If your organisation runs critical information infrastructure (CII) in Thailand, the Cybersecurity Act B.E. 2562 (2019) and its notifications require a code of practice, an annual risk assessment and audit, and a 24-hour report to the national agency when a significant cyber threat hits your CII systems. The Act set up a National Cybersecurity Committee chaired by the Prime Minister, a Cybersecurity Regulating Committee chaired by the Minister of Digital Economy and Society, and an Office (the NCSA) that monitors, coordinates and responds. It also created three cyber threat levels, with powers that grow at each level, and fines for failing to report or to follow orders. This guide covers who is in scope, the duties in the Act and in the Royal Gazette notifications that put them into practice, the threat levels, the penalties and what the regime means for service accounts, API keys and AI agents. It is for CISOs, compliance leads and security architects at Thai CII organisations and the suppliers that support them. It is a cyber law page, not a privacy page: for personal data duties read the Thailand PDPA Guide.
Sources: Royal Gazette texts of the B.E. 2564 (2021) and B.E. 2566 (2023) notifications, and the Ministry of Digital Economy and Society briefing on the Act, checked 8 November 2026. Translations from Thai are ours. Most texts are official Royal Gazette or ministry sources; section numbers for penalties come from the MDES briefing. Confirm against the official text before relying on it.
Key takeaways
- Designation drives scope: a 2021 National Cybersecurity Committee notification lists the CII missions and services across seven sectors and names the regulator for each; the CII duties apply to organisations that carry out those missions.
- 24 hours for significant threats: a 2023 Regulating Committee notification requires a CII organisation to report a significant cyber threat to the NCSA within 24 hours of detection, and to its regulator within the regulator's deadline.
- Annual risk assessment and audit: the 2021 code of practice notification requires both at least once a year, an audit summary to the NCSA within 30 days, and a remediation plan within 30 days where gaps are found.
- Three threat levels: non-serious, serious and critical, judged on impact to systems, data, recovery and users; powers to order action grow with each level.
- Fines are modest but personal: failing to report can cost up to THB 200,000, ignoring a committee order up to THB 300,000 plus THB 10,000 a day, and directors who order or allow an offence can share the liability.
Scope: who and what is covered
The Act took effect on 28 May 2019 and has 83 sections, according to the Ministry of Digital Economy and Society (MDES) briefing. Its stated aim is to prevent, respond to and reduce cyber threats that could disrupt CII and public services. Section 49 names the CII sectors and lets the National Cybersecurity Committee add others.
The National Cybersecurity Committee notification on CII criteria (Royal Gazette Vol. 138, Special Part 194 Ng, 23 August 2021, in force 24 August 2021) treats an agency as CII when it carries out a listed mission or service and a cyber threat against it would do one of three things: severely affect national image, international relations, public order or national security; affect the CII of other agencies; or disrupt a national essential service in a way that harms life, health, safety, property or national economic security if not fixed quickly.
| Sector (2021 notification annex) | Examples of listed missions or services | Regulators named (examples) |
|---|---|---|
| 1. National security | Defence capability, law enforcement, threat monitoring and alerts | Ministry of Defence, Royal Thai Police, National Security Council Office |
| 2. Essential government services | Government finance, public services, disaster and irrigation alerts | Ministry of Finance, Customs Department, Digital Government Development Agency |
| 3. Banking and finance | Retail payments, BAHTNET, PromptPay, securities exchange, clearing and depository | Bank of Thailand, Securities and Exchange Commission |
| 4. ICT and telecommunications | Fixed-line, mobile and fixed broadband | National Broadcasting and Telecommunications Commission |
| 5. Transport and logistics | Road, rail, sea and air | Ministry of Transport, Department of Rail Transport, Civil Aviation Authority of Thailand |
| 6. Energy and utilities | Electricity, petroleum and gas, water supply | Ministry of Energy |
| 7. Public health | Hospital services, medical testing, pharmaceuticals and devices, digital health data | Ministry of Public Health, Food and Drug Administration |
Regulators may publish their own guidance on applying the criteria to the organisations they supervise. If you are unsure whether a service is listed, ask your sector regulator in writing; the answer decides which duties below apply. Suppliers that are not CII themselves will still meet the duties through contracts, because the code of practice holds the CII organisation accountable for services that vendors run (see Key obligations).
