Security classification under Thailand's 2023 standard is the process of giving data and information systems a low, medium or high impact level for confidentiality, integrity and availability separately. This guide is for IT teams and auditors at government agencies and critical infrastructure operators who have to do it, walking through each step with a worked example.
- The notification applies to government agencies, regulators and CII organisations, and took effect on 19 January 2025.
- Every data category is rated on three objectives: confidentiality, integrity and availability, each at three levels.
- Data already published to the public skips the confidentiality assessment (clause 4, paragraph two).
- A system holding several data categories takes the highest level on each objective (clause 10).
- Ratings must be reviewed at least every 3 years, with reasons recorded for keeping or changing them (clause 11).
IT teams in Thai government agencies keep hitting the same question when they try to meet the National Cyber Security Agency's standards: what level of controls does this system need? The answer lies in two notifications published together in the same Government Gazette issue. The first tells you how to classify; the second tells you which controls each level needs.
This article covers the first: the National Cybersecurity Committee notification on the standard for determining cybersecurity characteristics for data or information systems, B.E. 2566 (2023). The controls for each level are in the minimum standard checklist.
Who must classify under the 2023 notification, and since when?
Any "agency" as defined in clause 3: government agencies, regulatory or supervisory agencies, and critical information infrastructure (CII) organisations. It was published on 18 January 2024 and clause 2 delays its effect by one year, so it has applied since 19 January 2025.
Private companies that are not CII fall outside that definition, but the method is a sound framework for anyone, especially vendors to government or CII clients, who will be asked for system levels anyway. The vendor's view is in Doing IT work for critical infrastructure.
The notification's term "cybersecurity characteristic" is simply the level you are about to assign. Clause 3 ties it to the impact of three kinds of incident.
"Cybersecurity characteristic" (Security category) means the specific characteristic of data or an information system in terms of cybersecurity, based on the assessment and classification of the impact on the agency's operations, the agency's assets, or the safety of the agency's service users, the agency's personnel, or the public, that may occur when the agency's confidential data is leaked, the agency's data is deleted, distorted, or destroyed, or the agency's data or information system is not in a state of readiness for use.
Step 1: How do you split a system into data categories?
Start with your list of systems and work out how many types of data each one holds. The notification rates each data category first and only then rolls the results up to the system. Clause 10, paragraph two, lets an agency define categories by its own criteria or follow guidance from the NCSA office.
Keep categories coarse enough to finish the job and fine enough to separate sensitive data from routine data. An HR system might split into organisation structure, payroll and staff health records. Lump them together and the impact rating will be off.
Step 2: How many objectives do you rate, and which can you skip?
Three, under clause 4: confidentiality, integrity and availability. Each is rated separately, so the same data can be low on confidentiality and high on availability.
The notification offers exactly one shortcut: data already published to the public skips confidentiality. The other two objectives still apply. A public notice page that is defaced, or offline on a key day, can do real damage.
Where the data or information system has already been disclosed to the public, the agency need not consider the objective under paragraph one (1).
Step 3: What do you weigh the impact against?
The four areas in clause 6: money, assets or reputation; the number of people who could be harmed; the agency's ability to do its job; and national security and public order. Run every objective from step 2 through all four areas and take the worst result.
(1) impact on the value of financial or asset damage, or on the agency's reputation; (2) impact on the number of the agency's service users, the agency's personnel, or the public who may suffer harm to life, body, health, property, or other damage; (3) impact on the agency's ability to perform its functions; (4) impact on national security and public order within the country.
CII organisations have an extra layer. Clause 6, paragraph two, makes the sector's regulatory or supervisory agency issue the impact assessment guidance, and lets it add or remove areas as threats change. A CII should get that guidance from its regulator before starting rather than interpret the four areas alone.
Step 4: Where are the lines between low, medium and high?
The wording is the same for every objective: a "limited or negligible" adverse effect is low, a "serious" one is medium, and a "severe or catastrophic" one is high. Clause 7 covers confidentiality, clause 8 integrity and clause 9 availability.
(2) where unauthorized disclosure of data, whether in whole or in part, could have a serious adverse effect on the operations, assets, or reputation of the agency or a person, it shall be classified as medium impact;
The notification gives no baht figure or headcount for "serious". Agencies have to fill that gap. What works is an internal criteria table, for example damage bands in money, the number of people affected, and how long a service can stop, signed off by management before anyone uses it.
Confidentiality has an extra rule for agencies holding classified government information. Under clause 7, paragraph two, "secret" data is at least low, "top secret" at least medium, and "most secret" is high.
(3) where the agency's inability to access and use the data or information system could have a severe or catastrophic adverse effect on the operations or assets of the agency or a person, it shall be classified as high impact.
Step 5: How does a system with many data categories end up with one level?
