Thaweesak Koanatakul, president of the security sub-committee, said the draft was now finished and the committee plans to submit it to the Electronic Transaction Commission and then to the Cabinet for approval as the national information security policy.

It is hoped the policy will be a framework for best operational practice to guide organisations to minimise risk and respond effectively to any security incidents that may occur, ensuring the organisations comply with relevant legislation in this area.

The power and convenience of information technology is, however, counterbalanced by the increasingly complex legislative framework that governs its use, as well as by the wide range of threats to the security of electronic information.

"That is why an information security policy is so important," said Thaweesak. The draft contains two main parts: the information security standard and the security guidelines.

Part of the Thai version of the draft security standard complies with ISO/IEC 27001 and ISO/IEC17799:2005. This ISO is the first in a family of international information security standards that will underpin and protect IT worldwide over the next decade. It is designed to complement the ISO9001:2000 and ISO14001:1996 standards so that management systems can be effectively integrated.

In the Thai version, security domains include 39 control objectives and 133 control structures in 11 areas, including security policy, organisation of information security, asset management, security of those who have access, physical and environmental security, and information security incident management.

In addition, it also divides organisations into high, moderate and low security levels.

A high-level critical organisation can affect over 100,000 people and create Bt100 million of damage per day. Examples of high level of critical organisations are the Metropolitan Electricity Authority, the Provincial Electricity Authority, PTT, the Bank of Thailand, the Securities and Exchange Commission, the Ministry of Finance and the Ministry of Industry.

The draft stipulates high critical level organisations should adopt and comply with the national information security policy within 12 months of its launch, while moderate and low level organisations should comply with the policy within two and three years, respectively.

The Information and Communication Technology Ministry has been drafting the master plan for national ICT security. Ajin Jirachiefpattana, head of the infrastructure management group at the ministry, said the ministry had hired a private company to study and develop the draft of the national ICT security plan six months ago, and expects it to be completed by November.

Ajin said the plan includes a time frame for the deployment of the master plan, the security standard, and the organisation of the body for security regulation.

The ICT Minister will submit the draft to the cabinet for approval before it is passed into law. This is expected to take place under the new government. However, the national security master plan will be in line with the national information security policy.

The national policy and the master plan on information security will show Thailand is ready to deal with information security concerns.

It will make other counties more confident when it comes to doing business with or in Thailand.

Asina Pornwasin

The Nation