What are the duties of CII organisations under Thailand's Cybersecurity Act? The duties of a Critical Information Infrastructure (CII) organisation under Sections 44–46 of the Cybersecurity Act B.E. 2562 (2019) are these: it must prepare its own code of practice, which at minimum includes a risk audit and assessment plan run at least once a year and a cyber threat response plan (Section 44); must prevent, respond to and reduce cyber threats under that code (Section 45); and must notify the Office of its executive-level and operational-level contacts (Section 46).
The IT manager of a private e-payment company receives a letter asking to see its cybersecurity code of practice. He already has an IT security policy, but he is not sure it covers what the law requires, or which of his systems needs which level of controls.
What you need to know
The 6 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- CII means computers or computer systems that a state or private organisation uses in work related to state security, public safety, national economic security or public-benefit infrastructure (Section 3).
- The code of practice must at least include a risk audit and assessment plan run at least once a year and a cyber threat response plan (Section 44).
- If an organisation has no code of its own, or its code is incomplete or inconsistent, the code of practice and standards framework prepared by the Office applies instead (Section 44).
- The National Cyber Security Committee Notification on Minimum Standards for Data or Information Systems B.E. 2566 (2023) has been in force since 19 January 2025.
- Minimum controls depend on whether a system's impact level is low, medium or high; high-level systems also need vulnerability assessment and penetration testing and third-party management.
- When a coordinating contact changes, the Office must be told promptly (Section 46, paragraph 2).
How to do it in 7 steps
Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Check whether you fall within the CII definitionCompare the systems you use in your business with the Section 3 definition: do they relate to state security, public safety, national economic security or public-benefit infrastructure? A good practice is to confirm your status with the regulator for your sector.
- Register your coordinating contactsSend the names of your executive-level and operational-level cybersecurity contacts to the Office of the National Cyber Security Committee (known as the NCSA) under Section 46, and notify it again whenever someone changes.
- Classify the impact level of each data set and systemFor each data set or information system, rate the impact on confidentiality, integrity and availability as low, medium or high, using the security classification notification that Clause 4 of the minimum standards refers to.
- Apply the minimum controls for each levelUse the table annexed to the 2023 minimum standards to pick controls by level. Medium systems take every low-level control plus 3 more topics; high systems take every medium-level control plus 4 more.
- Write your organisation's code of practicePrepare your own cybersecurity code of practice and standards framework promptly, in line with the national cybersecurity policy and plan, as Section 44 requires, with at least a risk audit and assessment plan and a cyber threat response plan.
- Audit and assess risk at least once a yearHave an assessor, an internal auditor or an independent external auditor audit and assess your cyber risk at least once a year under Section 44(1), and keep the report and remediation plan as evidence.
- Rehearse incident response and crisis communicationAn incident response plan, a crisis communication plan and cybersecurity exercises are minimum controls at every level under the 2023 minimum standards, so set an exercise schedule and record the results each time.
Who counts as a Critical Information Infrastructure (CII) organisation?
A CII organisation is a state agency or private organisation whose mission or service is critical information infrastructure, as defined in Section 3 of the Cybersecurity Act B.E. 2562 (2019). Private companies can therefore be CII organisations; the term is not limited to government bodies.
The Cybersecurity Regulating Committee sets the duties of CII organisations and their regulators, and at minimum must require each regulator to set appropriate standards for handling cyber threats at each CII organisation it oversees (Section 13(5)).
- Systems related to state security.
- Systems related to public safety.
- Systems related to national economic security.
- Systems related to infrastructure that serves the public interest.
What are a CII organisation's duties under the Cybersecurity Act?
The core duties are in Sections 43 to 46: follow the national policy and plan, prepare your own code of practice, prevent and respond to threats under that code, and register coordinating contacts with the Office.
- Section 43: once the national cybersecurity policy and plan are published in the Royal Gazette, CII organisations named in the plan must act in line with them.
- Section 44: prepare your own code of practice and standards framework promptly, including at least a risk audit and assessment plan run at least once a year and a cyber threat response plan.
- Section 45: prevent, respond to and reduce cyber threats under your own code and under the code and framework set by the Cybersecurity Regulating Committee under Section 13(4).
- Section 46: notify the Office of your executive-level and operational-level contacts, and notify it promptly of any change.
