OUR POLICIES

Being trusted: our code, sets out the principles of how we expect our people, and anyone who represents or works with us, to behave, do business and connect for good.

We understand holding onto a concern can feel heavy. Using our code can help identify if something isn't right. If something concerns you, it concerns us. Because we're in this together, wanting to make a better BT for all of us.

A key channel to speak up is our Speak Up Service which is BT Group's confidential service where any stakeholder of BT Group can share any concern related to anyone or anything not being in line with our code.

Our Speak Up Service is hosted by an external third party, so you can be sure that you can submit your report confidentially or even anonymously. Once logged, concerns are shared with the Group Ethics Team at BT Group, they review these and then work with business at the appropriate Subject Matter Expert (SME) level to get the concern addressed.

Some examples of the concerns people have shared with us are bullying and harassment (including sexual harassment), bribery, corruption, fraud, conflicts of interest, human rights, , substance abuse, threats, theft or misuse of BT resources (including time).

The thought of raising concerns can be difficult, but to Speak Up is to protect each other. Whatever you share is secure. Have confidence in you, and in us as we don't tolerate retaliation against reporters.

We recognise that our supply chain activities have a global impact. Acting with social responsibility towards those involved in the production of our goods and services is crucial if we are to help create a world in which our company can flourish, now and for generations to come.

In the light of this, we have established a supply chain initiative, Sourcing with Human Dignity. This outlines a set of standards based on the United Nations Universal Declaration of Human Rights and International Labour Organisation Conventions. We intend to gain the support of our direct suppliers to promote these standards throughout our supply base.

BT is committed to this initiative, not just because we believe it is right for us to do so, but also because we believe social responsibility is integral to long-term business success. We welcome suppliers who share this commitment and look forward to working collaboratively with you in Sourcing with Human Dignity.

To help us understand your CSR practices, we may invite you to complete our questionnaire where we then evaluate and adopt a risk based approach to identify areas of concern and areas for improvement. We will work with you our supplier to implement improvement actions where required.

Sourcing with Human Dignity Standards are available as pdf documents below:

No supplier will be given access to BT systems and networks as a right. But for specific business reasons, there may be some situations where we can give limited access, if the following conditions are met:

• We will carry out a risk assessment on the supplier to decide whether or not to authorise remote access
• The supplier must have a valid contract in place with us which includes all the relevant security clauses
• The supplier must revalidate their remote access when we ask them to
• The supplier must tell us about any change in remote access requirements such as joiners, movers, leavers as soon as possible
• Suppliers must report any suspected misuse of remote access to us immediately
• Suppliers can only use remote access methods which are provided and managed by us

We need to ensure that third parties providing services to BT Group run industry standard security frameworks to ensure the security of the services they provide to us and to protect our systems, networks and Information

There are different levels within these security requirements which will be advised as applicable according to the type of work, the level of access to information, systems and physical access to BT property.

As a supplier you will be expected to comply with the applicable requirements and make a contractual commitment to that effect.

The Supplier Security Requirements are available as pdf documents below:

BT Security Requirements V5.3, for all new or renewing contracts: Effective from 10th June 2025.

BT operates a Pre-Employment Check Policy for Third Parties to help protect our customers, employees, and assets and to maintain BT's security commitments to the NPSA (National Protective Security Authority).

BT is committed to ensuring that all third party people supplied to undertake work for BT or who require access to BT's property and/or systems to deliver contracted goods or services have appropriate pre-employment checks in advance of any interaction with BT. There are different levels of checks depending on the type of work, the level of contact with BT employees, customers and information, and the requirement for systems and physical access to BT property.

As a supplier you will be expected to comply with the policy and make a contractual commitment to that effect.

BT uses open source software widely for the economic and flexibility advantages that it brings. In doing so, and as with any other software, BT will always comply with all relevant open source software license conditions and obligations that this brings. To this end, BT has an open source software policy covering necessary management and due diligence in the use of open source. The use of open source is also subject to BT's architectural approvals process which drives efficient and controlled use of BT's software assets. BT requires you as a supplier to comply with all open source software licensing conditions.

If you are existing supplier to BT who has a query about this please contact your usual BT Commercial Contact.

Why does BT/Openreach have an access policy?

BT/Openreach has processes in place to protect our people, data, assets and customers. These processes can enable authorised unhosted access to BT/Openreach’s sites and buildings and allows the third party to obtain assets required for access from Physical Security.

