Thailand's NCSA to Introduce IoT Security Guidelines Amid Rising Cyber Threats

The National Cyber Security Agency (NCSA) of Thailand is set to introduce new IoT security guidelines in September 2026 to address increasing cyber threats targeting smart devices, particularly CCTV systems and virtual power plants (VPPs). AVM Amorn Chomchoey, NCSA's secretary-general, highlighted the risks of digital surveillance and the potential for hackers to manipulate data, which could lead to significant vulnerabilities in energy management systems. The guidelines will mandate features such as no-default passwords, firmware update support, and user notifications for security vulnerabilities. There are discussions about making these requirements mandatory, which may impact the compatibility with existing devices and potentially raise product prices. The integration of VPPs, which aggregate multiple small power sources, is a priority but poses new cybersecurity risks due to an expanded attack surface. The NCSA emphasizes the need for network segmentation to prevent catastrophic failures in the power grid.

Key Points: • NCSA plans to introduce IoT security guidelines in September 2026. • Guidelines will include mandatory features like no-default passwords and firmware updates. • Integration of virtual power plants increases cybersecurity vulnerabilities.