| Body | Role, per the MDES briefing |
|---|---|
| National Cybersecurity Committee | Chaired by the Prime Minister; proposes policy and action plans, sets measures and standards, designates CII criteria, defines threat levels |
| Cybersecurity Regulating Committee | Chaired by the Minister of Digital Economy and Society; sets the minimum code of practice and standards framework for CII; issues reporting rules |
| Office Management Committee | Oversees the Office's operations and plans |
| The Office (NCSA) | Monitors, alerts, coordinates and assists; runs training and drills; ThaiCERT incident reporting sits here |
| Sector regulators | Check minimum standards, order corrections and escalate to the Regulating Committee if an operator does not act (Section 53) |
Key obligations
Code of practice and standards framework (2021)
The Regulating Committee notification on the code of practice and standards framework for state agencies and CII organisations (Royal Gazette Vol. 138, Special Part 208 Ng, 6 September 2021, issued under Sections 13 and 54) took effect one year after publication. It is the most detailed list of what a CII organisation must run.
| Area | Requirement | Clause |
|---|---|---|
| Audit | Annual audit by an internal or independent auditor; summary to the NCSA within 30 days of completion, copy to the regulator | 17.1, 17.2 |
| Remediation | Remediation plan with actions and dates to the NCSA within 30 days of receiving an audit report that finds gaps | 17.3 |
| Risk assessment | At least annually and after significant change; risk register with set fields | 18, 21.2 |
| Asset register | Current inventory of critical service assets, reviewed annually | 21.1 |
| Vulnerability assessment and penetration testing | Assess IT and industrial control systems, including before new connections or major change; test internet-facing systems where needed; pen test summary to the NCSA within 30 days of a request | 21.3 |
| Third parties | The organisation stays accountable for CII security run by vendors; security requirements and audit rights in contracts | 21.4 |
| Protection | Security baselines reviewed annually, change management, logging and access reviews, encryption of all remote network connections | 22 |
| Incident response | Plan with an incident response team, reporting structure, containment, recovery and evidence preservation; reviewed and tested annually | 19, 24.1 |
| Crisis communication and exercises | Crisis communication plan tested annually; take part in national or sector exercises when ordered in writing | 24.2, 24.3 |
| Business continuity | Plan with maximum tolerable period of disruption, recovery time and recovery point objectives, aligned with vendor plans, tested at least annually | 25.1 |
Reporting cyber threats (2023)
The Regulating Committee notification on criteria and methods for reporting cyber threats (Royal Gazette Vol. 140, Special Part 107 Ng, 9 May 2023, in force 10 May 2023, issued under Sections 13(5) and 57) sets three reporting steps:
- Initial notice (clause 4): when a state agency or CII organisation experiences or expects a cyber threat, it investigates, assesses severity, responds under its own code of practice and notifies the NCSA as soon as possible after detection with the details in Annex 1. CII organisations also notify their regulator within the regulator's timeframe.
- Significant threat report (clause 5): where the threat affects a CII information system, the organisation sends the Annex 2 report to the NCSA within 24 hours of detection, and to its regulator within the regulator's deadline. If the facts are incomplete at 24 hours, send what you have and update; finish with a closing report. Sensitive detail may be limited under confidentiality policies.
- Annual summary (clause 6): state agencies and CII regulators send the NCSA a summary of all cyber incidents by category by 31 January of the following year (Annex 3).
Reports may be written or electronic (clause 7). ThaiCERT, part of the NCSA, lists a 24-hour reporting line and the address [email protected] on the NCSA site.
Duties in the Act itself
The MDES briefing summarises the Act's duties as: follow the national policy and plan; adopt a code of practice consistent with the minimum framework; run risk assessment with an audit at least once a year and an incident response plan (Section 54); name administrative and operational contacts for the Office; monitor threats to CII systems; take part in readiness tests; and report significant threats to the Office and the regulator.
