Reconix LogoReconix
Regulatory Compliance

Navigate Thailand's Cybersecurity Regulations with Confidence

PDPA, BOT, SEC, OIC, PCI DSS, ISO 27001: each sets its own security testing rules, and some set none. Get expert penetration testing, reports that map each finding to the clause it relates to, and clear remediation paths.

Get Your Compliance Assessment

Why Compliance Demands Specialist Testing

Banks, digital asset platforms, insurers, and any business handling personal data face cybersecurity rules that differ in who they cover, how often you test, who may test, and what you report.

Scope, frequency, and tester rules differ by regulator and, for SEC operators, by Risk Level Assessment tier
Reconix maps each finding to the clause it relates to, so your auditor can trace it
BOT and SEC rules require pentesting on a set cycle and on significant change; OIC requires it regularly or on material change
Several rules send results to the board, such as SEC IT audit reports and incident drill results

Thailand's Key Cybersecurity Regulations

Dive into each framework to understand what's required, what's at stake, and the testing each one sets.

PDPA Section 37

Personal Data Protection Act (PDPA)

Thailand's personal data law applies broadly to organizations handling personal data, with exemptions in Section 4. Section 37(1) requires appropriate security measures, reviewed when necessary and when technology changes.

Set by the PDPAReview on change; no fixed test cycle
View Requirements
Bank of Thailand

BOT Penetration Testing Requirements

Financial institutions under the Financial Institutions Businesses Act, including commercial banks and foreign bank branches, and specialized financial institutions pentest at least all Internet-facing systems once a year and on significant change (สกช. 5/2566). D-SIBs and commercial banks with high cyber inherent risk also follow iPentest, which sets no fixed frequency. Non-bank payment operators pentest Internet-facing systems yearly under สนช. 1/2564.

Enforced by BOTYearly + on significant change
View Requirements
BOT Notification 4/2568

BOT Mobile Banking Security

Required controls for mobile banking apps of institutions under the Financial Institutions Businesses Act: certificate pinning, anti-tampering, obfuscation, rooted or jailbroken device blocking, and blocking risky accessibility or remote-control apps. New vulnerabilities must be closed within a suitable time or BOT's deadline. The notification has no testing clause.

Enforced by BOTOngoing controls; no test cycle set
View Requirements
SEC Thailand

SEC Capital Market & Digital Asset Security

SEC-licensed operators, including digital asset businesses, pentest Internet-facing systems at least once a year and on every significant change (small operators at least every 3 years), and run a yearly vulnerability assessment of critical and Internet-facing systems. Obligations scale with the Risk Level Assessment tier.

Enforced by the SECYearly (small operators: every 3 years)
View Requirements
OIC Thailand

OIC Insurance Cybersecurity

OIC notifications 2563 require insurers to engage external experts to pentest systems, particularly Internet-facing ones, regularly or on every material system change. OIC's 2564 guideline sets at least once a year, and following it in full counts as compliance.

Enforced by OICRegular or on change (guideline: yearly)
View Requirements
ISO 27001:2022

ISO 27001 Security Assessment

Annex A control A.8.8 covers the management of technical vulnerabilities. Reconix guidance: penetration testing is a common way to evidence it, and the standard sets no fixed pentest cycle.

Certification audit findingNo fixed pentest cycle
View Requirements
PCI DSS v4.0.1

PCI DSS Payment Card Security

Req. 11.4.2 and 11.4.3 require internal and external penetration testing at least every 12 months and after significant change. Req. 11.3 requires vulnerability scans at least every three months, with external scans by an ASV. PCI DSS is an industry standard, and the payment brands run their own enforcement programs.

Enforced by payment brandsEvery 12 months + ASV every 3 months
View Requirements
NCSA B.E. 2568

NCSA Website Security Standard

From 17 September 2026, state agencies, regulators, and CII organizations must bring their websites to the Website Security Standard: a yearly self-assessment, reporting by impact level, and VA and pentest for high-impact websites.

Applies from 17 Sep 2026Yearly self-assessment
View Requirements

Which Services Do You Need?

Match each regulation to the services that address it.

RegulationCore RequirementRelevant ServicesTesting CycleEnforcement
PDPA Section 37Appropriate Security Measures
Web/Mobile App PentestCloud Security Audit
Review on change; no fixed test cycleSet by the PDPA
Bank of Thailand (BOT)Internet-Facing Pentest / iPentest for D-SIBs and High-Risk Banks
Mobile Banking PentestAPI & Network Security
Yearly + on significant changeEnforced by BOT
BOT Notification 4/2568Mobile Banking App Controls
Mobile App PentestAPI Security Testing
Ongoing controls; no test cycle setEnforced by BOT
SEC ThailandPentest and VA by RLA Tier
Exchange PentestingVulnerability Assessment
Yearly (small operators: every 3 years)Enforced by the SEC
OIC ThailandExternal-Expert Pentest
Vulnerability AssessmentNetwork Pentest
Regular or on change (guideline: yearly)Enforced by OIC
ISO 27001:2022Technical Vulnerability Management (A.8.8)
Penetration TestingVulnerability Assessment
No fixed pentest cycleCertification Audit Finding
PCI DSS v4.0.1Cardholder Data Environment Testing
Penetration TestingVulnerability Scanning
Every 12 Months + ASV Every 3 MonthsEnforced by Payment Brands
NCSA B.E. 2568Website Security Standard
Web App PentestVulnerability Assessment
Yearly self-assessment; VA + PT for high-impact sitesApplies from 17 Sep 2026

How We Get You Audit-Ready

Every engagement produces deliverables built around the clauses your regulator cites, so you spend less time on paperwork and more time running your business.

Regulatory-Mapped Testing

Every finding links to the regulatory clause it relates to, so auditors can trace it.

Board-Ready Reporting

Executive summaries with business impact analysis, paired with deep technical findings scored to CVSS 4.0, ready for the boardroom and the audit trail.

Remediation Verification

After you fix, the included retest documents the outcome for each finding. Retesting until every fix holds is available as a paid option.

Multi-Framework Coverage

A single well-scoped engagement can produce evidence for overlapping requirements across PDPA, BOT, SEC, OIC, and ISO 27001, saving time and budget.

Compliance FAQ

Answers to the most common questions about Thai cybersecurity regulations, testing cadence, and staying audit-ready.

Free tool

How mature is your security program?

Answer 14 questions and see your NIST CSF 2.0 tier and top 3 gaps on screen. No signup needed.

Test Against the Rules That Apply to You

Get security assessments mapped to the Thai rules that apply to your license.

Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.