An IT vendor to critical infrastructure is any business that provides IT services to, connects to the systems of, or can access important data of a Thai critical information infrastructure (CII) organisation. The 2021 code of practice calls them third-party service providers. This guide shows vendor owners what to prepare before signing and during the contract.
- Clause 10 of the 2021 code defines third-party service providers broadly: IT providers, anyone connected to CII systems, anyone who can access important data.
- The 2023 minimum standard requires Third Party Management for high-level systems; Remote Connection controls start at medium.
- A CII may verify vendors through third-party audits and renegotiate contracts when new rules arrive (clauses 21.4.3 and 21.4.4).
- Vendor continuity plans must match the CII's BCP, including RTO and RPO (clause 25.1.1).
- If the work involves personal data, the vendor also carries data processor duties under Section 40 of the PDPA.
Many IT firms never think about the Cybersecurity Act B.E. 2562 (2019) until a client turns out to be a power producer, a bank, a hospital or a telecoms operator, and the draft contract arrives with a cybersecurity schedule several pages long.
The Act places its duties on critical information infrastructure (CII) organisations. A CII cannot hand that responsibility to anyone else, so it pushes requirements down to the people who work for it. Whether an organisation is a CII is covered in Is your company critical infrastructure. This article looks at the other side of the table: the vendor's.
Who counts as a third-party service provider to a CII?
Anyone who provides IT services, connects to a CII's systems, or can access its important data. That is the definition in clause 10 of the annex to the 2021 code of practice. It does not look at company size or contract value, only at what you do with the CII's systems or data.
a natural or juristic person that is a third-party service provider, being a provider of information technology services, or a person who is connected to the information technology systems of a government agency or a critical information infrastructure organization, or a person who is able to access important data of a government agency or a critical information infrastructure organization
Read literally, that covers software houses, network managers, equipment sellers who log in remotely to push firmware updates, and outsourced contact centres that see the CII's customer data. The same definition excludes ordinary customers who simply use the CII's services.
Why ask about the system's level before you quote a price?
Because the level decides which minimum controls the CII must have, and some of those controls land directly on vendors. Clause 4 of the National Cyber Security Committee's 2023 notification on minimum standards sorts controls by low, medium and high.
The CII sets the level itself under the 2023 security classification notification; the method is explained in Security classification step by step. Vendors do not classify anything, but they should ask which level the system they will work on has.
(3) Where the information or information system has cybersecurity characteristics at the high level, minimum cybersecurity control measures for the information or information system shall be established under the following headings:
| Heading (annexed table) | Low | Medium | High | What the vendor will see |
|---|---|---|---|---|
| 2.5 Cybersecurity Awareness | ● | ● | ● | Invitations to training, or a duty to train your own staff to the CII's standard |
| 2.1 Access Control | ● | ● | ● | Named accounts, no shared logins, access removed when people leave |
| 2.3 Remote Connection | ● | ● | Remote access only when needed, encrypted on every channel | |
| 1.4 Third Party Management | ● | Cyber clauses in the contract and a CII right to audit | ||
| 5.1 Cybersecurity Resilience and Recovery | ● | Requests to see your continuity plan and RTO/RPO |
The table lists only the headings that involve outsiders. The last column is our assessment of how each heading tends to show up in practice, not wording from the notification. The full list is in the minimum standard checklist.
What will the CII want written into the contract?
At least four things under clause 21.4.2: the types of providers who access critical service assets, the provider's obligations to protect those services, risks in the service and product supply chain, and the CII's right to audit. They go into the SLA or the contract terms.
What vendors tend to miss is the proof. The code does not stop at contract wording; clause 21.4.3 suggests the CII set up a process to check that providers actually comply.
21.4.3 Consideration should be given to establishing a process to verify that third-party service providers comply with the cybersecurity requirements in the contract terms, for example, third-party audits and product audits.
The wording is "consideration should be given", so it does not force every CII to audit the same way. In practice, a vendor holding an independent audit report usually has an easier time negotiating how much on-site inspection it accepts.
Also read the change clause carefully. Clause 21.4.4 suggests renegotiating terms when new legal or regulatory requirements appear. Agree up front how extra work caused by new rules will be priced and scheduled.
21.4.4 Consideration should be given to negotiating contract terms to align with cases where there are new legal or regulatory requirements.
Once work starts, how far can your team connect remotely?
Only as far as needed, encrypted on every channel, and with no system commands that affect critical services unless the CII has expressly authorised them. Those are the guidelines in clause 22.3.2 of the code, which has five limbs in total.
(c) Use encryption for all network connections, such as https, ssh, scp, etc.; (d) Do not allow remote connections from Issuing System Commands that would affect the operation of the critical services of the government agency and the critical information infrastructure organization, unless expressly authorized due to business needs; and
For support teams, that makes the old habits hard to keep: a remote tool left open all day, or one admin account shared by the whole team. Limb (a) of the same clause says to enable remote connections only when necessary, and limb (e) restricts data flows to the minimum the connection needs.
- Ask the CII to state in the contract which commands your team may run alone and which need approval every time.
- Use named accounts with multi-factor authentication, and keep logs of who connected, when, and what they did.
- Write down how remote channels are opened and closed: who opens them and for how long.