Timeline and current status
| Date | Event | Source |
|---|---|---|
| 28 May 2019 | Cybersecurity Act B.E. 2562 in force | MDES briefing |
| 24 August 2021 | CII criteria and regulator assignment notification in force | Royal Gazette, 23 August 2021 |
| 6 September 2021 | Code of practice and standards framework notification published; in force one year later (about 6 September 2022) | Royal Gazette |
| 12 December 2021 | Threat level and measures notification in force | Royal Gazette, 11 December 2021 |
| 10 May 2023 | Cyber threat reporting notification in force (24-hour report) | Royal Gazette, 9 May 2023 |
Subordinate notifications change more often than the Act, and amendments to the Act itself have been discussed publicly. As of November 2026, check the Royal Gazette and the NCSA for any newer notification or amendment before relying on a specific deadline, and treat this page as a starting point.
Enforcement and penalties
Threat levels and powers
The National Cybersecurity Committee notification on threat characteristics and measures (Royal Gazette Vol. 138, Special Part 303 Ng, 11 December 2021, issued under Section 60) defines three levels. Severity is judged on four factors: effect on equipment or systems, effect on data, recovery outlook and effect on users. Where the facts fit more than one level, the highest applies, and the committee can reclassify as facts emerge. Some English translations of the Act use non-critical, critical and crisis for the same three levels.
| Level | Characteristics (paraphrased) | Powers, per the MDES briefing |
|---|---|---|
| Non-serious | Performance degraded but systems keep running; recovery possible under the plan; limited group of users affected | Normal measures; report within the regulator's timeframe |
| Serious | Attacks on main services or CII intended to stop them; main services cannot be recovered under the plan; all users affected | Orders to act and requests for information; court involvement for measures that affect rights (Sections 63 to 65) |
| Critical | System-wide failure, standard remedies fail, risk of spread to other infrastructure, possible threat to public order or national security | National Security Council may act; the Secretary-General may act immediately and report to the court in parallel |
Entering premises or seizing equipment requires a court order and must be limited to what is necessary, according to the MDES briefing.
Penalties
| Section | Offence | Maximum penalty |
|---|---|---|
| 73 | CII organisation fails to report a threat without reasonable cause | Fine of THB 200,000 |
| 74 | Any person fails to comply with a summons or provide information without reasonable cause | Fine of THB 100,000 |
| 75, para. 1 | Fails to monitor or check for defects as ordered, or to comply with a committee order | Fine of THB 300,000 plus up to THB 10,000 a day until compliance |
| 75, para. 2 | Fails to remediate threats, preserve data or comply with a court order on data access | 1 year, THB 20,000, or both |
| 76 | Obstructs or refuses orders of the committee or officers | 3 years, THB 60,000, or both |
| 77 | Directors or managers who order or allow a juristic person's offence | Same penalty as the offence |
Sections 70 to 72 also penalise officers and others who unlawfully disclose information obtained under the Act. Amounts are from the MDES briefing; the 2023 reporting notification separately confirms the THB 200,000 maximum under Section 73.
What it means for AI agents and non-human identities
The Act is technology-neutral, but its duties land on machine access. A risk register, an asset register, annual audits and access reviews will all test how service accounts, API keys, certificates and automation reach CII systems.
- Asset and risk registers (clauses 21.1, 21.2): list every non-human identity with privileged access to CII systems: SCADA integration accounts, payment switch service accounts, CI/CD deployment tokens and vendor remote access. See the Critical Infrastructure Identity Security Guide.
- Logging and access reviews (clause 22): include machine identities in access reviews and baseline their behaviour, so a compromised service account looks unusual rather than normal. The Detection Engineering for Non-Human Identities Guide sets out the method.
- Remediation and preservation orders (Section 75): fixing a threat often means revoking and reissuing credentials quickly while preserving logs. Know which secrets would need rotating and who owns them before an order arrives.
- Evidence: the threat level notification calls for collecting and preserving logs and alerts for forensic and legal use. Our recommendation is to keep machine identity authentication logs for at least 12 months on CII systems.
