ofcom is "fun". been working on implementation UK Telecommunications Security Code of Practice that been managed by ofcom. There are some very undefined controls with rather vague examples (that say "for example" and "not exhaustive list"). I tried to get from them clarification about how it should be applied, as controls/examples not clear. they wrote me back that I should simply look at example as they explain everything