Runs an essential service, in Thailand

Cybersecurity Act, B.E. 2562 (2019), ss. 44 to 46, 49, 52 and 54 to 56 · Read the law's page

• Prepare a Code of Practice and standard framework for Maintaining Cybersecurity without delay, including a plan for examining and assessing risks by an examiner, internal auditor or independent external auditor at least once per year and a plan for coping with Cyber Threats (section 44). Where you have no Code of Practice, an incomplete one, or one not in accordance with the Code of Practice and standard framework the Office prepares with the Committee's approval, that Code of Practice and standard framework is enforced on you (section 44).
• Prevent, cope with and mitigate risks from Cyber Threats in accordance with your Code of Practice and standard framework, and act in compliance with the Code of Practice and standard framework that the Cybersecurity Regulating Committee determines as the minimum requirement (sections 13 and 45).
• Notify the Office of the names of your executive officials and operational officials for coordination, and of any change without delay (section 46).
• Within thirty days of the Committee's notification prescribing your organization, or of its final judgement under section 51, notify the Office, your Supervising or Regulating Organization and the coordinating organization of the names and contact information of the owner, the person possessing the computer and the person monitoring the computer system, who must at least be persons responsible for your management (section 52). Give notice of any change to those persons to the same organizations not less than seven days in advance, or without delay where there is an inevitable reasonable cause (section 52).
• Conduct a risk assessment on Maintaining Cybersecurity, with examination in the cybersecurity aspect by an information security auditor, internal auditor or external independent auditor, at least once per year, and submit a summary report of the result to the Office within thirty days after the operation has been finished (section 54).
• If the Cybersecurity Regulating Committee views, from your Supervising or Regulating Organization's report, that your section 54 risk assessment or cybersecurity examination is not in compliance with the standards, conduct the risk assessment again in accordance with the standards, or carry out an examination in other aspects that may affect your Critical Information Infrastructure, as it orders; if it still views a completed assessment as not in compliance, make the correction and comply with the standards without delay once it notifies your chief executive, the person possessing the computer and the person monitoring the computer system (section 55).
• Establish a mechanism or process to monitor Cyber Threats and Cybersecurity Incidents relating to your Critical Information Infrastructure, in accordance with the standards your Supervising or Regulating Organization determines and your Code of Practice, and take part in the Office's assessment of readiness to cope with Cyber Threats (section 56).
• Correct any shortfall against the minimum cybersecurity standard that your Supervising or Regulating Organization finds, within the period it sets, and make the correction without delay once the Cybersecurity Regulating Committee notifies your chief executive (section 53).
• This binds an Organization of Critical Information Infrastructure, meaning a government agency or private organization that has a mission of or provides a Critical Information Infrastructure service in one of the aspects the National Cybersecurity Committee prescribes by notification: national security, substantive public service, banking and finance, information technology and telecommunications, transportation and logistics, energy and public utilities, public health, or others the Committee prescribes (section 49; reached by declaring that you operate an essential service).

Cybersecurity Act, B.E. 2562 (2019), ss. 57, 58 and 73 · Read the law's page

• When a Cyber Threat significantly occurs to your system, report it to the Office and your Supervising or Regulating Organization and cope with the Cyber Threat; the Cybersecurity Regulating Committee may prescribe the criteria and method of the report, and the section states no clock (section 57).
• When there is or may be a Cyber Threat to an information system you are responsible for, examine your related information, computer data and computer system, including the surrounding circumstances, to assess whether a Cyber Threat has occurred (section 58).
• If the examination shows that there is or may be a Cyber Threat, prevent, cope with and mitigate the risks in accordance with your Code of Practice and standard framework, and notify the Office and your Supervising or Regulating Organization without delay (section 58).
• This binds an Organization of Critical Information Infrastructure, meaning a government agency or private organization that has a mission of or provides a Critical Information Infrastructure service in one of the aspects the National Cybersecurity Committee prescribes by notification: national security, substantive public service, banking and finance, information technology and telecommunications, transportation and logistics, energy and public utilities, public health, or others the Committee prescribes (section 49; reached by declaring that you operate an essential service).