ThailandCybersecurity Act, Critical Information Infrastructure Code of Practice, Risk Assessment and Monitoring
Cybersecurity Act, B.E. 2562 (2019), ss. 44 to 46, 49, 52 and 54 to 56
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an Organization of Critical Information Infrastructure, meaning a government agency or private organization that has a mission of or provides a Critical Information Infrastructure service in one of the aspects the National Cybersecurity Committee prescribes by notification: national security, substantive public service, banking and finance, information technology and telecommunications, transportation and logistics, energy and public utilities, public health, or others the Committee prescribes (section 49; reached by declaring that you operate an essential service).
- Prepare a Code of Practice and standard framework for Maintaining Cybersecurity without delay, including a plan for examining and assessing risks by an examiner, internal auditor or independent external auditor at least once per year and a plan for coping with Cyber Threats (section 44).
- Prevent, cope with and mitigate risks from Cyber Threats in accordance with your Code of Practice and standard framework (section 45).
- Notify the Office of the names of your executive officials and operational officials for coordination, and of any change without delay (section 46).
- Within thirty days of the Committee's notification prescribing your organization, notify the Office, your Supervising or Regulating Organization and the coordinating organization of the names and contact information of the owner, the person possessing the computer and the person monitoring the computer system (section 52).
- Conduct a risk assessment on Maintaining Cybersecurity, with examination in the cybersecurity aspect by an information security auditor, internal auditor or external independent auditor, at least once per year, and submit a summary report of the result to the Office within thirty days after the operation has been finished (section 54).
- Establish a mechanism or process to monitor Cyber Threats and Cybersecurity Incidents relating to your Critical Information Infrastructure, in accordance with the standards your Supervising or Regulating Organization determines and your Code of Practice, and take part in the Office's assessment of readiness to cope with Cyber Threats (section 56).
- Correct any shortfall against the minimum cybersecurity standard that your Supervising or Regulating Organization finds, within the period it sets, and make the correction without delay once the Cybersecurity Regulating Committee notifies your chief executive (section 53).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Cybersecurity Regulating Committee (CRC), which under section 53 may notify the chief executive of a private organization to make correction and comply with the standards.
Settledness
- As of
- Open questions
- Which organizations are Organizations of Critical Information Infrastructure, given that section 49 leaves each mission or service to the Committee's notification and its case-by-case review?
What this law does
Section 44 requires an Organization of Critical Information Infrastructure to prepare a Code of Practice and standard framework for Maintaining Cybersecurity without delay. Section 44 requires that Code of Practice to include a plan for examining and assessing risks at least once per year and a plan for coping with Cyber Threats.
Section 45 gives an Organization of Critical Information Infrastructure a duty to prevent, cope with and mitigate risks from Cyber Threats in accordance with its Code of Practice and standard framework. Section 46 requires the organization to notify the Office of the names of its executive officials and operational officials for coordination.
Section 49 gives the National Cybersecurity Committee the power to prescribe by notification the characteristics of organizations that have a mission or provide services in national security, substantive public service, banking and finance, information technology and telecommunications, transportation and logistics, energy and public utilities, public health, and others the Committee prescribes.
Section 52 requires the organization to notify the Office, its Supervising or Regulating Organization and the coordinating organization of the names and contact information of the owner, the person possessing the computer and the person monitoring the computer system, within thirty days of the Committee's notification.
Section 54 requires the organization to conduct a risk assessment on Maintaining Cybersecurity at least once per year and to submit a summary report to the Office within thirty days after the operation has been finished. Section 56 requires the organization to establish a mechanism or process to monitor Cyber Threats or Cybersecurity Incidents related to its Critical Information Infrastructure.
Section 53 requires the Supervising or Regulating Organization to examine the minimum cybersecurity standard of the organizations under its supervision. Under section 53 the Cybersecurity Regulating Committee may notify the chief executive of a private organization to make correction and comply with the standards. An Organization of Critical Information Infrastructure is a government agency or private organization that has a mission of or provides a Critical Information Infrastructure service. Section 2 brings the Act into force on the day following the date of its publication in the Government Gazette.
When LexLint raises it
When your app profile says your app runs an essential service.