Reconix LogoReconix
NCSA

NCSA Web Security Standard: Are You Ready for September 2026?

Thailand's mandatory Website Security Standard B.E. 2568 kicks in September 2026. If you're a government agency or CII operator, now is the time to prepare.

v1.0
Standards Version
Website Security
Sep 2026
Enforcement Date
1-Year Transition Period
CII
Applies To
Critical Infrastructure
Annual
Testing Cycle
Minimum Requirement
Get NCSA Compliance Assessment

What Is the NCSA Web Security Standard?

Published in the Royal Gazette on 16 September 2025, this standard sets the minimum security bar for every website operated by a government agency, regulator, or CII organization. It was issued by the National Cybersecurity Committee (กมช.) under the Cybersecurity Act B.E. 2562 and uses a "High Water Mark" risk model built on the CIA triad. Private-sector organizations are strongly encouraged to adopt it as well.

  • Issued by the National Cybersecurity Committee (กมช.) under NCSA (สกมช.) pursuant to the Cybersecurity Act B.E. 2562 (2019)
  • Published in the Royal Thai Government Gazette on 16 September 2025
  • Takes effect 16 September 2026, giving organizations 1 year to comply
  • Applies the "High Water Mark" principle based on the CIA triad (Confidentiality, Integrity, Availability)
  • Requires organizations to classify website impact levels as low, medium, or high
  • Mandatory for government agencies, regulatory bodies, and CII operators; recommended for private enterprises
  • Based on international standards including OWASP ASVS and NIST frameworks

Reference: Website Security Standard B.E. 2568 (Version 1.0), National Cybersecurity Committee (กมช.), Royal Thai Government Gazette, 16 September 2025

Who Must Comply?

Mandatory for government agencies, regulators, and CII operators. Private enterprises are strongly encouraged to adopt the standard as their own security baseline.

Government Agencies

All government organizations operating public-facing websites and web applications

Financial Services CII

Banks, securities firms, insurance companies, and payment service providers designated as CII

ICT & Telecom CII

Information and communication technology providers and telecommunications operators

Energy & Utilities CII

Energy providers and public utility organizations operating critical web systems

Transportation CII

Transportation infrastructure operators with web-based services and systems

Healthcare CII

Healthcare organizations operating websites handling sensitive patient information

Version 1.0

Core Security Requirements

Six domains you must address — from penetration testing and secure development to incident response and monitoring.

Web Vulnerability Assessment & Penetration Testing

Conduct continuous vulnerability assessments scanning internet-accessible assets for known CVEs and misconfigurations. Penetration testing must be performed at least annually, targeting OWASP Top 10 vulnerabilities including XSS, SQL Injection, and broken authentication.

Secure Development Practices

Implement a Secure Software Development Lifecycle (SSDLC) including secure coding standards, code review processes, and pre-deployment security testing. Secure code review is highly recommended to eliminate OWASP Top 10 flaws at the source code level.

SSL/TLS & DNSSEC Configuration

Enforce HTTPS with TLS 1.2 or higher, strong cipher suites, valid certificates, and HSTS headers. Implement DNSSEC for DNS security across all web properties.

Access Control & Authentication

Implement robust access control mechanisms with Multi-Factor Authentication (MFA) for administrative access and sensitive systems. Enforce strong session management controls and role-based authorization.

Incident Response for Web Attacks

Establish documented procedures for detecting, responding to, and recovering from web-based security incidents including defacement, data breaches, and DDoS attacks.

Security Monitoring & Logging

Implement comprehensive logging of web application events, security monitoring systems, and regular log review processes for anomaly detection.

What Happens If You Don't Comply

The Cybersecurity Act B.E. 2562 gives NCSA real enforcement powers. While the Act itself is already in force, the Website Security Standard B.E. 2568 specifically takes effect on 16 September 2026. After that date, non-compliance triggers escalating consequences.

Regulatory Orders
Cybersecurity Act

Under the Cybersecurity Act (already in force), NCSA can issue compliance orders requiring CII organizations to implement specific security measures. Once the Website Security Standard takes effect in September 2026, failure to meet its requirements may trigger escalated enforcement.

Administrative Penalties
Cybersecurity Act

Organizations that fail to meet CII obligations under the Cybersecurity Act face administrative penalties. Once the Website Security Standard is enforceable (from September 2026), NCSA will have grounds to impose corrective measures and sanctions for non-compliance with its specific requirements.

Reputational Impact
Public Disclosure

Non-compliance with NCSA standards may be disclosed through regulatory reporting channels, affecting organizational reputation, public trust, and business relationships with government entities.

Checklist

Your NCSA Compliance Checklist

Everything your organization needs in place before the September 2026 deadline.

Classify website impact levels (low, medium, high) per NCSA High Water Mark guidelines
Conduct continuous vulnerability assessments of internet-accessible web assets
Perform annual web application penetration testing covering OWASP Top 10
Implement and document a Secure Software Development Lifecycle (SSDLC)
Configure SSL/TLS with TLS 1.2 or higher, strong cipher suites, and valid certificates
Implement DNSSEC for DNS security protection
Deploy HSTS headers and enforce HTTPS across all web properties
Enable Multi-Factor Authentication (MFA) for all administrative and sensitive system access
Implement role-based access control and strong session management
Deploy Web Application Firewall (WAF) protection
Create and test incident response procedures for web-based attacks
Implement comprehensive security logging and real-time monitoring
Conduct regular cybersecurity training for development and operations teams
Maintain documented evidence of all security assessments for NCSA review
Perform remediation tracking with defined timelines for identified vulnerabilities
Review and update web security policies at least annually

NCSA Web Security Standards FAQ

Common questions about the NCSA Web Application Security Standards and compliance requirements.

Don't Wait Until the Deadline

September 2026 is closer than you think. Our assessments map directly to every NCSA requirement and deliver audit-ready documentation.

Reconix is a leading cybersecurity company in Thailand, providing world-class services to businesses of all sizes.