# NCSA Website Security Standard B.E. 2568

Locale: `en`

Source: `/en/compliance/ncsa-website-standard/`

Summary: The Website Security Standard covers governance and security operations across website architectures.

On this page

1. [Overview](/en/compliance/ncsa-website-standard/#topic-overview)
2. [Making the NCSA website standard an operational cycle](/en/compliance/ncsa-website-standard/#compliance-control-summary)
3. [Requirements Matrix](/en/compliance/ncsa-website-standard/#compliance-matrix)
4. [Readiness Assessment](/en/compliance/ncsa-website-standard/#compliance-readiness-checklist)
5. [Frequently Asked Questions](/en/compliance/ncsa-website-standard/#compliance-faq)
6. [Related Frameworks](/en/compliance/ncsa-website-standard/#related-compliance-frameworks)
7. [Practical guidance and tools](/en/compliance/ncsa-website-standard/#ncsa-resource-heading)
8. [Educational video](/en/compliance/ncsa-website-standard/#ncsa-video-heading)
9. [Website security lifecycle](/en/compliance/ncsa-website-standard/#ncsa-security-lifecycle)
10. [Who should act](/en/compliance/ncsa-website-standard/#ncsa-who-must-act)
11. [Using Forms C1 and C2](/en/compliance/ncsa-website-standard/#ncsa-forms-c1-c2)
12. [Forms C1 and C2 workflow](/en/compliance/ncsa-website-standard/#ncsa-form-workflow)
13. [Technical safeguards overview](/en/compliance/ncsa-website-standard/#ncsa-technical-baseline)

# NCSA Website Security Standard B.E. 2568

The Website Security Standard covers governance and security operations across website architectures.

Executive Summary and Mandate Overview

Target Audience

Government agencies, regulators, and Critical Information Infrastructure (CII) entities that operate websites

Mandatory Frequency

Form C1 (ค1) self-assessment at least annually, with Form C2 (ค2) only when nonconformity is found

Required Scope

Government Portals, Content Management Systems (CMS), Public Web APIs

Non-Compliance Risk

Non-compliance with the NCSA Website Standard B.E. 2568 according to the site's impact level

## Making the NCSA website standard an operational cycle

The standard connects governance, impact assessment, self-assessment, and improvement. Technical testing should therefore cover the website's real architecture.

[![Website-standard operating cycle: Identify sites and owners → Classify impact → Apply minimum requirements → Form ค1 self-assessment → Form ค2 remediation → Review evidence](/assets/compliance/guide-ncsa-website-standard-compliance-control-summary-en-v2.webp)](/assets/compliance/guide-ncsa-website-standard-compliance-control-summary-en-v2.webp)

**Website-standard operating cycle**

Forms ค1 and ค2 link assessment, evidence, and remediation.

1. **Identify sites and owners** — Record URLs, services, and accountable owners
2. **Classify impact** — Assess the importance of data and services
3. **Apply minimum requirements** — Implement safeguards for the impact level
4. **Form ค1 self-assessment** — Record status and supporting evidence
5. **Form ค2 remediation** — Assign outstanding items, owners, and due dates
6. **Review evidence** — Verify fixes and update the next cycle

- Confirm that the entity and site are in scope, then classify impact before selecting controls and evidence.
- The Form C1 (ค1) self-assessment cycle should draw on evidence from relevant web applications, web servers, databases, and cloud or web-hosting components.
- For nonconformity, create a Form C2 (ค2) improvement plan with owner, due date, and follow-up method instead of closing an issue with a test report alone.
- Pentesting is technical evidence for website-security operations. It does not automatically turn the standard into a mandatory annual pentest for every site.

NCSA / WEBSITE SECURITY STANDARD

### Who is in scope and how Penetration Testing supports it

- It applies to government agencies, regulatory or supervisory bodies, and Critical Information Infrastructure organizations. General private-sector adoption is encouraged.
- The notification was issued on 16 September 2025 and takes effect after one year, on 16 September 2026.
- In-scope organizations perform the ค1 self-assessment at least annually, determine impact level, report accordingly, and create a ค2 remediation plan for gaps.
- The standard does not automatically turn the annual self-assessment into a blanket annual Penetration Testing requirement. Penetration Testing provides technical evidence for Website Security Operation and exploitable-vulnerability validation.

**Derive scope from impact**

Scope should cover the web application, web server, database, and relevant cloud or web-hosting components according to the architecture and website impact level, rather than testing only the public pages.

## Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

| Reference | Mandate Title | Scope Required | Testing Cycle |
| --- | --- | --- | --- |
| **NCSA Website Standard 2025** | Website Governance, Site Inventory, and Accountable Ownership | Public information and online-service sites, cloud and web-hosting dependencies | Reviewed each NCSA reporting cycle (annual) |
| **Appendix C (Kor), Form C1** | Self-Assessment Against Requirements and Recommendations with Evidence | Government Portals, Content Management Systems (CMS), Public Web APIs | Annual self-assessment |
| **Appendix C (Kor), Form C2** | Remediation Plan for Items Still Requiring Improvement | Outstanding Form C1 items with assigned owner and due date | After assessment, tracked until closed |

### Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

0%

Website and online-service inventory maintained with system owner, URL, and hosting model
          
          
            
            Form C1 self-assessment completed across all requirements with auditable evidence retained
          
          
            
            Form C2 remediation plan created for outstanding items with an owner and due date
          
          
            
            Website, CMS, and public web APIs security-tested, with evidence reviewed after remediation

Assessment Status

Check items above to view assessment result.

[Request Pentest Quote](/en/#contact)

## Practical guidance and tools for the Website Security Standard

WSS by STH turns the Website Security Standard B.E. 2568 (2025) into an actionable checklist for governance, risk assessment, development, operations, and remediation evidence.

[Open WSS by STH ](https://wss.sth.sh/)

## Educational video: Website Security Standard

Watch this educational video for an introduction to the standard and its application to organizational websites.

[YouTube ](https://www.youtube.com/watch?v=GDKFojgPaSA)

## Website security lifecycle

[![Website security lifecycle: Govern, Identify, Protect, Detect, Respond, Recover](/assets/compliance/website-security-lifecycle-en-v1.webp)](/assets/compliance/website-security-lifecycle-en-v1.webp)

**Website security lifecycle**

An explanatory overview. Read the article for scope, applicability and supporting evidence.

- **Govern** — Policy and accountable owners
- **Identify** — Websites, data and risk
- **Protect** — Risk-appropriate safeguards
- **Detect** — Monitor unusual activity
- **Respond** — Handle incidents and coordinate
- **Recover** — Restore and improve

## Who should act

Appendix C (Appendix Kor) includes Form C1 for state agencies, regulators, critical information infrastructure organisations, and private entities. For private entities, the standard encourages adoption rather than imposing the same duty level as for state agencies, regulators, or CII organisations.

[![Who has duties and who is encouraged to adopt: State agencies, Regulators, CII organisations, Private entities](/assets/compliance/guide-ncsa-website-standard-ncsa-who-must-act-en-v1.webp)](/assets/compliance/guide-ncsa-website-standard-ncsa-who-must-act-en-v1.webp)

**Who has duties and who is encouraged to adopt**

Private adoption is encouraged; it is not the same duty imposed on state agencies, regulators, or CII organisations.

- **State agencies** — Bring agency websites into line with the standard
- **Regulators** — Assign owners and follow up supporting evidence
- **CII organisations** — Link websites to critical services and dependencies
- **Private entities** — Are encouraged to adopt the standard

### State agencies

Inventory agency sites that provide public information or online services, then identify the system owner and URL.

### Regulators

Assign accountable owners, follow up on compliance, and retain evidence that can be audited.

### CII organisations

Consider service criticality and infrastructure dependencies before prioritising remediation.

### Private entities (encouraged to adopt)

Private organisations with public-facing information or online-service sites are encouraged to adopt the guidance, beginning with the site and dependencies such as cloud or web hosting.

A category appearing in Form C1 does not replace the scope assessment or duties that may apply under a specific law or organisational requirement.

## Using Forms C1 and C2

Form C1 records the self-assessment. Form C2 creates a remediation plan for items that the assessment identifies as still requiring improvement. Together they give every finding an owner, evidence, and follow-up path.

[![How Forms ค1 and ค2 turn assessment into remediation: Self-assess with Form ค1 → Attach evidence → Select outstanding items → Create Form ค2 → Assign and follow up](/assets/compliance/guide-ncsa-website-standard-ncsa-forms-c1-c2-en-v2.webp)](/assets/compliance/guide-ncsa-website-standard-ncsa-forms-c1-c2-en-v2.webp)

**How Forms ค1 and ค2 turn assessment into remediation**

ค1 records results and evidence; ค2 turns gaps into tracked remediation.

