Under the Telecommunications (Security) Act and its regulations, providers must manage security risk across their networks and suppliers and tell Ofcom about security compromises. When suppliers, controls and incidents are tracked in separate places, showing that duty is met takes longer than meeting it. ERM+ keeps them linked.
10 risks on the register. 8 rated High before controls, 1 after.
Select a cell to see which risks sit there and where their controls move them.
Typically 100 to 1,000 employees, established and regulated, with the risk register, supplier oversight and resilience work still run largely by hand.
What it asks
Appropriate and proportionate measures to identify and reduce the risk of security compromises, set out in the Security Measures Regulations and Code of Practice.
What ERM+ holds
Security risks mapped to network functions, the controls that address them and the evidence those controls were applied.
What it asks
Significant security compromises reported to Ofcom promptly, with the facts to hand.
What ERM+ holds
Incident records with impact, timeline, affected services and suppliers captured when the incident is raised.
What it asks
Control over the risks introduced by third-party suppliers, including managed service providers with network access.
What ERM+ holds
A supplier register linked to the access each supplier holds, the risks it creates and the incidents it has been part of.
What it asks
Effective oversight of the partners and promoters that deliver services to consumers.
What ERM+ holds
Partner due diligence, issues and remediation tracked against the services they deliver.
A summary to frame the conversation, not legal advice. The first call establishes exactly which requirements apply to your firm.
Managed service providers and vendors often have privileged access to the network, and their risks sit outside your core register.
When a security compromise is reportable, the time goes into working out which services and suppliers were involved.
Control testing, supplier reviews and incident logs live with different teams, so assembling a view for Ofcom is a project every time.
CTO / CIO
Also: Head of IT, Head of Technology Risk
Head of Risk / CRO
Also: Head of Operational Resilience, Risk Director
Head of Compliance
Also: Chief Compliance Officer, Head of Regulatory Affairs
COO
Also: Head of Operations
CFO
Also: Finance Director
More than 50 years of risk experience between the co-founders and over 500 with our senior associates. Implementation in weeks, not months.
Meet the team“ERM PLUS significantly reduced the time and resources for achieving regulatory compliance in risk and prudential management.”
“The expertise and professionalism of the ERM Plus team are unparalleled. Their strategic guidance and hands-on approach have been instrumental in achieving our business goals.”
We look at what you capture today, what your regulator will ask for, and whether there is a gap. If there is nothing there, no need to take it further.
A gap check, not a pitch. No project, no budget conversation, no access to sensitive data.