Thailand's National Cyber Security Agency has been building out the standards that sit under the Cybersecurity Act, and two of them took effect in September 2026: a security standard for cloud services and one for websites and web applications. They apply first to the organisations the Act designates as critical information infrastructure, a list that includes energy, transport, finance, healthcare and government services, and they set the baseline the agency will inspect against.
The shift is from policy to evidence. It is no longer enough to have a security policy on file. An operator has to show that access is controlled, that secrets are managed, that logs exist and are kept, that incidents have a named response, and that the architecture was reviewed before it was changed.
Why this reaches beyond the designated list
Most critical services run on suppliers. A hospital's patient records, a port's scheduling system and a ministry's public portal are built and hosted by other companies, and the standards flow down the contract. A supplier that cannot show its own controls becomes the operator's problem at inspection time. That is why our vendor and supply-chain assessments look at the access a supplier holds, not just the software it ships.
The devices are in scope
In a physical operation the attack surface includes the kiosk at the door, the lock on the room, the camera in the corridor and the controller on the plant floor. Our work for the Royal Thai Navy, delivered through Section 31 International, treats the cameras and the network they sit on as one system: the same software that adds smoke, fire and facial detection to existing hardware is assessed and monitored with the rest of the estate.
What to do this quarter
Start with an inventory of every system that holds identities, payments or operational data, and who can reach it. Rank findings by risk and fix them in order, writing least-privilege access, managed secrets and audit logging into the systems rather than into a document beside them. Write the incident plan that names who is called first. Then review the architecture again whenever it changes, because the standards will be inspected against what is running, not what was designed.
Opsian's Cyber Security service covers each of those steps, from the assessment to the monitoring that continues after handover. The assessment is a document the organisation owns, whether or not Opsian does the remediation.
