23, 2025 17:07
From: Chirag Raval
Subject: UK Telecommunications Security Act (TSA) & Frameworx
There is emerging guidance and community insight on how TM Forum's Framework-including eTOM, SID, and TAM-can be adapted to meet the specific requirements of the UK Telecommunications Security Act (TSA).
points:
1. Alignment of Framework with UK TSA Layers
The UK TSA introduces a three-layer security framework:
Layer 1: Overarching security duties (via amendments to the Communications Act 2003)
Layer 2: Specific security measures (Electronic Communications Security Measures Regulations 2022)
Layer 3: Technical guidance (Code of Practice issued by DCMS and NCSC) 1
Framework adaptation can support these layers as follows:
eTOM (Business Process Framework)
Can be mapped to TSA's operational and governance requirements.
Processes like Security Management, Risk Management, and Service Assurance are directly relevant.
eTOM's Operations Support & Readiness (OSR) and Enterprise Management domains can be extended to include TSA-specific controls such as patching, monitoring, and incident response.
SID (Information Framework)
Helps define and manage security-related data entities, such as:
Network elements
Access controls
Vulnerability records
SID can be extended to model security posture, compliance status, and audit trails-critical for TSA reporting and oversight.
TAM (Application Framework)
Useful for identifying and categorizing applications that support TSA compliance (e.g., SIEM, PAM, vulnerability scanners).
TAM can be adapted to highlight security-critical applications and their interdependencies, aiding in risk assessment and remediation planning.
------------------------------
Chirag Raval
Lead Consultant
Infosys Ltd
Original Message:
Sent: Sep 23, 2025 05:27
From: J David Sharples
Subject: UK Telecommunications Security Act (TSA) & Frameworx
Friends,
Is there any specific guidance, framework adaptions or insights, as to how Frameworx with its Business Process Framework (eTOM), the Information Framework (SID), and the Application Framework (TAM), can and should be adapted towards the specific requirements of the UK TSA?
Kind Regards,
David.
#BusinessAssurance
#General
------------------------------
J David Sharples
BT Group plc
------------------------------