OIC Cybersecurity Compliance for Thailand's Insurance Sector
Licensed life and non-life insurers in Thailand, including foreign branches, must meet the OIC IT risk notifications of B.E. 2563. Plan pentests, vulnerability assessments, and pre-production security tests against the clauses that require them.
What Is the OIC Cybersecurity Regulation?
The Office of Insurance Commission (OIC / คปภ.) regulates Thailand's insurance industry. Its cybersecurity rules center on the Notification Re: Criteria for Life and Non-life Insurance Companies' Governance and Management of Information Technology Risk B.E. 2563 (2020).
OIC's translations of the two notifications match on every clause cited here. They require pentests by external experts, risk-based vulnerability management, a security test before production, recovery plan tests, a cyber incident response plan, incident reports to the OIC, and IT audit. The Thai text governs: OIC's English translation renders clause 21(6) as "independent experts" where the Thai says external experts.
The OIC guideline of B.E. 2564 (2021) sets out the practice in more detail. Under clause 4 of the notification, an insurer that follows the guideline in full is deemed to comply.
A draft notification of B.E. 2569 (2026) is open for public hearing until 21 October 2026 and is not law. If issued as drafted, it would repeal the 2563 notifications from 1 December 2026, require external experts to pentest Internet-facing systems at least once a year or on significant change, and drop the deemed-compliance clause. It also proposes mobile app testing to MASTG before go-live, API testing, and a yearly independent external IT audit report to the OIC.
Who Must Comply?
The 2563 notifications apply to licensed insurers. This page does not cover brokers, agents, or insurtech firms that hold no insurer license.
Key OIC Cybersecurity Requirements
Six obligations in the 2563 notifications that security testing and audit work touch.
Penetration Testing by External Experts
Engage external experts to pentest your systems, particularly Internet-facing applications and networks, regularly or on every material system change (clause 21(6)). OIC guideline 2564 item 10 sets at least once a year and on every significant change.
Vulnerability Management
Manage vulnerabilities by risk level, with a defined way to search for, test, and manage them (clauses 21(6), 39(2)). The guideline adds VA of critical systems at least once a year or on significant change (item 9).
Security Testing Before Production
Security-test developed systems before production, against the security process in the technical specification, and protect sensitive test data (clause 22(2)(จ)).
IT Recovery Plan Testing
Test the IT recovery plan at least once a year and report the results to executives. Test that backups restore (clause 25).
Cyber Incident Response Plan
Prepare, drill, or test the cyber incident response plan and emergency plan, and report to the board or its delegated committee (clause 40(2)). The clause sets no frequency.
IT Audit
Audit IT to plan and scope, and after any material abnormal IT event. Use an independent external expert where systems are complex or use new technology, and review the audit plan at least once a year (clauses 33(2), 34).
Policyholder Data Protection
Insurers hold health, financial, and claims data about the people they cover.
Sensitive Data Types Handled by Insurers
- Personal identification information
- Health records and medical history
- Financial information and payment data
- Claims history and settlement details
- Beneficiary details and family information
Cross-Compliance with PDPA Section 37
Insurers also fall under the PDPA. Section 37(1) requires appropriate security measures, reviewed when necessary and when technology changes. The Security Measures Notification 2565 adds review after any breach that carries risk. The PDPA names no testing method.
Incident Reporting Deadlines
- Report to the OIC immediately when a material IT problem or incident occurs or you become aware of it: one that affects services, systems, insured-person data, or reputation (including an attack or threatened attack on important IT) and must be escalated to your top executive. Include details, cause, impact, fix, and prevention (clause 43(1)).
- Send a progress report within 3 business days and a closing report within 15 days after closure, to [email protected] (OIC guideline 2564 reporting form).
- If a cyber attack involves the company's major information infrastructure service, notify the OIC or the agency the law requires without delay, within 72 hours (clause 43(2)).
- If you are designated Critical Information Infrastructure under the Cybersecurity Act, NCSA's report of significant threats on form ก2 within 24 hours also applies.
- A personal data breach goes to the PDPC Office without delay, within 72 hours of becoming aware where feasible, unless it carries no risk (PDPA section 37(4)).
How Security Testing Addresses OIC Requirements
Each row cites the clause of the 2563 notification or the OIC guideline 2564 it maps to. Rows labeled Reconix recommendation are our advice. The OIC does not require them.
OIC Compliance Checklist
Items to validate against the 2563 notifications and the OIC guideline 2564.
- Pentest by external experts, particularly of Internet-facing applications and networks, regularly or on every material system change (clause 21(6)). If you use independent internal testers, follow guideline item 10 in full: at least once a year and on every significant change
- Vulnerability management by risk, with a defined way to find, test, and manage vulnerabilities (clauses 21(6), 39(2)); VA of critical systems at least once a year or on significant change (guideline item 9)
- Security test of developed systems before production, with sensitive test data protected (clause 22(2)(จ))
- IT recovery plan tested at least once a year and reported to executives; backup restores tested (clause 25)
- Cyber incident response plan and emergency plan prepared, drilled, or tested, and reported to the board or its delegated committee (clause 40(2))
- Incident reporting path to the OIC ready: immediate report, progress within 3 business days, closing report within 15 days, 72 hours for attacks involving major information infrastructure services (clause 43; guideline form)
- IT audit to plan and scope and after material abnormal IT events; independent external expert where systems are complex or use new technology; audit plan reviewed at least once a year (clauses 33(2), 34)
- Draft 2569 tracked: the hearing closes 21 October 2026. If issued as drafted, it takes effect 1 December 2026 and requires external-expert pentests of Internet-facing systems at least once a year or on significant change
Official References
The Thai notifications govern. The links below are OIC's English translations.
OIC Cybersecurity FAQ
Answers to the most common questions about OIC cybersecurity requirements for insurers in Thailand.
Secure Your Insurance Operations
Plan pentests, vulnerability assessments, and pre-production security tests against the clauses of the OIC notification, with evidence your auditors can trace to each clause.
Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.