← Frameworks / BOT Cyber Resilience / Control Mappings

Machine-readable: JSON API guide

Bank of Thailand Cyber Resilience Guidelines for Financial Institutions

Bank of Thailand mandatory cyber resilience guidelines for all BOT-regulated financial institutions. 26 requirements across governance and oversight, identification (asset management, risk assessment, threat intelligence), protection (access control, data security, network security, application security, change management), detection (monitoring, vulnerability assessment, penetration testing), and response and recovery (incident management, business continuity, crisis communication, lessons learned). Structured around NIST CSF five-function model with BOT-specific supervisory expectations.

Controls: 224
Total Mappings: 297
Publisher: Bank of Thailand (BOT) Version: 2023
BOT Cyber Resilience → SP 800-53 SP 800-53 → BOT Cyber Resilience Coverage Analysis
AC (21) AT (5) AU (11) CA (8) CM (13) CP (12) IA (12) IR (9) MA (6) MP (7) PE (16) PL (4) PM (16) PS (9) PT (8) RA (7) SA (12) SC (26) SI (14) SR (8)

AC Access Control

Control Name BOT Cyber Resilience References
AC-01 Policy and Procedures
Ch2.2
AC-02 Account Management
Ch2.2Ch8.2
AC-03 Access Enforcement
Ch2.2
AC-04 Information Flow Enforcement
Ch2.2Ch2.4
AC-05 Separation of Duties
Ch2.2
AC-06 Least Privilege
Ch2.2
AC-07 Unsuccessful Logon Attempts
Ch2.2Ch8.2
AC-08 System Use Notification
Ch2.2
AC-09 Previous Logon Notification
Ch2.2
AC-10 Concurrent Session Control
Ch2.2
AC-11 Device Lock
Ch2.2
AC-12 Session Termination
Ch2.2
AC-13 Supervision and Review — Access Control
Ch2.2
AC-14 Permitted Actions Without Identification or Authentication
Ch2.2
AC-16 Security and Privacy Attributes
Ch2.2
AC-17 Remote Access
Ch2.2Ch2.4Ch9.1
AC-18 Wireless Access
Ch2.4
AC-19 Access Control for Mobile Devices
Ch2.6Ch9.1
AC-20 Use of External Systems
Ch2.6Ch5.2
AC-24 Access Control Decisions
Ch2.2
AC-25 Reference Monitor
Ch2.2

AT Awareness and Training

Control Name BOT Cyber Resilience References
AT-01 Policy and Procedures
Ch7.1
AT-02 Literacy Training and Awareness
Ch7.1
AT-03 Role-based Training
Ch7.1
AT-04 Training Records
Ch7.1
AT-06 Training Feedback
Ch7.1

AU Audit and Accountability

Control Name BOT Cyber Resilience References
AU-01 Policy and Procedures
Ch6.1
AU-02 Event Logging
Ch3.1Ch6.1
AU-03 Content of Audit Records
Ch3.1
AU-04 Audit Log Storage Capacity
Ch3.1
AU-06 Audit Record Review, Analysis, and Reporting
Ch3.1Ch6.1Ch8.2
AU-07 Audit Record Reduction and Report Generation
Ch3.1
AU-09 Protection of Audit Information
Ch3.1
AU-12 Audit Record Generation
Ch3.1
AU-13 Monitoring for Information Disclosure
Ch3.1
AU-14 Session Audit
Ch3.1
AU-16 Cross-organizational Audit Logging
Ch6.1

CA Security Assessment and Authorization

Control Name BOT Cyber Resilience References
CA-01 Policy and Procedures
Ch1.3Ch6.1
CA-02 Control Assessments
Ch1.3Ch3.2Ch6.1
CA-03 Information Exchange
Ch5.2
CA-05 Plan of Action and Milestones
Ch6.1
CA-06 Authorization
Ch6.1
CA-07 Continuous Monitoring
Ch1.3Ch3.1Ch6.1Ch10.1
CA-08 Penetration Testing
Ch3.2
CA-09 Internal System Connections
Ch5.2

