Telecom infrastructure is moving from light oversight to direct state control in 2026. Forrester predicts that five governments will nationalize or impose strict restrictions on telecom infrastructure this year, driven by the Salt Typhoon cyberespionage campaign that breached over 600 organizations across 80 countries. Moreover, its attackers went undetected for years, which showed how exposed commercial networks are to nation-state actors. First, Australia has strengthened its SOCI Act reforms to put telecom assets under direct oversight. Also, Italy has advanced a 22 billion euro restructuring of its national network. The US, meanwhile, has banned Chinese and Russian ownership of subsea cables and raised cybersecurity standards for critical infrastructure. This guide explains why control of telecom infrastructure is tightening, what CISOs and compliance teams should expect and how to prepare.
Why Telecom Infrastructure Is Moving Toward Government Control
For decades, governments treated telecom providers as commercial businesses that needed only light oversight. Then Salt Typhoon changed that view. Nation-state actors breached major providers and stayed hidden for years, reaching call records, metadata and the communications of government officials and private citizens across 80 countries.
The breach showed that commercial incentives alone cannot secure infrastructure that governments see as essential to national security, the economy and public safety. So governments no longer want to rely on voluntary compliance or self-regulation for networks that carry government communications, financial transactions and control data for other critical systems.
Regulation is also arriving from several directions at once. In the EU, NIS2, the Digital Markets Act, the Digital Services Act and the AI Act are all being enforced, which gives telecom operators overlapping obligations. Taken together, the trend is a structural move from market-based security toward state-directed protection of telecom infrastructure.
Salt Typhoon is a cyberespionage campaign attributed to nation-state actors. It breached over 600 organizations across 80 countries by targeting commercial telecom networks, where attackers exploited vulnerabilities to reach call records, metadata and, in some cases, the content of officials’ communications. Because it went undetected for years, it showed that commercial security measures could not stop persistent, well-funded state attackers.
How Five Governments Are Taking Control of Telecom Infrastructure
The governments expected to nationalize or restrict telecom infrastructure in 2026 are taking different routes. But they share one goal: direct state control over networks they consider too critical to leave in commercial hands.
What Changing Telecom Rules Mean for CISOs
For CISOs and compliance teams, these changes reach well beyond the telecom industry. After all, almost every enterprise relies on commercial telecom infrastructure. So each one needs to understand how the new rules affect its own security posture and compliance duties.
| Impact Area | What Is Changing | CISO Response Required |
|---|---|---|
| Supply Chain Risk | Vendor nationality and origin restrictions tightening | ✓ Inventory all telecom hardware and software for adversary vendors |
| Incident Reporting | CIRCIA mandates 72-hour reporting for critical sectors | ✓ Build incident response workflows meeting regulatory timelines |
| Data Sovereignty | Communications data residency increasingly regulated | ◐ Map data flows across telecom providers and jurisdictions |
| Quantum Readiness | Harvest-now-decrypt-later threats driving PQC mandates | ◐ Begin post-quantum cryptography transition planning |
| IoT Security | Insecure telecom IoT ecosystems under regulatory scrutiny | ✗ Most organizations lack visibility into telecom IoT exposure |
Forrester warns that ecosystem risk will grow, because telecom relies on large IoT ecosystems that are notoriously insecure and often exploited. Low-Earth-orbit satellites also add new attack surfaces that current rules do not cover. As a result, CISOs need to bring telecom dependencies into their risk assessments.
By late 2026, the line between telecom and cloud regulation is expected to blur. After a major hyperscaler outage in late 2025, regulators began discussing whether cloud providers should count as essential infrastructure with the same resilience and reporting duties as telecom operators. A first cloud carrier category may appear in 2026, which would require approval under both telecom and cloud frameworks. For enterprises that use both, one compliance event could then trigger duties under several regimes at once.
Talk to an ExpertUnsure how new telecom rules affect your network? Review your exposure with us.
Quantum Threats to Telecom Infrastructure
Quantum computing adds pressure, because telecom networks carry exactly the data that harvest-now-decrypt-later attacks target. Adversaries collect encrypted traffic today and plan to decrypt it once quantum computers mature, which could expose years of government, financial and corporate communications.
Forrester predicts that quantum security spending will exceed 5% of overall IT security budgets in 2026. NIST has published post-quantum cryptography standards that organizations can start using now. Still, migrating entire telecom networks will take years and needs coordinated investment from operators, regulators and enterprise customers.
Five Telecom Infrastructure Priorities for 2026
Based on Forrester’s predictions and the current rules, here are five telecom infrastructure priorities for CISOs, compliance officers and infrastructure leaders:
- Inventory all telecom-dependent infrastructure for adversary vendor exposure: Governments are restricting vendors by nationality. So document every hardware and software component in your telecom supply chain. That way you find replacement needs before deadlines hit.
- Build incident reporting workflows for multiple frameworks: CIRCIA, NIS2, SOCI and other mandates set different reporting timelines. So build one workflow that meets the strictest. Then a single incident triggers the right notices in every jurisdiction.
- Expand risk assessments to cover telecom infrastructure dependencies: As governments take control of telecom assets, check how changes in ownership or regulation could affect your connectivity and data transfer. Also look for single points of telecom dependency.
- Begin post-quantum cryptography transition planning for sensitive communications: Harvest-now-decrypt-later attacks target data in transit. So move your most sensitive communications to PQC first. Data you encrypt today then stays protected when quantum computing matures.
- Monitor the cloud-telecom regulatory convergence closely: Cloud providers may face telecom-style rules by late 2026. So track developments that could add overlapping duties. Also check whether your providers will stay compliant under the new frameworks.
The Short Version
Key Takeaway Control of telecom infrastructure is moving to the state as five governments nationalize or restrict it in 2026, after the Salt Typhoon breach of 600+ organizations across 80 countries. Australia enforces SOCI Act oversight, Italy restructures its national network for 22 billion euros and the US bans adversary ownership of subsea cables. CISOs should check supply chains for restricted vendors, build incident reporting that works across frameworks and start PQC transitions. The blending of telecom and cloud regulation will change compliance duties for every enterprise that depends on these networks.
Looking Ahead: Telecom Regulation Beyond 2026
Pressure on telecom infrastructure is likely to grow as governments treat communications networks as sovereign assets. The move toward nationalization and direct oversight may spread beyond the first five governments as other countries respond to espionage on their own networks. Telecom, cloud and AI rules are also likely to converge into shared frameworks for all critical digital infrastructure.
Organizations that adapt early can turn compliance into an advantage. Those that react to each new mandate separately will face rising costs, fragmented compliance programs and a growing risk of penalties as frameworks multiply across jurisdictions.
For CISOs and compliance leaders, telecom is an early signal for wider critical infrastructure governance. Governments that take control of telecom today are likely to apply similar rules to cloud, AI and data infrastructure later. So compliance programs that work across frameworks will cope with each new shift far better than ones built around a single framework.
Our ServiceCybersecurity Services
Frequently Asked Questions
References
- Five Governments Nationalize, Salt Typhoon 600+ Orgs, Australia SOCI, Italy 22B, US Subsea Bans: Forrester — Predictions 2026: Cybersecurity and Risk Leaders Grapple With New Tech and Geopolitical Threats
- CISO Implications, IoT Ecosystem Risk, LEO Satellite Attack Surfaces, Regulatory Fragmentation: CybrSec Media — Forrester’s 2026 Cybersecurity Predictions
- Cloud-Telecom Convergence, Sovereign Cloud Contracts, Operator Dual Identity, 6G Spectrum: Wray Castle — Telecom Regulation 2026: What Industry Leaders Need to Know
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.