Ofcom published a policy statement setting out how it intends to update its network resilience guidance to provide greater clarity to communication providers in order to reduce risk of network outages. Ofcom consulted on this proposal between December 2023 and March 2024, after feedback from industry that more guidance was needed on how providers can demonstrate compliance with network resilience requirements.
The updated Network and Service Resilience Guidance outlines specific measures providers are expected to consider as part of their resilience-related security duties. The measures are flexible enough to apply to all types of provider offering communications networks and services in the UK, and also allows for continued technology evolution.
Under the updated guidance, Ofcom have introduced the following measures for providers to consider:
-
Ensuring that networks are designed to avoid or reduce single points of failure.
-
Ensuring that key infrastructure points have automatic failover functionality built in so that when equipment fails, network traffic is immediately diverted to another device or site that can maintain end user connectivity.
-
Setting out the processes, tools, and training that should be considered to support the requirements on resilience.
In terms of how the updated guidance impacts voice service providers specifically:
-
The guidance outlines that voice services, especially emergency calls, should be prioritised, particularly over other types of service traffic that can cope better with delays during peak times or network issues.
-
The guidance recommends that critical voice services, such as emergency calls, should not rely on the open internet; this may require providers to establish dedicated infrastructure to protect these services from potential internet-related disruptions.
-
Providers are encouraged to inform customers about the availability, reliability, and potential risks associated with the voice services they provide, to ensure customers are able to make informed choices.
As part of the impact assessment, Ofcom outlines that while there may be additional costs associated with providers amending their network infrastructure approaches in order to comply, it considers the benefits outweigh any potential costs; for example, there are measures providers can take to interconnect voice services in a resilient way, but this may incur additional costs.
Communications providers are expected to have regard to the updated guidance from now when considering their resilience-related security duties.