A critical information infrastructure (CII) organisation is a state or private body whose services fall in a field designated under Section 49 of Thailand’s Cybersecurity Act, such as finance, telecoms, energy and public health. This is for executives, IT teams and CII vendors, and covers how to check whether you qualify and the duties that follow.
- The National Cyber Security Committee designates CII characteristics across 7 fields under Section 49, and settles disputes under Section 51.
- Names of the owner, computer possessor and system administrator go to the Office within 30 days of designation (Section 52).
- A cyber risk assessment and an audit at least once a year, with a summary to the Office within 30 days of completion (Section 54).
- Significant cyber threats must be reported to the Office and the regulator; failing without reasonable cause costs up to THB 200,000 (Sections 57, 73).
- IT vendors to CII get cyber requirements in their contracts, including the CII's right to audit them (Code of Practice, item 21.4).
Many Thai IT managers first meet the term CII through a customer, not a statute. A bank sends its software contractor a new contract draft with several extra pages on security audits, footnoted as required by the Cybersecurity Act's code of practice.
Two questions follow. Are we CII too? And if not, why are these duties landing on us? This article answers both from the Cybersecurity Act B.E. 2562 (2019) and the notifications issued under it.
What is a critical information infrastructure organisation?
Under Section 3 of the Cybersecurity Act B.E. 2562 (2019), it is a state or private agency whose mission or service is critical information infrastructure. The infrastructure itself is defined as follows:
"critical information infrastructure" means a computer or a computer system which a State agency or a private agency uses in its undertaking relating to the maintenance of the security of the State, public safety, the economic security of the country, or infrastructure for public benefit;
Read on its own, that definition could catch almost any large company. So the Act does not leave it to each organisation. Section 49 gives the National Cyber Security Committee the power to designate the characteristics of CII organisations.
The Committee shall have the power to prescribe by notification the characteristics of organisations having missions or providing services in the following fields as critical information infrastructure organisations: (1) the field of the security of the State; (2) the field of important public services; (3) the field of finance and banking; (4) the field of information technology and telecommunications; (5) the field of transport and logistics; (6) the field of energy and public utilities; (7) the field of public health; (8) other fields as additionally prescribed by notification of the Committee.
Section 49 paragraph two requires designations to follow criteria the Committee publishes in the Government Gazette and to be reviewed from time to time. Section 51 adds that where there is doubt or dispute about whether an organisation fits, the Committee gives the final decision.
How can we tell whether we might be CII?
Use these five questions as a first screen before talking to your regulator. The final word belongs to the Committee's notification and your supervisory body.
| Question | If yes | Reference |
|---|---|---|
| Is our main mission or service in one of the Section 49 fields? | Go to the next question | Section 49, paragraph one |
| Do the computer systems behind that service relate to state security, public safety, the country's economic security or public-benefit infrastructure? | They fit the definition of critical information infrastructure | Section 3 |
| Is there a body that the law empowers to regulate or supervise our business? | If we are CII, that body audits our minimum standards | Section 3, Section 53 |
| Do our characteristics match the Committee's notification, or has our regulator told us so? | We are CII; the 30-day clock in Section 52 applies | Section 49 paragraph two, Section 52 |
| Still unsure, or we disagree? | Ask the Committee to rule | Section 51 |
State agencies have an extra layer to read. Several provisions in Chapter 3, including Sections 44, 45, 46 and 58, apply to state agencies as well as to CII.
Once designated, what must a CII do, and by when?
The duties fall into three groups: naming who is responsible, building and auditing the programme every year, and reporting when something happens. In date order:
- Designation or ruling dateThe filing deadline starts to runSection 49 paragraph two, Section 51
- Within 30 daysFile names and contact details of the owner, the computer possessor and the system administrator with the Office, the regulator and the Section 50 coordination centreSection 52 paragraph one
- Without delayAdopt your own code of practice and standards framework, and notify the Office of executive-level and operational-level contactsSections 44 and 46
- At least once a yearRisk assessment by an assessor and a cybersecurity audit by an internal or independent external auditorSection 54 paragraph one; Code items 17.1 and 18
- Within 30 days of completionSubmit the summary report to the Office, with a copy to the regulatorSection 54 paragraph two; Code item 17.2
- Within 30 days of an audit report finding non-complianceSubmit a corrective action plan with timeframes, unless the Regulating Committee says otherwiseCode item 17.3
- Yearly, and after significant changeReview the cyber incident response planCode items 19.3 and 19.4
- At least 7 days before a change of responsible personNotify the change in advance, or promptly if an unavoidable need arisesSection 52 paragraph two
- When a significant cyber threat occursReport to the Office and the regulator, then respond under Part 4 of Chapter 3Sections 57 and 58
File your responsible persons within 30 days
For the benefit of contact and coordination, a critical information infrastructure organisation shall notify the names and contact information of the owner of the proprietary right, the possessor of the computer, and the computer system administrator to the Office, to its regulatory or supervisory organisation, and to the organisation under มาตรา 50, within thirty daysThe rest of Section 52 paragraph one says the people named must at least be those responsible for running the organisation. The names you file should belong to people with real decision-making power, not a shared IT inbox.