What do the 2023 minimum standards for data and information systems require?
The notification applies to state agencies, regulators and CII organisations, and requires minimum controls set by the impact level of each data set or system. It was published in the Royal Gazette on 18 January 2024 and took effect one year later, so it has been in force since 19 January 2025.
- Low (10 topics): cyber risk assessment, incident response plan, asset management, risk assessment and risk management strategy, access control, system hardening, awareness, threat detection and monitoring, crisis communication plan, and cybersecurity exercises.
- Medium: everything at low, plus a cybersecurity audit plan, remote connection controls and removable storage media controls.
- High: everything at medium, plus vulnerability assessment and penetration testing, third-party management, information sharing, and resilience and recovery.
What happens if we don't have our own code of practice yet?
Under the last paragraph of Section 44, if an organisation has no code of practice, or its code is incomplete or inconsistent, the code of practice and standards framework prepared by the Office with the Committee's approval applies to it.
If an organisation cannot carry out these duties, the Office may provide personnel or technology support on request under Section 45, paragraph 2.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ You have a general IT security policy but no annual audit plan or threat response plan as Section 44 requires. | ✓ Add both plans to your code of practice and link every control to an owner and evidence. AIPDPA's controls workspace records the status and evidence of each control, mapped across PDPC guidance, the ETDA framework, the NCSA cloud standard and the NCSA website security standard, so you see the gaps before the assessor does. |
| ✗ Applying the same set of controls to every system, even though high-level systems need more. | ✓ Classify each system's impact level first, then add the extra topics from the annexed table. For public websites, AIPDPA's website security scan checks against the NCSA website security standard in minutes, though it does not replace the penetration testing high-level systems require. |
| ✗ Outsourced providers who run critical systems are missing from your risk plan. | ✓ Third-party management is a minimum control for high-level systems. List each provider, the systems they can access and the security terms agreed. AIPDPA's vendor register keeps every provider and its risk level in one place. |
See every security control and its evidence before the assessor arrives
AIPDPA's controls workspace maps your controls across PDPC guidance, the ETDA framework, the NCSA cloud standard and the NCSA website security standard, with a website scanner and vendor register built in. See the demo account, no sign-up needed.
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Can a private company be a CII organisation in Thailand?
Yes. Section 3 defines a CII organisation as a state agency or private organisation whose mission or service is critical information infrastructure.
How often must a CII organisation audit its cyber risk?
At least once a year, by an assessor, an internal auditor or an independent external auditor, under Section 44(1).
When did the 2023 minimum standards for information systems take effect?
On 19 January 2025. The notification was published in the Royal Gazette on 18 January 2024, and Clause 2 says it applies once one year has passed from publication.
Do high-level systems need a penetration test?
Yes. Vulnerability assessment and penetration testing is a minimum control for data or information systems rated high, under Clause 4(3) of the 2023 minimum standards.
What must a CII organisation report to the NCSA?
The names of its executive-level and operational-level cybersecurity contacts, plus prompt notice of any change, under Section 46.
How far can AIPDPA help a CII organisation?
AIPDPA helps you track the status and evidence of your security controls, scan websites against the NCSA standard and keep a vendor register. It does not replace an assessor or the code of practice your organisation must write itself.
Sources
This guide relies on 8 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Cybersecurity Act B.E. 2562 (2019), Section 3
- Cybersecurity Act B.E. 2562 (2019), Section 13
- Cybersecurity Act B.E. 2562 (2019), Section 43
- Cybersecurity Act B.E. 2562 (2019), Section 44
- Cybersecurity Act B.E. 2562 (2019), Section 45
- Cybersecurity Act B.E. 2562 (2019), Section 46
- National Cyber Security Committee Notification on Minimum Standards for Data or Information Systems B.E. 2566 (2023), Clause 2
- National Cyber Security Committee Notification on Minimum Standards for Data or Information Systems B.E. 2566 (2023), Clause 4 and annexed table
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
PDPC, ETDA and NCSA requirements in one place — do the work once, evidence several standards.
Join the waitlist →Scan your sites against the NCSA website security standard and get certificate-expiry alerts.
Join the waitlist →Know who processes data for you, how risky they are and whether the contract is in place.
Join the waitlist →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.