ThailandCybersecurity Act, Reporting of Cyber Threats by Critical Information Infrastructure Organizations
Cybersecurity Act, B.E. 2562 (2019), ss. 57, 58 and 73
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds an Organization of Critical Information Infrastructure, meaning a government agency or private organization that has a mission of or provides a Critical Information Infrastructure service in one of the aspects the National Cybersecurity Committee prescribes by notification: national security, substantive public service, banking and finance, information technology and telecommunications, transportation and logistics, energy and public utilities, public health, or others the Committee prescribes (section 49; reached by declaring that you operate an essential service).
- When a Cyber Threat significantly occurs to your system, report it to the Office and your Supervising or Regulating Organization and cope with the Cyber Threat; the Cybersecurity Regulating Committee may prescribe the criteria and method of the report, and the section states no clock (section 57).
- When there is or may be a Cyber Threat to an information system you are responsible for, examine your related information, computer data and computer system, including the surrounding circumstances, to assess whether a Cyber Threat has occurred (section 58).
- If the examination shows that there is or may be a Cyber Threat, prevent, cope with and mitigate the risks in accordance with your Code of Practice and standard framework, and notify the Office and your Supervising or Regulating Organization without delay (section 58).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 73 sets a fine not exceeding Baht 200,000 for an Organization of Critical Information Infrastructure that does not report a Cyber Threat incident under section 57 without reasonable cause.
- Rule
- Fixed only
- As of
- Currency
- THB
- Fixed cap
- 200,000
Who enforces it
Enforcement body
The Cybersecurity Regulating Committee (CRC), which under section 53 may notify the chief executive of a private organization to make correction and comply with the standards.
Settledness
- As of
- Open questions
- When does a Cyber Threat 'significantly' occur for the section 57 duty, and what criteria and method of reporting has the Cybersecurity Regulating Committee prescribed?
What this law does
Section 57 requires an Organization of Critical Information Infrastructure, in the event of a Cyber Threat significantly occurring to its system, to report to the Office and the Supervising or Regulating Organization and to cope with the Cyber Threat, and allows the Cybersecurity Regulating Committee to prescribe the criteria and method of the reporting.
Section 58 requires a Government Agency or an Organization of Critical Information Infrastructure, where there is or may be a Cyber Threat to its information system, to examine its related information, computer data and computer system, to prevent, cope with and mitigate the risks, and to notify the Office and its Supervising or Regulating Organization without delay.
Section 73 provides that an Organization of Critical Information Infrastructure that does not report a Cyber Threat incident in accordance with section 57 without reasonable cause is subject to a fine not exceeding Baht two hundred thousand. The Act places section 73 in its chapter of penalty provisions.
A Cyber Threat is any action or unlawful undertaking by using the computer, computer system, or undesirable program with an intention to cause any harm to the computer system, computer data, or other relevant data, and be an imminent threat to damage or affect operation of the computer, computer system, or other relevant data.
An Organization of Critical Information Infrastructure is a government agency or private organization that has a mission of or provides a Critical Information Infrastructure service. Section 2 brings the Act into force on the day following the date of its publication in the Government Gazette.
When LexLint raises it
When your app profile says your app runs an essential service.