The Electronic Communications (Security Measures) Regulations 2022

Competency

13.—(1) A network provider or service provider must take such measures as are appropriate and proportionate to ensure that persons given responsibility for the taking of measures on behalf of the provider for the purposes mentioned in section 105A(1) of the Act (“the responsible persons”)—

(a) are competent to discharge that responsibility, and

(b) are given resources to enable them to do so.

(2) The duty in paragraph (1) includes in particular a duty to take such measures as are appropriate and proportionate—

(a) to ensure that the responsible persons have appropriate knowledge and skills to perform their responsibilities effectively,

(b) to ensure that the responsible persons are competent to enable the network provider or service provider to perform the provider’s duties under regulation 6, and are given resources for that purpose,

(c) to ensure that the responsible persons—

(i) are competent to show appropriate understanding and appraisal of the activities of third party suppliers and of any recommendations made by third party suppliers for the purposes of identifying and reducing the risk of security compromises occurring, and

(ii) are given resources for that purpose, and

(d) where new equipment is supplied, provided or made available by a third party supplier—

(i) to ensure that the equipment is set up according to a secure configuration approved by appropriately trained security personnel, following procedures which enable it to be demonstrated that the configuration has been carried out in that way, and

(ii) to record any failure to meet recommendations of the third party supplier as to the measures that are essential to reduce the risk of security compromises occurring as a result of the way in which the equipment is set up.

(3) In paragraph (2)(c) and (d) “third party supplier” has the meaning given by regulation 7(2).