On 10 September 2026, Thailand's National Cyber Security Committee Announcement on the Cloud Cybersecurity Standard B.E. 2567 (2024) formally took effect. The announcement was published in the Royal Gazette on 10 September 2024, with a two-year lead time before taking effect. In-scope organizations have had two years to prepare. From now on, they must comply.
For Critical Information Infrastructure organizations, adopting public cloud is no longer only a technology or cost decision. It is now a question of compliance with a national standard.
Who must comply
The standard applies to government agencies, regulatory or supervisory bodies, and Critical Information Infrastructure (CII) organizations under the Cybersecurity Act B.E. 2562 (2019) that use public cloud services. Examples include banks and financial institutions, insurers, electricity and energy providers, waterworks, government agencies, transport, and hospitals.
It also covers public Cloud Service Providers (CSPs) serving these organizations, under a shared-responsibility model between the Cloud Service Customer (CSC) and the CSP.
The core principle: classify data first, and the assurance level follows
Organizations using public cloud must act according to the impact level of their data or information systems, as defined in the NCSA standard for assigning cybersecurity attributes to data and information systems. The minimum requirements (Cybersecurity Baseline) are set at three levels: low, medium and high. Personal data must be classified at no lower than medium for confidentiality impact.
The assigned impact level determines how the cloud customer is assessed:
- Low: self-assessment with supporting evidence, approved by the head of the organization, submitted to the National Cyber Security Agency (NCSA) office, and reviewed at least once a year.
- Medium: attestation by the regulator or supervisory body, or certification by a Certification Body, on a three-year cycle.
- High: certification by a Certification Body on a three-year cycle: certification in year 1 and surveillance audits in years 2 and 3.
The impact level also sets the minimum certifications a cloud provider must hold:
- Low: at least ISO/IEC 27001 and CSA STAR Level 1/CCM Lite.
- Medium: at least CSA STAR Level 2/CCM and ISO/IEC 27701.
- High: at least ISO/IEC 27017 or CSA STAR Level 2/CCM, plus ISO/IEC 27018 and ISO/IEC 27701.
Getting data classification right at the start is therefore critical. It determines both the controls your organization must implement and which cloud providers you can use.
Scope of the requirements
The requirements are organized into two areas:
- 01Cloud Security Governance: information security policies, organization of information security, and compliance.
- 02Cloud Infrastructure Security and Operation: human resource security, asset management, access control, cryptography, physical and environmental security, operations security, communications security, system acquisition and development, supplier relationships, and incident management.
Once implementation is complete, organizations must submit a summary report to the NCSA office within 30 days.
If you do not comply
The announcement is issued under the Cybersecurity Act B.E. 2562 (2019) and is binding on in-scope organizations, so failing to comply means failing to meet a legally mandated standard. The announcement itself does not specify penalties. Legal consequences are governed by the Act, and organizations should seek legal advice on their own exposure.
How InfraLab can help
InfraLab understands the requirements of this standard and can design cloud and hybrid-cloud systems that comply from day one:
- Assessing and classifying the impact level of your data and information systems.
- A gap assessment against the minimum requirements for the assigned level.
- Designing cloud architecture, access control, encryption and monitoring to meet the requirements.
- Helping you select cloud providers with the certifications your data level requires.
- Preparing evidence for self-assessment or certification.
Download the full announcement using the form, or contact our team to discuss your organization's path to compliance.