(Unofficial Translation) No. 136 Chapter 69 Kor (2) Government Gazette 27 May 2019 Information Infrastructure under the supervisor or regulation and cooperate and coordinate with the Office to prevent, cope with, and mitigate the risks from the Cyber Threat; notify the Government Agency or Organization of Critical Information Infrastructure under its supervision or regulation, including other relevant Government Agencies or Organizations of Critical Information Infrastructure without delay. Section 60 In considering to exercise power to prevent Cyber Threats, the Committee will determine the type of Cyber Threat as classed into three levels, as follows: (1) a Cyber Threat at a non-critical level means a Cyber Threat with significant risk at a level which causes the computer system of the country's Organization of Critical Information Infrastructure to be compromised; (2) a Cyber Threat at a critical level means a Cyber Threat with the nature of having significant increase in computer system, computer, or computer data attacks, with the aim to attack the Organization of Critical Information Infrastructure of the country, and such attack has the effect of causing damage to the computer system of the information technology infrastructure related to the operation of the Organization of Critical Information Infrastructure of the country, public stability, international relations, national defense, economy, public health, public safety, or the public order of the people, such that it could not operate or provide service; (3) a Cyber Threat at a crisis level means a Cyber Threat in a crisis level of the following nature; (a) is a Cyber Threat occurring from a computer system, computer, computer data attacks in a level higher than the Cyber Threats in a critical level, which cause severe effect to Critical Information Infrastructure of the country in a large-scale and which causes the whole operation of Government Agency or the provision of service of Organization of Critical Information Infrastructure to fail, such that the state could not control the operation center of the state's computer system, or the normal remedial measures for Cyber Threat could not resolve the issue and there is risk of spreading to other critical infrastructure of the country, which may cause death to many people or cause a great amount of computer system, computer, and computer data to be destroyed in a large-scale on a national level; (b) is a Cyber Threat that affects or may affect the public order or is a threat to public security or may cause the country or part of the country to be in a critical situation, or an offense regarding terrorism under the Penal Code, battling or war, which an urgent measure is required to maintain the democratic form of government with the King as the Head of the State in accordance with the Constitution of the Kingdom of Thailand, sovereignty and the integrity of the territory, national benefit, compliance with the laws, public safety, normal living of the public, protection of freedom and rights, public order or benefit, or the protection or remedy of damages from the public disaster that is emergency and critical. The details of the characteristics of the Cyber Threats, the measures to prevent, cope with, assess, suppress, and suspend of the Cyber Threats in each level shall be in accordance with the notification prescribed by the Committee. Section 61 When it appears to the CRC that there is or there may be a Cyber Threat 17

Select target paragraph3