KCOM Group PLC

United Kingdom · www.kcom.com · 20 vendors

KCOM Group Limited is a UK communications and IT services provider, offering broadband internet, telephony, and IT solutions to residential and business customers. The company provides essential telecommunications infrastructure and services, including fixed-line and fibre-to-the-premises networks, primarily in Hull, East Yorkshire, and North Lincolnshire. KCOM also offers managed IT services, cloud solutions, and cybersecurity offerings to enterprises and public sector organizations.

Resilience scores

Technology vendors

Services catalogue

3 services in catalogue across 2 categories; runs on 20 sub-vendors.

Insights

Last updated 2026-07-19 · revision 2

20 direct vendors, 241 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

KCOM Group PLC exhibits high migration readiness due to its advanced and diverse technology stack. The company has extensively adopted leading cloud platforms (AWS and Microsoft Azure), holding Premier Consulting Partner status with AWS and Gold Cloud Platform Competency with Azure, indicating significant expertise and investment in cloud solutions. The presence of DevOps competencies for both AWS and Microsoft, along with the use of Red Hat OpenStack and cloud-native VoIP platforms, suggests a strong capability for modern application development, containerization, and microservices architectures, even if not explicitly detailed. The absence of specified data residency requirements is a significant advantage, offering greater flexibility for data placement during migration. While deep partnerships with vendors like Cisco and ForgeRock could imply some level of lock-in in specific areas, KCOM's multi-cloud strategy (AWS and Azure) and use of open-source components (Red Hat) mitigate overall vendor lock-in risk, providing flexibility to migrate between cloud providers or leverage best-of-breed services. The primary challenges to migration readiness stem from the lack of data on the regulatory environment and financial stability, which could introduce unforeseen complexities or funding constraints. However, based on the available technological data, KCOM is well-positioned for future migrations.

Compliance

13 in-scope frameworks identified; showing 3.

Modern Slavery Act 2015 — Compliant

KCOM publishes a Modern Slavery Statement on its website, as required by Section 54 of the Modern Slavery Act 2015 for commercial organisations with an annual turnover of £36 million or more. Risk is Low because KCOM demonstrates active compliance through published statements and a Supplier and Partner Code of Conduct.

Evidence: https://www.kcom.com/responsibility/corporate-governance/modern-slavery-statement/, https://www.kcom.com/media/1622/supplier-and-partner-code-of-conduc.pdf, https://www.legislation.gov.uk/ukpga/2015/30/section/54/enacted

Cyber Essentials & Cyber Essentials Plus — Compliant

KCOM holds current Cyber Essentials and Cyber Essentials Plus certifications (2026), demonstrating compliance with the UK government's baseline cybersecurity framework. Cyber Essentials Plus involves independent technical verification of controls. Risk is Low because active certification provides strong assurance of baseline cybersecurity hygiene. These certifications are also required for UK government contracts, supporting KCOM's public sector business.

Evidence: https://www.kcom.com/media/4qcbq1r3/kcom-cyber-essentials-2026-certificate.pdf, https://www.kcom.com/media/pi0bt3im/cyber-essentials-plus-2026-certificate.pdf, https://www.kcom.com/responsibility/corporate-governance/standards-policies-and-codes/, https://www.ncsc.gov.uk/cyberessentials/overview

ISO 27001 (source) — Compliant

KCOM holds a current ISO 27001:2022 certification, as evidenced by the publicly published certificate (2025). This is the latest version of the standard, demonstrating that KCOM has undergone a third-party audit by an accredited certification body and maintains a conformant Information Security Management System (ISMS). Risk is Low because active certification with annual surveillance audits provides strong assurance of ongoing compliance. The 2022 version of the standard includes updated controls relevant to cloud security and threat intelligence.

Evidence: https://www.kcom.com/media/2ljhp1wd/iso-27001-certificate-2025.pdf, https://www.kcom.com/responsibility/corporate-governance/standards-policies-and-codes/, https://www.iso.org/standard/27001

Financials

Three-year financials

Financial Resilience Score: 6/10

KCOM Group Limited benefits from a durable, regionally entrenched market position in Hull and East Yorkshire, where it operates the UK's only non-Openreach incumbent local access network. This monopoly-like position provides stable ARPU, low churn, and a regulated wholesale revenue stream, supporting long-term cash generation. The company is backed by Macquarie Asset Management (via MEIF 6 Fibre Limited), a patient infrastructure investor with deep experience financing fibre platforms, which supports refinancing capacity and shareholder loan structures. KCOM's multi-year FTTP build (Lightstream) is now largely complete in its incumbent footprint, which should reduce forward capex intensity and improve free cash flow conversion. However, resilience is constrained by high leverage typical of Macquarie-owned fibre platforms, exposing the group to refinancing and interest rate risk. Geographic concentration in a single UK region limits diversification, and competitive intrusion from altnets such as MS3 Networks (and potentially Openreach) threatens the historic monopoly for the first time in over a century. Regulatory oversight by Ofcom's Hull Access Market Review constrains wholesale pricing, and a legacy defined-benefit pension scheme (Kingston Communications Pension Scheme) adds funding obligations. The post-2019 group is materially smaller after divestment of national ICT/enterprise businesses, limiting scale advantages versus national telcos.

Key strengths: Regional network monopoly-like position in Hull/East Yorkshire (no Openreach in local access), Full-fibre FTTP build (Lightstream) largely complete, reducing forward capex intensity, Long-term infrastructure ownership by Macquarie Asset Management provides patient capital, Award-winning network reliability (~16 faults per 1,000 customers vs UK avg ~44), Regulated wholesale revenue stream provides stable cash flows

Risk factors: High leverage typical of Macquarie-owned fibre platforms; refinancing/interest rate sensitivity, Geographic concentration in a single UK region (Hull/East Yorkshire/N. Lincolnshire), Competitive overbuild by altnets (MS3 Networks) and potential Openreach entry, Ofcom regulatory price controls on Hull wholesale access, Legacy defined-benefit pension scheme (Kingston Communications Pension Scheme), Small absolute scale limits procurement and content leverage versus national telcos

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report