Code of practice, risk assessment and the annual audit
Section 44 requires each CII to adopt its own cybersecurity code of practice and standards framework, and sets two minimum contents:
The code of practice on cybersecurity under paragraph one shall at least consist of the following matters: (1) a plan for the audit and assessment of cybersecurity risk by an assessor, an internal auditor, or an independent external auditor, at least once a year; (2) a plan for responding to cyber threats.
If a CII has no code of its own, or an incomplete one, Section 44 paragraph three applies the code prepared by the Office instead. The one in use is the Cybersecurity Regulating Committee's Notification on the Code of Practice and Standards Framework, B.E. 2564 (2021), which took effect one year after its Gazette publication.
A critical information infrastructure organisation shall arrange for an assessment of cybersecurity risk by an assessor, and shall also arrange for a cybersecurity audit by an information security auditor, whether by an internal auditor or by an independent external auditor, at least once a year.
Section 54 paragraph two then gives 30 days from completion to send the summary report to the Office. Item 17.1 of the 2021 Code sets the audit scope: the business impact analysis (BIA) process and results, the critical services identified by the BIA, and compliance with the Act, the Code and related standards. Item 18 adds a defined risk appetite, key risk indicators and regular reporting to the organisation's board.
17.3 In the case where an audit conducted under มาตรา 54 identifies non-compliance with 17.1, unless the CSC specifies otherwise in writing, the critical information infrastructure organization shall submit a corrective action plan to the Office within 30 (thirty) days from the date of receiving the audit reportIf standards are still not met, the Act escalates to people before money. Under Sections 53 and 55 the regulator first orders a fix. If that is ignored, the matter goes to the Cybersecurity Regulating Committee, which for a private organisation notifies the top executive, the computer possessor and the system administrator to rectify without delay, with the Secretary-General following up.
When an incident hits, who must a CII tell, and what is the penalty?
Both the Office of the National Cyber Security Committee (NCSA) and the organisation's own regulator, whenever a cyber threat significantly affects the CII's systems.
When a cyber threat occurs which is significant to the system of a critical information infrastructure organisation, the critical information infrastructure organisation shall report to the Office and to the regulatory or supervisory organisation, and shall carry out operations to respond to the cyber threat as provided in Part 4. In this regard, the Cybersecurity Regulating Committee may also prescribe the rules and procedures for such reporting.
Section 57 itself sets no hour count; it lets the Regulating Committee prescribe reporting rules. Section 58, which applies to state agencies and CII alike, requires the organisation to examine its data and systems when a threat occurs or is expected, and to notify the Office and its regulator promptly.
Any critical information infrastructure organisation which fails, without reasonable cause, to report a cyber threat incident under มาตรา 57 shall be liable to a fine not exceeding two hundred thousand baht.Liability does not stop at the company. Under Section 77, a director, manager or person responsible for operations who gave the instruction, or who had a duty to act and failed to, is liable to the same penalty.
We are not CII but we work for one. What reaches us?
Mostly the contract. The Act does not place the Section 52 to 57 duties on vendors directly, but the 2021 Code of Practice keeps the CII responsible for outsourced work and requires it to write requirements into its contracts.
Item 10 of the Code's annex defines third-party service provider broadly: IT service providers, anyone connected to the CII's systems, and anyone who can access the CII's important data or its users' data. Software houses, cloud providers and remote support teams all fall within it.
21.4.1 The organization shall be Responsible and Accountable for maintaining the cybersecurity of the critical information infrastructure, even where a third-party service provider carries out any operation in respect of the critical services of the government agency and the critical information infrastructure organization.
