# Penetration Testing Requirements for NDID Members

Locale: `en`

Source: `/en/compliance/ndid/`

Summary: NDID is infrastructure for digital identity proofing and authentication that connects participating service providers in different roles.

On this page

1. [Overview](/en/compliance/ndid/#topic-overview)
2. [Identity and data flow through NDID](/en/compliance/ndid/#compliance-control-summary)
3. [Requirements Matrix](/en/compliance/ndid/#compliance-matrix)
4. [Readiness Assessment](/en/compliance/ndid/#compliance-readiness-checklist)
5. [Frequently Asked Questions](/en/compliance/ndid/#compliance-faq)
6. [Related Frameworks](/en/compliance/ndid/#related-compliance-frameworks)

# Penetration Testing Requirements for NDID Members

NDID is infrastructure for digital identity proofing and authentication that connects participating service providers in different roles.

Executive Summary and Mandate Overview

Target Audience

NDID Members: Relying Parties (RP), Identity Providers (IdP), Authoritative Sources (AS)

Mandatory Frequency

At least annually prior to node onboarding or annual re-certification

Required Scope

NDID Proxy Nodes, HSM Key Modules, OAuth2 and OIDC Endpoints, Encryption Gateways

Non-Compliance Risk

Suspension from NDID network and revocation of cross-organizational ID verification rights

## Identity and data flow through NDID

NDID connects requests among a Requesting Party, Identity Provider, and Authoritative Source. It routes requests and records necessary transaction metadata rather than acting as a centralized personal-data warehouse.

[![How identity requests and data flow through NDID: User and Requesting Party → NDID Platform → Identity Provider → Authentication result → Authoritative Source → Off-platform data channel](/assets/compliance/guide-ndid-compliance-control-summary-en-v1.webp)](/assets/compliance/guide-ndid-compliance-control-summary-en-v1.webp)

**How identity requests and data flow through NDID**

NDID routes requests and records transaction metadata; it is not a centralized personal-data warehouse

1. **User and Requesting Party** — The user requests a service and selects an Identity Provider
2. **NDID Platform** — Routes requests between members and records necessary transaction metadata
3. **Identity Provider** — Proofs and authenticates the user
4. **Authentication result** — The Requesting Party checks result integrity before making its service decision
5. **Authoritative Source** — Confirms authoritative information when the request needs additional data
6. **Off-platform data channel** — Returns data from the Authoritative Source to the Requesting Party over an encrypted channel

- The user begins a service request with the Requesting Party and selects a registered Identity Provider.
- NDID routes the request to the Identity Provider, which proofs and authenticates the user before returning the result.
- The Requesting Party checks result integrity and the electronic signature before making its service decision.
- When an Authoritative Source is involved, confirmed data returns to the Requesting Party over an encrypted channel outside the NDID Platform.

NATIONAL DIGITAL ID

### What members prepare for a security assessment

- Test the member applications, web systems, network layer, and operating systems involved in the NDID Platform connection. The NDID Node is excluded unless the issued criteria state otherwise.
- The onboarding criteria supplied by the user call for an external juristic-person testing provider and evidence of tester qualifications such as GPEN, eCPPT, OSCP, or another certification accepted by NDID for the member role.
- Testing follows OSSTMM or NIST SP 800-115 with the OWASP Web/Mobile Testing Guide, or PTES/ISSAF, according to the criteria issued to the member.
- Critical, High, and Medium findings must be corrected. Low findings are corrected or supported by a recorded rationale, and corrected vulnerabilities are retested.
- The member submits the final Penetration Test Report and tester certificate to NDID. The supplied criteria state at least annually and after significant changes.

**Confirm the current criteria**

Details may differ by member role and onboarding package. This summary reflects the criteria supplied by the user, not a publicly controlled document. Members should follow the latest criteria received from NDID.

## Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

| Reference | Mandate Title | Scope Required | Testing Cycle |
| --- | --- | --- | --- |
| **NDID Security Standard 2.0** | Security Requirements for Relying Party (RP) Members | NDID Proxy Node, Application Integration, Webhook Endpoints | At least annually |
| **NDID IdP and AS Rules** | Security Requirements for Identity Providers (IdP) and Authoritative Sources (AS) | HSM Key Modules, OAuth2 and OIDC Endpoints, Encryption Gateways | At least annually prior to re-certification |

### Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

0%

NDID Proxy Node and backend API integrations completed annual Penetration Testing
          
          
            
            Hardware Security Module (HSM) key management audited for high-assurance protection
          
          
            
            Node-to-node communications encrypted and OAuth2 and OIDC endpoints verified
          
          
            
            Pentest compliance report submitted for annual NDID membership re-certification

Assessment Status

Check items above to view assessment result.

[Request Pentest Quote](/en/#contact)

## Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

### Must NDID members complete penetration testing prior to live network onboarding?

Yes. All members including Relying Parties (RP), Identity Providers (IdP), and Authoritative Sources (AS) must submit independent pentest reports before production onboarding and retest annually.

### What happens if a critical vulnerability is identified on an NDID member node?

NDID may immediately suspend node connectivity until the vulnerability is remediated and validated via retesting.

## Related Compliance Frameworks and Security Standards

- [
                Bank of Thailand pentest rules for financial institutions
                
              ](/en/compliance/bank-of-thailand/)
- [
                Thai SEC penetration testing requirements
                
              ](/en/compliance/sec/)
- [
                Does Thailand's PDPA require penetration testing?
                
              ](/en/compliance/pdpa/)
- [
                Thailand Digital ID: ETDA, DGA, IAL/AAL, and DPS Security
                
              ](/en/compliance/thailand-digital-id/)

Open full-size image to zoom

## Official source documents

See NDID platform standards and membership on the official NDID website.

[Go to the official source ](https://ndid.co.th/home/)

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

Last updated 16 October 2026