Cybersecurity Law Update – New Thai Rules Mandating Baseline Cybersecurity Requirements For Critical Systems

The Thai National Cyber Security Committee of Thailand ("NCSC") has released two notifications requiring critical information infrastructure operators ("CIIOs")¹ to implement baseline cybersecurity protection measures in their data and information systems to enhance their cybersecurity resilience.

These notifications are:

• Notification on standards in determining the security category for data or information systems ("Notification on Security Category"); and
• Notification on baseline standards for data and information systems ("Notification on Baseline Cybersecurity Standards"),which shall be referred to as "Notifications".

These Notifications were published in Thailand's Royal Gazette on 18 January 2024 and will become effective on 18 January 2025 (ie 1 year from the publication date). The CIIOs are expected to be in compliance with the Notifications as of the effective date.