1. **Self-assess with Form ค1** — Record site information and each result
2. **Attach evidence** — Use configurations, logs, reports, and provider records
3. **Select outstanding items** — Move only incomplete items into remediation
4. **Create Form ค2** — Record causes, initial action, and remaining work
5. **Assign and follow up** — Set owners and due dates, then review closure evidence

### Form C1: self-assess and retain evidence

- Record site information: entity, site owner, URL, service type, and implementation model such as on-premises, cloud service, or web hosting.
- Assess requirements and recommendations, retaining evidence such as configurations, operating records, test reports, or provider documentation.
- Use the status that matches reality: completed, in progress, or not started. Mark a requirement as still needing improvement when it is not complete.

### Form C2: turn remaining items into remediation

- Bring forward only items from Form C1 that still need improvement, rather than duplicating completed items as plan work.
- Record the outstanding requirement, cause, initial remediation, and the remediation work that remains.
- Assign an owner and due date, then follow up and review the evidence after remediation before updating the next assessment cycle.

Field names and usage guidance are based on Appendix C (Appendix Kor), pages 47-49, and Form C2, page 69, of the hosted standard.

## Forms C1 and C2 workflow

[![From assessment to improvement: Assess with Form ค1, Collect evidence, Identify gaps, Plan with Form ค2, Verify results](/assets/compliance/website-assess-improve-en-v2.webp)](/assets/compliance/website-assess-improve-en-v2.webp)

**From assessment to improvement**

An explanatory overview. Read the article for scope, applicability and supporting evidence.

- **Assess with Form ค1** — Record the actual status
- **Collect evidence** — Link proof to assessment items
- **Identify gaps** — Select items needing improvement
- **Plan with Form ค2** — Assign tasks, owners and due dates
- **Verify results** — Review evidence after remediation

## Technical safeguards overview

[![Website technical safeguards: Transport, Application, Admin access, File integrity](/assets/compliance/website-technical-safeguards-en-v1.webp)](/assets/compliance/website-technical-safeguards-en-v1.webp)

**Website technical safeguards**

An explanatory overview. Read the article for scope, applicability and supporting evidence.

- **Transport** — HTTPS and suitable configuration
- **Application** — Find and fix vulnerabilities
- **Admin access** — Restrict and verify access
- **File integrity** — Monitor unexpected changes

## Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

### When does the NCSA Website Security Standard B.E. 2568 take effect and who is in scope?

The standard was published in the Royal Gazette on 16 September 2025 and takes effect on 16 September 2026. It applies to government agencies, regulatory/supervisory bodies, and Critical Information Infrastructure (CII) entities, while private sector adoption is encouraged.

### How are Form C1 self-assessments and Form C2 remediation plans managed?

In-scope entities must conduct a self-assessment using Form C1 (ค1) at least annually. When gaps or nonconformities are identified, a Form C2 (ค2) remediation plan must be created with designated owners and target completion dates for reporting to NCSA.

## Related Compliance Frameworks and Security Standards

- [
                Thailand Cybersecurity Act 2019 and penetration testing
                
              ](/en/compliance/cybersecurity-act/)
- [
                OWASP Top 10 guides for Web, Mobile, API, LLM, and Agentic
                
              ](/en/compliance/owasp-top-10/)
- [
                NCSA Cloud Security Standard B.E. 2567 (2024)
                
              ](/en/compliance/ncsa-cloud-security-standard/)
- [
                Does ISO/IEC 27001:2022 require penetration testing?
                
              ](/en/compliance/iso-27001/)

Open full-size image to zoom

## Official source documents

Original files from the regulating authorities, hosted on sth.sh for convenience. Always defer to the latest version at the source link.

[
            
              
              
              ![First-page preview of NCSA Website Security Standard B.E. 2568 (2025)](/assets/process/compliance-sources/sth-source-ncsa-website-standard-2568.webp)
            
          ](/assets/documents/sth-source-ncsa-website-standard-2568.pdf)

### NCSA Website Security Standard B.E. 2568 (2025)

By NCSA

[Open document (PDF) ](/assets/documents/sth-source-ncsa-website-standard-2568.pdf)
              [Download (PDF) ](/assets/documents/sth-source-ncsa-website-standard-2568.pdf)
              [Download Forms ค1/ค2 (.docx) ](/assets/documents/sth-source-ncsa-website-standard-forms-c1-c2.docx)
              [Source ](https://ratchakitcha.soc.go.th/documents/86192.pdf)
              [NCSA Website Security Portal ](https://websitesecurity.ncsa.or.th/)

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

## PDF document

[Open in new tab ](/en/compliance/ncsa-website-standard/)
              [Download](/en/compliance/ncsa-website-standard/)

Last updated 16 October 2026