A major network outage affecting thousands of customers is difficult to miss.
But what happens when one mobile mast fails in a rural area?
The number of affected customers may be relatively small. The consequences may not be. A single failure can leave a community without reliable mobile coverage — and, in some circumstances, affect access to emergency calls. Yet incidents of this kind may not meet reporting thresholds designed mainly around customer numbers.
Ofcom is proposing changes intended to give it a clearer, more consistent picture of telecoms security incidents, particularly those affecting mobile services and rural communities. The consultation closed on 4 August 2026. Ofcom's website currently lists it as "Pending Statement (Closed)" — the changes have not yet been finalised.
What is Ofcom proposing?
Ofcom published its consultation on 12 May 2026, proposing updates to its General Statement of Policy under section 105Y of the Communications Act 2003 — the guidance that governs how providers report security compromises and how Ofcom supervises compliance.
The key proposals:
- New mobile thresholds. Ofcom proposes replacing reporting arrangements based partly on individual operators' definitions of a "major service failure" with common criteria based on customer impact, duration and the number of affected cell sites. The proposed thresholds include outages affecting 25 or more sites in the same urban or semi-urban area, and outages lasting eight hours or more at one or more rural cell sites.
- Greater visibility of rural outages. A single rural mast can matter more than a larger number of urban sites because there may be little or no overlapping coverage nearby. Qualifying rural incidents would generally be included in monthly bulk reports unless another quantitative or qualitative factor makes earlier reporting necessary.
- Clearer incident information. Reports would need to specify when the incident occurred, which cell sites and services were affected, the geographic area, the known or suspected cause, and any third-party involvement.
- No delegating accountability. Where a network, wholesale service or other third party is involved, the regulated provider — not the third party — remains responsible for reporting.
- A tighter "critical" threshold. Ofcom also proposes lowering the trigger for its highest severity category from 3 million to 1.5 million user-hours lost, meaning more incidents would qualify for the fastest reporting track.
Are the three-hour and 72-hour windows new?
No.
Ofcom proposes renaming its incident tiers from urgent / non-urgent / non-major to critical / major / moderate — but says explicitly that this renaming does not change the reporting timeframes.
The highest-tier deadlines — three hours, then 72 hours — already exist. What is actually changing is which incidents get classified into which tier and how much detail each report must contain.
A real-life example: three companies, one incident
Imagine a mobile service outage that involves three organisations:
- the main communications provider responsible for the customer service;
- a network contractor operating part of the affected infrastructure; and
- a cloud or managed-service supplier supporting the underlying system.
Each organisation sees a different part of the incident. The communications provider sees the customer impact and complaints. The network contractor sees the affected cell sites and restoration work. The technology supplier holds the system alerts and the suspected technical cause.
For a critical incident, the main provider needs to send Ofcom an initial notification within three hours and a fuller report within 72 — while the information needed to write that report is split across three companies.
Without a shared process, that usually means email threads, phone calls, spreadsheets and separate documents. Each channel tends to drift: different incident times get recorded, customer-impact figures change without a clear update trail, explanations of the cause vary between companies, and nobody can say for certain who approved the final wording that went to Ofcom.
How CommsPliant handles this
CommsPliant gives each organisation its own controlled contribution document within the shared incident workspace.
The network contractor records the affected infrastructure and restoration timeline. The technology supplier records its technical findings. The communications provider adds the customer impact and prepares the final regulatory wording.
Every contribution is timestamped, attributed and versioned.
Access is scoped by role and by document. External contractors see and edit only the contribution documents assigned to them. They do not see the other organisations' documents or the final regulatory submission unless they are explicitly granted access.
The responsible communications provider reviews the separate contributions, decides what must be reported and approves the two official communications:
- the initial three-hour notification; and
- the fuller 72-hour report.
The result is three organisations contributing through one controlled process instead of three disconnected email threads — with a clear record of who supplied each piece of information, what changed and when.
The practical takeaway
Ofcom's proposals are not final, but the direction is clear: incident reporting is becoming more consistent, more geographically specific and more capable of showing the real effect of an outage — including those that affect only a small rural community.
For providers, preparing is not only about monitoring networks. It is also about controlling the information produced during an incident — especially when that information comes from more than one organisation and the clock is already running.