NCSA Website Security Standard B.E. 2568
The Website Security Standard covers governance and security operations across website architectures.
- Target Audience
- Government agencies, regulators, and Critical Information Infrastructure (CII) entities that operate websites
- Mandatory Frequency
- Form C1 (ค1) self-assessment at least annually, with Form C2 (ค2) only when nonconformity is found
- Required Scope
- Government Portals, Content Management Systems (CMS), Public Web APIs
- Non-Compliance Risk
- Non-compliance with the NCSA Website Standard B.E. 2568 according to the site's impact level
Making the NCSA website standard an operational cycle
The standard connects governance, impact assessment, self-assessment, and improvement. Technical testing should therefore cover the website's real architecture.
Forms ค1 and ค2 link assessment, evidence, and remediation.
- Identify sites and owners — Record URLs, services, and accountable owners
- Classify impact — Assess the importance of data and services
- Apply minimum requirements — Implement safeguards for the impact level
- Form ค1 self-assessment — Record status and supporting evidence
- Form ค2 remediation — Assign outstanding items, owners, and due dates
- Review evidence — Verify fixes and update the next cycle
- Confirm that the entity and site are in scope, then classify impact before selecting controls and evidence.
- The Form C1 (ค1) self-assessment cycle should draw on evidence from relevant web applications, web servers, databases, and cloud or web-hosting components.
- For nonconformity, create a Form C2 (ค2) improvement plan with owner, due date, and follow-up method instead of closing an issue with a test report alone.
- Pentesting is technical evidence for website-security operations. It does not automatically turn the standard into a mandatory annual pentest for every site.
NCSA / WEBSITE SECURITY STANDARD
Who is in scope and how Penetration Testing supports it
- It applies to government agencies, regulatory or supervisory bodies, and Critical Information Infrastructure organizations. General private-sector adoption is encouraged.
- The notification was issued on 16 September 2025 and takes effect after one year, on 16 September 2026.
- In-scope organizations perform the ค1 self-assessment at least annually, determine impact level, report accordingly, and create a ค2 remediation plan for gaps.
- The standard does not automatically turn the annual self-assessment into a blanket annual Penetration Testing requirement. Penetration Testing provides technical evidence for Website Security Operation and exploitable-vulnerability validation.
Scope should cover the web application, web server, database, and relevant cloud or web-hosting components according to the architecture and website impact level, rather than testing only the public pages.
Requirements and Testing Scope Matrix
Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.
| Reference | Mandate Title | Scope Required | Testing Cycle |
|---|---|---|---|
| NCSA Website Standard 2025 | Website Governance, Site Inventory, and Accountable Ownership | Public information and online-service sites, cloud and web-hosting dependencies | Reviewed each NCSA reporting cycle (annual) |
| Appendix C (Kor), Form C1 | Self-Assessment Against Requirements and Recommendations with Evidence | Government Portals, Content Management Systems (CMS), Public Web APIs | Annual self-assessment |
| Appendix C (Kor), Form C2 | Remediation Plan for Items Still Requiring Improvement | Outstanding Form C1 items with assigned owner and due date | After assessment, tracked until closed |
Compliance Readiness Self-Assessment
Select items your organization has completed to evaluate your readiness score.
Practical guidance and tools for the Website Security Standard
WSS by STH turns the Website Security Standard B.E. 2568 (2025) into an actionable checklist for governance, risk assessment, development, operations, and remediation evidence.
Educational video: Website Security Standard
Watch this educational video for an introduction to the standard and its application to organizational websites.
Website security lifecycle
An explanatory overview. Read the article for scope, applicability and supporting evidence.
- Govern — Policy and accountable owners
- Identify — Websites, data and risk
- Protect — Risk-appropriate safeguards
- Detect — Monitor unusual activity
- Respond — Handle incidents and coordinate
- Recover — Restore and improve
Who should act
Appendix C (Appendix Kor) includes Form C1 for state agencies, regulators, critical information infrastructure organisations, and private entities. For private entities, the standard encourages adoption rather than imposing the same duty level as for state agencies, regulators, or CII organisations.
Private adoption is encouraged; it is not the same duty imposed on state agencies, regulators, or CII organisations.
- State agencies — Bring agency websites into line with the standard
- Regulators — Assign owners and follow up supporting evidence
- CII organisations — Link websites to critical services and dependencies
- Private entities — Are encouraged to adopt the standard
State agencies
Inventory agency sites that provide public information or online services, then identify the system owner and URL.
Regulators
Assign accountable owners, follow up on compliance, and retain evidence that can be audited.
CII organisations
Consider service criticality and infrastructure dependencies before prioritising remediation.
Private entities (encouraged to adopt)
Private organisations with public-facing information or online-service sites are encouraged to adopt the guidance, beginning with the site and dependencies such as cloud or web hosting.
A category appearing in Form C1 does not replace the scope assessment or duties that may apply under a specific law or organisational requirement.
Using Forms C1 and C2
Form C1 records the self-assessment. Form C2 creates a remediation plan for items that the assessment identifies as still requiring improvement. Together they give every finding an owner, evidence, and follow-up path.
ค1 records results and evidence; ค2 turns gaps into tracked remediation.
- Self-assess with Form ค1 — Record site information and each result
- Attach evidence — Use configurations, logs, reports, and provider records
- Select outstanding items — Move only incomplete items into remediation
- Create Form ค2 — Record causes, initial action, and remaining work
- Assign and follow up — Set owners and due dates, then review closure evidence
Form C1: self-assess and retain evidence
- Record site information: entity, site owner, URL, service type, and implementation model such as on-premises, cloud service, or web hosting.
- Assess requirements and recommendations, retaining evidence such as configurations, operating records, test reports, or provider documentation.
- Use the status that matches reality: completed, in progress, or not started. Mark a requirement as still needing improvement when it is not complete.
Form C2: turn remaining items into remediation
- Bring forward only items from Form C1 that still need improvement, rather than duplicating completed items as plan work.
- Record the outstanding requirement, cause, initial remediation, and the remediation work that remains.
- Assign an owner and due date, then follow up and review the evidence after remediation before updating the next assessment cycle.
Field names and usage guidance are based on Appendix C (Appendix Kor), pages 47-49, and Form C2, page 69, of the hosted standard.
Forms C1 and C2 workflow
An explanatory overview. Read the article for scope, applicability and supporting evidence.
- Assess with Form ค1 — Record the actual status
- Collect evidence — Link proof to assessment items
- Identify gaps — Select items needing improvement
- Plan with Form ค2 — Assign tasks, owners and due dates
- Verify results — Review evidence after remediation
Technical safeguards overview
An explanatory overview. Read the article for scope, applicability and supporting evidence.
- Transport — HTTPS and suitable configuration
- Application — Find and fix vulnerabilities
- Admin access — Restrict and verify access
- File integrity — Monitor unexpected changes
Frequently Asked Questions (FAQ)
Key answers and practical guidance addressing common compliance questions.
When does the NCSA Website Security Standard B.E. 2568 take effect and who is in scope?
The standard was published in the Royal Gazette on 16 September 2025 and takes effect on 16 September 2026. It applies to government agencies, regulatory/supervisory bodies, and Critical Information Infrastructure (CII) entities, while private sector adoption is encouraged.
How are Form C1 self-assessments and Form C2 remediation plans managed?
In-scope entities must conduct a self-assessment using Form C1 (ค1) at least annually. When gaps or nonconformities are identified, a Form C2 (ค2) remediation plan must be created with designated owners and target completion dates for reporting to NCSA.
