Thailand’s Cloud Security Standard Is Now in Force: What Providers and CII Operators Must Review

Thailand's new Cloud Security Standard took effect on Sept. 10, 2026, requiring compliance from government agencies, critical information infrastructure organizations, and public-cloud providers. The standard classifies cloud systems based on impact level and mandates that covered organizations review security controls, contracts, and prepare evidence for compliance.

Covered entities include those with cloud-service agreements with the government, CII organizations, and regulatory or supervisory bodies. The National Cyber Security Agency (NCSA) has partnered with NECTEC to establish a certification system, recognizing NECTEC's Digital Technology Evaluation and Certification Institute as its first cloud-security certification body.

Organizations must classify their cloud systems, assess risks, document security policies, and prepare business continuity and disaster recovery plans according to impact level. The standard aligns with Thailand's Cloud First Policy and supports broader efforts to enhance digital infrastructure security.