{
  "url": "https://openlegislation.uk/electronic-communications-security-measures-regulations-2022/regulation-4",
  "json_url": "https://openlegislation.uk/electronic-communications-security-measures-regulations-2022/regulation-4.json",
  "legislation": "uksi/2022/933",
  "legislation_title": "The Electronic Communications (Security Measures) Regulations 2022",
  "legislation_url": "https://openlegislation.uk/electronic-communications-security-measures-regulations-2022",
  "path": "regulation/4",
  "kind": "regulation",
  "number": "4",
  "heading": "Protection of data and network functions",
  "text": "(1) A network provider must use such technical means as are appropriate and proportionate—\n(a) to protect data which is stored by electronic means and relates to the operation of the public electronic communications network, in a manner which is appropriate to the data concerned, and\n(b) to protect functions of the public electronic communications network in a manner which is appropriate to the functions concerned.\n(2) A service provider must use such technical means as are appropriate and proportionate—\n(a) to protect data which is stored by electronic means and relates to the operation of the public electronic communications service, in a manner which is appropriate to the data concerned, and\n(b) to protect functions of the public electronic communications network by means of which the public electronic communications service is provided, so far as those functions are under the control of the service provider, in a manner which is appropriate to the functions concerned.\n(3) In paragraphs (1) and (2), “protect”, in relation to data or functions, means protect from anything involving a risk of a security compromise occurring in relation to the public electronic communications network or public electronic communications service in question.\n(4) The duties in paragraphs (1) and (2) include in particular duties to take such measures as are appropriate and proportionate—\n(a) to ensure that workstations through which it is possible to make significant changes to security critical functions are not exposed—\n(i) where, in the case of a public electronic communications network, the workstation is directly connected to the network, to signals that are incoming signals in relation to the network,\n(ii) where, in the case of a public electronic communications service, the workstation is directly connected to the public electronic communications network by means of which the service is provided, to signals that are incoming signals in relation to that network, or\n(iii) where, in either case, the workstation is operated remotely, to signals other than those that the workstation has to be capable of receiving in order to enable changes to security critical functions authorised by the network provider or service provider to be made,\n(b) to monitor and reduce the risks of security compromises occurring as a result of incoming signals received in the network or, as the case may be, a network by means of which the service is provided, and\n(c) to monitor and reduce the risks of security compromises occurring as a result of the characteristics of any equipment supplied to customers which is used or intended to be used as part of the network or service.\n(5) A network provider must use within the public electronic communications network signals which, by encryption, reduce the risks of security compromises occurring.\n(6) A service provider must—\n(a) monitor and reduce the risks of security compromises relating to customers’ SIM cards occurring in relation to the public electronic communications network by means of which the public electronic communications service is provided, and\n(b) replace SIM cards in cases where it is appropriate to do so in order to reduce such risks.\n(7) In paragraph (6), “SIM card” means a subscriber identity module or other hardware storage device intended to store an International Mobile Subscriber Identity (IMSI) and associated cryptographic material, and the reference to replacing a SIM card includes a reference to the application to a SIM card of any process which permanently replaces one IMSI and associated cryptographic material with another.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "I",
      "label": "I1",
      "text": "Reg. 4 in force at 1.10.2022, see reg. 1(2)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/uksi/2022/933/regulation/4",
    "retrieved_at": "2026-10-28T21:56:10.989417+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}