Cybersecurity Act B.E. 2562 (2019) and Penetration Testing
The Act establishes cybersecurity risk-assessment and audit duties. Penetration Testing is a technical method and source of evidence that may support those duties; it is not the entire audit.
- Target Audience
- Government agencies, regulators, and CII entities designated under Section 49
- Mandatory Frequency
- Annual cybersecurity risk assessment and audit (Sec 54); not a named pentest mandate
- Required Scope
- CII systems in the seven named Section 49 sectors, plus any additional sector the Committee designates
- Non-Compliance Risk
- NCSC orders under Section 55, and fines up to 300,000 THB plus daily penalties under Section 75 for failing to obey an order
Using testing in the cybersecurity risk-assessment cycle
The Act establishes assessment and audit expectations for in-scope entities. Penetration testing can evidence technical risk but does not replace the whole governance process.
Section 54 establishes an assessment, audit, reporting, and correction cycle for CII organisations.
- Identify CII services and systems — Define scope and supporting dependencies
- Assess cyber risk — Link threats, weaknesses, and impact
- Conduct security audit — Use internal or independent external auditors
- Perform at least annually — Apply the Section 54 cycle
- Submit the summary — Report within 30 days after completion
- Correct deficiencies — Repeat work when results do not meet the standard
- Identify critical services, supporting systems, and infrastructure dependencies before fixing an assessment scope.
- Section 54 states that CII organisations must arrange cybersecurity risk assessment and audit at least annually, subject to the Act's applicable conditions.
- Assessment evidence should connect threat, vulnerability, impact, control owner, and remediation rather than consider a scan or pentest in isolation.
- Confirm the reporting framework and 30-day timing against the actual entity and responsible authority.
NATIONAL CYBERSECURITY / RISK & AUDIT
Statutory duties
- Section 44 requires government agencies, regulators or supervisors, and critical information infrastructure (CII) organizations to create a code of practice and standards framework whose minimum content includes an annual cybersecurity inspection and risk-assessment plan.
- Section 54 specifically requires CII organizations to arrange a cybersecurity risk assessment and cybersecurity audit at least annually, then send a summary to NCSA within thirty days after completion.
Role of Penetration Testing
- Penetration Testing is technical evidence supporting risk assessment and audit, not the whole audit.
- Clauses 21.3.4 and 21.3.6 of the B.E. 2564 (2021) Code of Practice use recommendatory risk-and-need wording for Penetration Testing, focusing on critical and Internet-facing services.
- When performed, scope should cover the relevant host, network, and application layers, and testers should be independent of the systems and processes under assessment.
The Act does not require every organization to conduct annual Penetration Testing. Keep the statutory risk-assessment and audit duties distinct from the technical testing method selected to support them.
Requirements and Testing Scope Matrix
Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.
| Reference | Mandate Title | Scope Required | Testing Cycle |
|---|---|---|---|
| Sections 49 to 54 | CII designation and cybersecurity risk assessment | CII entities in the seven named Section 49 sectors, plus any additional sector the Committee designates | Risk assessment and cybersecurity audit at least annually |
| NCSC Notification B.E. 2564 | Code of Practice and Cybersecurity Standard Framework | Government agencies and CII entities under the minimum standard framework | Aligned with the Section 54 assessment and audit cycle |
Compliance Readiness Self-Assessment
Select items your organization has completed to evaluate your readiness score.
Frequently Asked Questions (FAQ)
Key answers and practical guidance addressing common compliance questions.
Which entities are governed under Thailand's Cybersecurity Act 2019?
The Act governs government agencies, regulators, and Critical Information Infrastructure (CII) entities under Section 49: national security, essential public services, banking and finance, IT and telecommunications, transport and logistics, energy and utilities, public health, and any additional sector the Committee designates.
What penalties apply if a CII entity fails the Section 54 assessment or disobeys an NCSC order?
Section 54 requires CII entities to complete a cybersecurity risk assessment and audit at least annually. It is not a named pentest mandate. Failure to obey an NCSC order under Section 75 can attract a fine of up to 300,000 THB plus a daily fine of up to 10,000 THB until compliance.