It takes the highest level on each objective. Clause 10 rates each data category first, then uses the highest rating per objective as the system's level. One sensitive category can lift the whole system.
(1) assess and classify the potential impact for considering the cybersecurity objectives under clause 4 for each data category;
The table below is a hypothetical example for a government agency. The ratings illustrate the reasoning only; a real agency may reach different results under its own criteria and its regulator's guidance.
| System | Main data | Rating per objective | System level | Short reason |
|---|---|---|---|---|
| Public information website | News and notices already published | Not rated / Medium / Low | Medium | Confidentiality skipped under clause 4 para. 2, but a fake notice could cause real confusion |
| Online complaints system | Names, phone numbers, complaint details | Medium / Medium / Low | Medium | A leak would seriously affect complainants |
| Payroll system | Bank accounts, salaries, tax | High / High / Medium | High | Altered figures mean wrong pay across the organisation |
| Public appointment booking | Schedules, visitor names | Low / Medium / High | High | An outage on service days stops every counter |
What minimum level applies to personal data in the cloud?
Confidentiality must be at least medium, under clause 5 of the National Cybersecurity Committee's 2024 notification on cloud security standards, which points straight back to this classification notification.
In carrying out clause 4, where the data is personal data, the confidentiality impact level shall be classified as at least medium, as determined under the Notification of the National Cybersecurity Committee re: Standard for Determining Cybersecurity Characteristics for Data or Information Systems, B.E. 2566 (2023)
That rule sits in the cloud notification, so it attaches to systems using cloud services. An agency that sets an internal rule starting all personal data at medium wherever it lives stays consistent and has an easy story to tell. Cloud details are in Moving to the cloud: the 2024 NCSA standard.
Step 6: You have a level. What next?
Use it to pick the control set in clause 4 of the 2023 notification on minimum standards, which opens by referring to the result of this classification. Low has ten headings, medium adds three and high adds four more.
(2) Where the information or information system has cybersecurity characteristics at the medium level, minimum cybersecurity control measures for the information or information system shall be established under the following headings: (a) comply with paragraph (1); (b) Cybersecurity Audit Plan; (c) Remote Connection; (d) Removable Storage Media.
Step 7: How often must you review, and what evidence do you keep?
At least every 3 years, or sooner when the data, the system or the agency's functions change significantly. Each time, record the outcome and the reasons, whether the level stays or changes. Clause 11 is explicit.
An agency shall review the determination of cybersecurity characteristics for data or information systems at least every 3 years, or review it when the data, information system, or the agency's functions change significantly, and shall record the review outcome together with the reasons for retaining, or amending, the potential impact level of each cybersecurity objective under clause 4.
Triggers for an early review include moving a system to the cloud, adding a new data category to an existing system, or putting a counter-only service online. Write the reasons down every time; they are the first thing an auditor will ask for.
Where do teams go wrong most often?
- Rating a whole system in one go without splitting data categories, skipping the step clause 10 (1) requires.
- Looking only at confidentiality and missing that a system with non-secret data but zero tolerance for downtime can be high on availability.
- Skipping confidentiality for data that is not actually public yet, such as a draft notice not yet on the website.
- Having no internal criteria for what "serious" means, so different teams rate inconsistently.
- Finishing the ratings without recording reasons, leaving no answer when an auditor asks why a system got its level.
If you want ratings, reasons and review dates kept in the same place as the controls they trigger, AIPDPA includes security controls mapped to the PDPC, ETDA and NCSA standards. See it in the demo account.
Frequently asked questions
Must an ordinary private company classify under this notification?
It applies to government agencies, regulatory or supervisory agencies and CII organisations as defined in clause 3. Private companies that are not CII are not directly bound, but clients in those groups may require the same method by contract.
Does the notification say how much damage counts as high?
No. Clauses 7 to 9 use "limited or negligible", "serious" and "severe or catastrophic". Agencies set their own internal criteria; CII organisations should get guidance from their regulator under clause 6, paragraph two.
If some data in a system is already public, can we skip confidentiality?
Only for the data already disclosed to the public, under clause 4, paragraph two. If the system also holds unpublished data, rate confidentiality for that category and take the highest level under clause 10.
Do we have to send our ratings to the NCSA?
This notification does not require submission. It requires reviews and a record of outcomes and reasons under clause 11. Reporting duties under other instruments, such as the cloud notification, follow those instruments.
Law and sources
- National Cybersecurity Committee Notification on the Standard for Determining Cybersecurity Characteristics for Data or Information Systems, B.E. 2566 (2023) — Clause 3–11
- National Cyber Security Committee Notification on Minimum Standards for Information or Information Systems, B.E. 2566 (2023) — Clause 4
- National Cybersecurity Committee Notification on Cybersecurity Standards for Cloud Systems, B.E. 2567 (2024) — Clause 5
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)