The Electronic Communications (Security Measures) Regulations 2022

Patches and updates

12.  A network provider or service provider must—

(a) where the person providing any software or equipment used for the purposes of the public electronic communications network or public electronic communications service makes available a patch or mitigation relating to the risks of security compromises occurring (including software updates and equipment replacement), take such measures as are appropriate and proportionate to deploy the patch or mitigation within such period as is appropriate in the circumstances having regard to the severity of the risk of security compromise which the patch or mitigation addresses,

(b) identify any need for a security update or equipment upgrade and implement the necessary update or upgrade within such period as is appropriate, having regard to the assessed security risk of the network provider or service provider, and

(c) arrange for any decision as to what period the network provider or service provider considers appropriate—

(i) for the purposes of sub-paragraph (a), in a case where the network provider or service provider considers in relation to a particular patch or mitigation that a period of more than 14 days beginning with the day on which the patch or mitigation becomes available is appropriate, or

(ii) for the purposes of sub-paragraph (b), in a case where there is a significant risk of a security compromise occurring,

to be taken at an appropriate governance level and recorded in writing.