Because the CII cannot hand off that responsibility, item 21.4.2 requires cyber requirements in the service level agreement or contract terms, covering at least four matters. The fourth is the one vendors notice first:
(d) The right of the government agency and the critical information infrastructure organization to audit the cybersecurity of the third-party service provider.
| What you will see in the contract or the work | Source | What to have ready |
|---|---|---|
| Types of provider accessing critical-service assets, by business need and risk profile | Item 21.4.2(a) | A list of systems, accounts and access paths your team uses |
| Your obligations to protect critical services from cyber threats | Item 21.4.2(b) | Your security policy and evidence that you follow it |
| Service and product supply-chain risk | Item 21.4.2(c) | A list of the software and subcontracted services you rely on |
| The CII's right to audit your security | Item 21.4.2(d) | Readiness for an audit, or a third-party audit report |
| Third-party or product audits | Item 21.4.3 (should consider) | Existing test results or certifications |
| Awareness training for contractors and third parties with CII access | Item 22.5.1 | Staff attendance and training records |
| Forensic or recovery vendor contacts in the incident plan | Item 19.1(h) | An emergency contact who answers out of hours |
The National Cyber Security Committee's 2023 Notification on Minimum Standards for Information or Information Systems raises the bar for high-impact systems. Clause 4(3) adds third-party management, vulnerability assessment and penetration testing, information sharing, and resilience and recovery on top of the medium-level controls.
(3) Where the information or information system has cybersecurity characteristics at the high level, minimum cybersecurity control measures for the information or information system shall be established under the following headings: (a) comply with paragraph (2); (b) Vulnerability Assessment and Penetration Testing; (c) Third Party Management;
If the contract involves personal data, the vendor also has its own duties as a data processor under Section 40(2) of the PDPA: appropriate security measures, and telling the data controller about any breach. Our guide to processor agreements covers that side.
How much should an ordinary private company care about the Cyber Act?
If you are not CII, not a state agency and not working for one, the Part 3 duties in Chapter 3 do not apply to you directly. The 2023 minimum-standard notification also defines agency as state agencies, regulators and CII only.
Two things still matter. Section 58 paragraph two lets any organisation or person struggling to handle a cyber threat ask the Office for help. And PDPA security duties already apply to every data controller, while the NCSA framework is a structure you can borrow straight away. See the minimum security checklist comparing NCSA and PDPC rules.
In AIPDPA, security controls come pre-mapped to the PDPC, ETDA and NCSA standards, so your IT team sees on one page which law each control answers. When an incident happens, the breach register runs the PDPA 72-hour countdown. Start with the free website scan to see what outsiders see.
Common CII mistakes
Status comes from the Committee's designation under Section 49 or a ruling under Section 51, not from the field alone.
Section 52 asks for the names of the owner, computer possessor and administrator, who must at least be people responsible for running the organisation.
Section 54 paragraph two and Code item 17.2 require a summary to the Office within 30 days, with a copy to the regulator.
Section 58 says to notify promptly, and Section 73 penalises a CII that fails to report under Section 57 without reasonable cause.
Code item 21.4.1 keeps the CII responsible and accountable even where a third party carries out the work.
It matches what Code items 21.4.2(a) and (d) ask the CII to put in the contract.
Frequently asked questions
What is CII in Thailand?
A critical information infrastructure organisation is a state or private agency whose mission or service is critical information infrastructure, under Section 3 of the Cybersecurity Act B.E. 2562 (2019). The National Cyber Security Committee designates the characteristics of such organisations under Section 49.
Which sectors can be designated as CII?
Section 49 lists seven fields: state security, important public services, finance and banking, information technology and telecommunications, transport and logistics, energy and public utilities, and public health. The Committee may add others.
What if we are not sure whether we are CII?
Under Section 51, doubts or disputes about whether an organisation fits a Section 49 or 50 designation are decided by the Committee, and the 30-day deadline in Section 52 then runs from the date of that ruling.
How often must a CII be audited?
At least once a year: a risk assessment by an assessor and a cybersecurity audit by an internal or independent external auditor under Section 54, with a summary report to the Office within 30 days of completion.
What is the penalty for a CII that does not report a cyber threat?
Under Section 73, a fine of up to 200,000 baht if it fails to report under Section 57 without reasonable cause. Section 77 extends liability to directors or managers who gave the instruction or failed to act.
Do IT vendors to a CII have duties under the Cyber Act?
The Section 52 to 57 duties belong to the CII. But item 21.4 of the 2021 Code of Practice requires the CII to put cyber requirements, including audit rights, into its contracts with third-party providers, so vendors take on duties by contract.
Law and sources
- Cybersecurity Act B.E. 2562 (2019) — Section 3 · Section 44 · Section 49 – Section 58 · Section 73 · Section 77
- Cybersecurity Regulating Committee Notification on the Code of Practice and Standards Framework for State Agencies and CII Organisations, B.E. 2564 (2021) — Clause 17 · Clause 18 · Clause 19 · Clause 21.4 · Clause 22.5.1
- National Cyber Security Committee Notification on Minimum Standards for Information or Information Systems, B.E. 2566 (2023) — Clause 3 · Clause 4 (3)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)