- Do not pull live data onto your own machines for testing; if unavoidable, agree a masking method first.
Do the vendor's own staff need cyber training?
Plan for it. Clause 22.5.1 requires the CII's awareness plan to cover contractors and third-party providers with access, and its list of audiences names vendors, contractors and service providers explicitly.
22.5.1 Importance shall be given to a Cybersecurity Awareness plan for employees, contractors, and third-party service providers who have access to the critical information infrastructure.
The required content includes awareness of the laws, rules and procedures for accessing the CII's systems. Vendors who rotate people through projects should make training a condition of getting access, rather than something to chase afterwards.
The CII is audited every year. Where does the vendor come in?
Work that is outsourced remains the CII's responsibility under clause 21.4.1 of the code. Section 54 of the Cybersecurity Act requires a CII to run a risk assessment and a cyber audit at least once a year, so the parts a vendor runs are usually asked for evidence too.
A critical information infrastructure organisation shall arrange for an assessment of cybersecurity risk by an assessor, and shall also arrange for a cybersecurity audit by an information security auditor, whether by an internal auditor or by an independent external auditor, at least once a year.
Auditors typically want lists of who has access, access logs, training records and evidence of vulnerability fixes. If you keep these properly from day one, the annual audit does not turn into a team-wide document hunt.
When systems fail, how must the vendor's plan line up with the CII's?
Same definitions, same time targets. Clause 25.1.1 has the CII prepare a business continuity plan and review its providers' plans for consistency, naming three values that must match.
including reviewing the plans of third-party service providers to consider consistency with the plan of the government agency and the critical information infrastructure organization, such as consistency of the scope of definitions and the determination of critical timeframes: Maximum Tolerable Period of Disruption (MTPD), Recovery Time Objective (RTO), and Recovery Point Objective (RPO), among others.
Picture this: the CII wants its billing system back within 4 hours, while the vendor's support contract promises a response within one business day. Those numbers cannot coexist, and a reviewer will spot it immediately. The figures are hypothetical; the notification sets no values.
If the work involves personal data, what does the PDPA add?
Data processor duties under Section 40 of the Personal Data Protection Act B.E. 2562 (2019). These are the vendor's own legal duties, not requirements passed down by contract like the cyber ones.
(2) provide appropriate security measures for preventing unauthorized or unlawful loss, access to, use, alteration, correction or disclosure, of Personal Data, and notify the Data Controller of the Personal Data breach that occurred;
In practice, one incident may need reporting down two routes: under the contract's cyber clauses and to the data controller under the PDPA. Build both into a single team procedure. The PDPA side of the contract is covered in the processor agreement guide.
- Before quotingAsk the level of the system you will touch and cost the controls that follow2023 minimum standard, clause 4
- NegotiatingAgree the four contract topics, how compliance is verified, and what happens when rules changeCode clauses 21.4.2–21.4.4
- Before go-liveTrain the team, issue named accounts, set the remote access procedureClauses 22.5.1 and 22.3.2
- During the contractKeep access and patching evidence ready for the CII's annual auditCybersecurity Act, Section 54
- Annual plan reviewCompare your RTO and RPO with the CII's BCPClause 25.1.1
Where do vendors usually go wrong?
The statutory duties sit with the CII, but clause 21.4.1 makes it answer for outsourced work, so the requirements arrive by contract.
High-level systems add headings such as Third Party Management and Resilience and Recovery. The cost difference is large.
Clause 22.3.1 requires remote connections to have measures that prevent and detect unauthorised access. Shared accounts make individuals untraceable.
Answers clause 21.4.3 directly and reduces duplicate on-site audits.
If you serve several CII clients, one register of controls you can point to again and again saves the most effort. AIPDPA includes security controls mapped to the PDPC, ETDA and NCSA standards; you can see it in the demo account.
Frequently asked questions
Does a small vendor to a CII have to register with the NCSA?
The documents in our knowledge base contain no provision requiring third-party providers to register themselves. The requirements reach vendors through their contracts with the CII under clause 21.4 of the 2021 code of practice.
Can a CII really audit our company?
Clause 21.4.2 (d) has the CII write a right to audit third-party providers into the contract, so the scope is whatever the parties agree. Clause 21.4.3 mentions third-party audits as one option.
If the system we support is low level, does clause 21.4 still apply?
The 2023 minimum standard requires Third Party Management only for high-level systems, but a CII may set stricter terms than the minimum. Check the contract you are actually offered.
Our team works from abroad and connects remotely. What else applies?
On the cyber side, the same clause 22.3.2 rules apply. If personal data is involved, also check cross-border transfer rules under Sections 28 and 29 of the PDPA; see When data leaves Thailand.
Can this article replace a contract review?
No. It explains the texts in our knowledge base; every contract has its own facts. Have a specialist read the cyber schedule before you sign.
Law and sources
- Cybersecurity Regulating Committee Notification on the Code of Practice and Standards Framework, B.E. 2564 (2021) — 21.4 · 22.3 · 22.5 · 25.1
- National Cyber Security Committee Notification on Minimum Standards for Information or Information Systems, B.E. 2566 (2023) — Clause 4
- Cybersecurity Act B.E. 2562 (2019) — Section 54
- Personal Data Protection Act B.E. 2562 (2019) — Section 40
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)