The provider of a public electronic communications network or a public electronic communications service must inform OFCOM as soon as reasonably practicable of—
any security compromise that has a significant effect on the operation of the network or service;
any security compromise within section 105A(2)(b) that puts any person in a position to be able to bring about a further security compromise that would have a significant effect on the operation of the network or service.
In determining for the purposes of this section whether the effect that a security compromise has, or would have, on the operation of a network or service is significant, the following matters in particular are to be taken into account—
the length of the period during which the operation of the network or service is or would be affected;
the number of persons who use the network or service that are or would be affected by the effect on the operation of the network or service;
the size and location of the geographical area within which persons who use the network or service are or would be affected by the effect on the operation of the network or service;
the extent to which activities of persons who use the network or service are or would be affected by the effect on the operation of the network or service.