You must be aware and follow the obligations of our policies to ensure that our people, data assets and customers are protected. We have a Security Handbook for Third Parties which provides general guidance on the responsibilities third parties have whilst accessing the estate. If there are actions which must be taken where the Security Handbook does not cover you must reach out to the Physical Identity & Access Management team to get advice, they may reach out to specialists across the business if they are unable to answer directly.

How to report issues and concerns on the BT/Openreach estate?

You must report issues to the Physical Security Operations Centre as soon as it is safe to do so. This can be done by phone (0800 321 999) or by email - psoc@bt.com

How do we gain long-term access to the estate?

As a third party attempting to gain access to the estate, you will need a legitimate business reason for why you require access. You will also need a management grade individual from BT/Openreach to “Sponsor” your company for registration on our systems. This individual will be required to raise this request with the Physical Identity & Access Management team at physical.access.administration@bt.com they will be able to advise on how to onboard your company and what would be the best option for access based on the requirements.

What are the options for managing access to the BT Estate?

Option 1 (Redside) - Requesting access directly via the BASOL Redside System

This option provides the flexibility necessary for suppliers to administer their own requests for access to BT buildings and sites.

An Authorising Signatory (AS) and up to 10 delegates can apply for access, cards and keys on behalf of their employees/agents using the BASOL Redside System.

The AS and delegates are approved by a BT manager who sponsor's the company and is responsible for ensuring compliance with security policies.

• The BT Sponsor will raise a request to the Access Control Team for the company to have access to the BASOL Reside System. An ASF1 form must be completed for each AS/delegate to provide the required information, assurance and approvals.
• Up to date records of all personnel who need access to the BT estate for more than 28 days must be maintained using the HR Process. This ensures that access, cards and keys can be managed effectively for the supplier's community.
• Access, cards and keys can be requested using the BASOL Reside System.

Access and keys requested should be the minimum required for the person's role and access should be removed when it is no longer required.

During 2018 new card requests will require submission of a passport style photo so that a BT contractor photo ID card can be provided, until this is fully implemented a standard access card will be provided. You will be advised by the Access Control Management Team when the process change affects you.

• For people with a short term or occasional access requirement, the AS can request approval to manage temporary access, cards and keys that can be allocated via BASOL Redside for a period of up to 28 days.

A BASOL Redside System User Guide will be provided and support will be available from the Access Control Management Team.

Option 2 (Greenside) - Obtaining access via a BT Line Manager/CLM

Suitable for smaller contracts where it is practical for a BT manager to administer access requirements for the contracted personnel.

Under this option a designated BT CLM can obtain all of the necessary access, photo ID cards and keys on behalf of the contracted personnel.

• For people who need to access to BT sites for more than 4 weeks, a UIN should be requested via HR processes and the necessary access, photo ID cards and keys can be requested by the registered BT Line Manager using the BASOL system.
• For people with a short term or occasional access requirement, the BT Line Manager (or a nominated representative) can request approval to manage temporary access, cards and keys that can be allocated via BASOL for a period of up to 28 days.

More detailed information regarding the application process, including all form referred to above, is contained in the BT Physical Access Application Process for non BT organisations.

Suppliers must exercise due care when recruiting employees within their own company or indeed when using employees of any other contractors or agents, who will have access to the BT estate. The employer must ensure that, when an individual is recruited, an employment application form is completed, references are obtained, self-declaration of criminal convictions signed and proof of identity validated (e.g. passport / birth certificate).

All people accessing the BT estate must be in possession of, and display, their own company photo ID if they not using BT provided photo I/ access cards.

To guarantee a safe and secure working environment for everyone to work in, it is vital that all BT people, suppliers, contractors and agency employees are aware of, and carry out, the correct security behaviours in order to maintain the integrity of BT sites.

This is especially the case with BT's telephone exchanges and it is vitally important that these are kept secure at all times.

Access to BT premises and systems will only be granted to a supplier once the employment and contractual process is completed.

Suppliers will only be provided with the minimum access to BT sites and assets as required by their duties.

Where physical access or occupancy is required by a supplier the following Best Practice Guide for Non-BT People MUST be followed. The Guide will help site users to understand more about BT's security systems, policies and procedures.

At BT we are committed to ensuring the products and services we procure meet the needs of all users, customers, and colleagues, including those with disabilities.

It’s vital that all our suppliers understand accessibility and disability and are confident in making their products accessible and making adjustments for disabled users who may need them.

View our accessibility policy