Following the issuance of regulations on information technology systems in 2022*, the SEC recognizes that the current rules should be updated to enable business operators in the capital market to implement effective information technology risk control measures on a continuing basis without imposing undue burdens. The SEC is therefore conducting this public hearing on the proposed revisions to the Rules on Establishment of Information Technology Systems, with the following key points: 

    (1) To adjust the frequency of submitting IT audit reports to be appropriate for the risk level of small business operators and low-risk operators, requiring submission every three years or upon occurrence of a widespread adverse incident; 

    (2) To adjust submission of risk level assessment (RLA) forms and IT audit reports to be in the same period, i.e., the first quarter of each year; 

    (3) To adjust security measures to be commensurate with the risks of small business operators, such as reducing penetration testing frequency to once every three years, increasing controls for generic user accounts, and maintaining incident records for at least two years with root cause analysis; 

    (4) To adjust the applicable scope of investment advisory business operators to ensure that they would implement sufficient controls for managing IT-related risks arising from the use of technology; and 

    (5) To improve other details of the rules to better communicate the intent and enable effective risk control implementation.

The consultation paper is available at https://www.sec.or.th/TH/Pages/PB_Detail.aspx?SECID=998  and the central legal hub at www.law.go.th . Stakeholders and interested parties are welcome to submit comments and suggestions through the websites or email: cyberteam@sec.or.th. The public hearing ends on 15 July 2024. 

______________________

Note:

* Notification of the Office of the Securities and Exchange Commission No. Sor Thor. 38/2565 Re: Rules in Details concerning Arrangements of Information Technology Systems, dated 28 September 2022, effective from 1 July 2023 onwards.