- Vendors and AI agents (clause 21.4): vendor API keys and AI agents that act on CII systems are access paths you remain accountable for. Register them, scope their credentials, log their actions and write audit rights into contracts. See the AI agent registry.
Compliance steps
- Confirm status: check your services against the 2021 CII annex and confirm your regulator in writing.
- Name contacts: give the NCSA and your regulator administrative and operational contacts, and keep them current.
- Adopt the code of practice: map your controls to the 2021 notification clause by clause, starting with asset and risk registers, incident response and continuity.
- Build the 24-hour runbook: agree what counts as a significant threat, who decides, who files the Annex 2 report and who updates it. Ask your regulator for its own deadline. Rehearse it in the annual incident response test.
- Run the annual risk assessment and audit: choose an internal or independent auditor, file the summary within 30 days and any remediation plan within 30 days of the report.
- Prepare for orders: document how you would execute monitoring, remediation, preservation and access orders, with legal review of court steps.
- Exercise continuity: test the business continuity and crisis communication plans at least annually and align them with key vendors.
- Watch for change: check the Royal Gazette and NCSA each quarter for new notifications (our recommendation).
| Thai requirement | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Code of practice and minimum standards | GV.OC-03 | CA-2 |
| Annual risk assessment (clause 18) | ID.RA-04, ID.RA-05 | RA-3 |
| Asset register (clause 21.1) | ID.AM-01 | CM-8 |
| Third-party accountability (clause 21.4) | GV.SC-05 | SA-9 |
| 24-hour significant threat report | RS.CO-02, RS.MA-03 | IR-6 |
| Incident response and continuity plans | ID.IM-04, RC.RP-01 | IR-8, CP-2, CP-4 |
| Machine credentials on CII systems | PR.AA-01 | IA-5, AC-2 |
Common failure patterns
- Waiting for certainty: teams debate severity past the 24-hour window. The notification allows a partial report with updates, so file early.
- Forgetting the regulator: the NCSA report is filed but the sector regulator's separate deadline is missed.
- Paper audits: the annual audit reviews documents but never tests privileged and machine access to CII systems.
- Vendors outside the plan: vendor-run services are left out of the risk register and continuity tests, though the organisation stays accountable for them.
- Treating the PDPA as the only Thai duty: privacy breach notification and Cybersecurity Act reporting have different triggers and go to different authorities.
Practitioner checklist
- Confirm CII status and regulator in writing against the 2021 annex.
- Keep administrative and operational contacts current with the NCSA and regulator.
- Map controls to every clause of the 2021 code of practice notification.
- Maintain a 24-hour significant threat runbook, including the regulator's own deadline.
- Complete the annual risk assessment and audit; file the summary within 30 days.
- Include service accounts, API keys, certificates and AI agents in asset and risk registers.
- Write security requirements and audit rights into CII vendor contracts.
- Test incident response, crisis communication and continuity plans at least annually.
- Check the Royal Gazette and NCSA quarterly for new notifications.
Standards and references
- Royal Gazette: Regulating Committee Notification on the Code of Practice and Cybersecurity Standards Framework, B.E. 2564 (Thai)
- Royal Gazette: Regulating Committee Notification on Criteria and Methods for Reporting Cyber Threats, B.E. 2566 (Thai, copy hosted by Mahidol University)
- Royal Gazette: National Cybersecurity Committee Notification on CII Criteria and Regulator Assignment, B.E. 2564 (Thai)
- Royal Gazette: National Cybersecurity Committee Notification on Cyber Threat Levels and Measures, B.E. 2564 (Thai)
- Ministry of Digital Economy and Society: Cybersecurity Act B.E. 2562 briefing (Thai)
- ThaiCERT (NCSA): Cybersecurity Act and related notifications
- National Cyber Security Agency (NCSA)
- NIST: Cybersecurity Framework 2.0
This guide summarises Thailand's Cybersecurity Act B.E. 2562 (2019) and related notifications and is not legal advice. Related NHI Mgmt Group resources: Thailand PDPA Guide · Critical Infrastructure Regulation Map · Incident Response Plan Template · Business Continuity and Disaster Recovery Guide