NCSA Website Security Standard B.E. 2568: What It Requires
The Website Security Standard B.E. 2568 binds state agencies, regulators, and CII organizations from 17 September 2026. NCSA encourages private organizations to adopt it.
What Is the NCSA Web Security Standard?
This standard sets minimum security requirements for the websites of state agencies, regulators, and CII organizations. The National Cybersecurity Committee (กมช.) issued it under the Cybersecurity Act B.E. 2562. It takes effect on 17 September 2026, and NCSA promotes its adoption by private organizations.
- Issued by the National Cybersecurity Committee (กมช.) under the Cybersecurity Act B.E. 2562 (2019)
- Takes effect on 17 September 2026 (clause 2)
- Covers websites that are Internet-facing, hold important data, serve the public, serve CII, or handle electronic transactions
- Requires each website's impact level (low, medium, or high) to be rated for confidentiality, integrity, and availability
- Requires a self-assessment on form ค1 at least once a year, with gaps recorded on form ค2 and fixed
- Binding on state agencies, regulators, and CII organizations; NCSA promotes adoption by private organizations
Reference: Website Security Standard B.E. 2568, National Cybersecurity Committee (กมช.)
Who Must Comply?
The standard binds state agencies, regulators, and CII organizations from 17 September 2026. Private organizations are encouraged to adopt it.
State Agencies
Must bring their websites into line with the standard and self-assess them on form ค1 at least once a year (clauses 3 and 4).
Regulators and Supervisory Bodies
Must bring their websites into line with the standard and self-assess them on form ค1 at least once a year (clauses 3 and 4).
Designated CII Organizations
CII status comes from designation. Under the 2568 criteria, regulators propose lists of qualifying organizations and the National Cybersecurity Committee designates them (clause 8).
CII Designated Under the 2564 Criteria
Organizations designated under the 2564 criteria stay CII until the committee completes designation under the 2568 criteria (clause 5).
Critical Services in Finance
Listed for finance (BOT): retail deposit and withdrawal, BAHTNET, ICS cheque imaging, PromptPay, and the Single Payment System. Listed for capital markets (SEC): order matching, clearing and settlement, and depository centers. Ask your regulator whether it has proposed your organization.
Private Organizations
NCSA promotes and supports adoption of the standard by private organizations as a guide for their own website security. The standard does not bind them.
Core Security Requirements
Six obligations from the Website Security Standard and the CII rules that security testing touches.
Vulnerability Assessment
CII organizations must assess vulnerabilities of critical services by risk (host, network, and architecture review), and before connecting any new system or making a major change (Code of Practice 2564, 21.3.1 to 21.3.3). High-impact websites must have VA and pentest per the Code of Practice.
Penetration Testing
The Code of Practice says CII organizations should consider pentesting critical services, especially Internet-facing systems, by risk, at least once a year as necessary and before new systems or major changes (21.3.4, 21.3.6). High-impact websites must have VA and pentest; medium and low impact websites are exempt (table ค6).
Tester Requirements
CII: When you pentest, cover host, network, and application, especially all Internet-facing systems. Use certified testers independent of the tested system, with the qualifications your regulator sets, supervise provider testing, and send NCSA a pentest summary within 30 days of a request (21.3.5, 21.3.7, 21.3.8, 21.3.10).
Track and Verify Fixes
Track and fix findings from VA and pentests, and verify the fixes (21.3.9). Record website gaps on form ค2 and fix them.
Secure Configuration and Access Control
The annex sets configuration and access-control controls for in-scope websites. Check the standard for the full list.
Threat Reporting (CII)
If a threat occurs or is suspected, investigate. Once confirmed, respond and notify NCSA promptly. Report significant threats to NCSA on form ก2 within 24 hours of detection or occurrence, and to your regulator within its deadline.
Reporting Deadlines You Must Meet
The Cybersecurity Act is already in force, and the Website Security Standard applies from 17 September 2026. These are the reporting duties in the rules this page cites.
CII organizations report significant threats to NCSA on form ก2 within 24 hours of detection or occurrence, and to their regulator within its deadline.
CII organizations run a cybersecurity risk assessment and a cybersecurity audit at least once a year, and send the summary to NCSA within 30 days of completion and no later than 31 January, with a copy to their regulator. Yearly continuity, crisis communication, and incident response plan exercises are reported by 31 January.
Low or medium impact websites: report form ค1 results to your top executive. High impact websites: report to your top executive and your regulator, with a copy to NCSA. Record gaps on form ค2 and fix them.
How Security Testing Maps to NCSA Requirements
Each row names the rule it serves. Rows labeled Reconix recommendation are our advice.
Your NCSA Compliance Checklist
What to have in place for the standard, which applies from 17 September 2026. Items marked CII apply only to designated organizations.
Official References
Consult the original regulatory documents for full requirements.
Services Mapped to the Standard
Testing and advisory services mapped to the testing duties in the standard and the Code of Practice.
NCSA Web Security Standards FAQ
Common questions about the NCSA Website Security Standard and what it requires.
Check Your Websites Against the Standard
The standard applies from 17 September 2026. Our assessments map each finding to the clause it affects and include a retest of the fixes.
Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.