CM Configuration Management

Control Name BOT Cyber Resilience References
CM-01 Policy and Procedures
Ch2.1
CM-02 Baseline Configuration
Ch2.1
CM-03 Configuration Change Control
Ch2.1Ch10.1
CM-04 Impact Analyses
Ch10.1
CM-05 Access Restrictions for Change
Ch2.1
CM-06 Configuration Settings
Ch2.1
CM-07 Least Functionality
Ch2.1Ch2.6
CM-08 System Component Inventory
Ch2.1
CM-09 Configuration Management Plan
Ch2.1
CM-10 Software Usage Restrictions
Ch2.1
CM-11 User-installed Software
Ch2.1Ch2.6
CM-12 Information Location
Ch2.1
CM-14 Signed Components
Ch2.1

CP Contingency Planning

Control Name BOT Cyber Resilience References
CP-01 Policy and Procedures
Ch4.2
CP-02 Contingency Plan
Ch4.2
CP-03 Contingency Training
Ch4.2
CP-04 Contingency Plan Testing
Ch4.2
CP-06 Alternate Storage Site
Ch4.2
CP-07 Alternate Processing Site
Ch4.2
CP-08 Telecommunications Services
Ch4.2
CP-09 System Backup
Ch4.2
CP-10 System Recovery and Reconstitution
Ch4.2
CP-11 Alternate Communications Protocols
Ch4.2
CP-12 Safe Mode
Ch4.2
CP-13 Alternative Security Mechanisms
Ch4.2

IA Identification and Authentication

Control Name BOT Cyber Resilience References
IA-01 Policy and Procedures
Ch2.2
IA-02 Identification and Authentication (Organizational Users)
Ch2.2Ch8.2Ch9.1
IA-03 Device Identification and Authentication
Ch2.2
IA-04 Identifier Management
Ch2.2
IA-05 Authenticator Management
Ch2.2
IA-06 Authentication Feedback
Ch2.2
IA-07 Cryptographic Module Authentication
Ch2.2
IA-08 Identification and Authentication (Non-organizational Users)
Ch2.2
IA-09 Service Identification and Authentication
Ch2.2
IA-10 Adaptive Authentication
Ch2.2
IA-11 Re-authentication
Ch2.2
IA-12 Identity Proofing
Ch2.2

IR Incident Response

Control Name BOT Cyber Resilience References
IR-01 Policy and Procedures
Ch4.1
IR-02 Incident Response Training
Ch4.1
IR-03 Incident Response Testing
Ch4.1
IR-04 Incident Handling
Ch4.1
IR-05 Incident Monitoring
Ch4.1
IR-06 Incident Reporting
Ch4.1
IR-07 Incident Response Assistance
Ch4.1
IR-08 Incident Response Plan
Ch4.1
IR-09 Information Spillage Response
Ch4.1

MA Maintenance

Control Name BOT Cyber Resilience References
MA-01 Policy and Procedures
Ch10.1
MA-02 Controlled Maintenance
Ch10.1
MA-03 Maintenance Tools
Ch10.1
MA-04 Nonlocal Maintenance
Ch10.1
MA-05 Maintenance Personnel
Ch10.1
MA-06 Timely Maintenance
Ch10.1

MP Media Protection

Control Name BOT Cyber Resilience References
MP-01 Policy and Procedures
Ch2.3
MP-02 Media Access
Ch2.3
MP-03 Media Marking
Ch2.3
MP-04 Media Storage
Ch2.3
MP-05 Media Transport
Ch2.3
MP-06 Media Sanitization
Ch2.3
MP-07 Media Use
Ch2.3

PE Physical and Environmental Protection

Control Name BOT Cyber Resilience References
PE-01 Policy and Procedures
Ch2.8
PE-02 Physical Access Authorizations
Ch2.8
PE-03 Physical Access Control
Ch2.8
PE-04 Access Control for Transmission
Ch2.8
PE-05 Access Control for Output Devices
Ch2.8
PE-06 Monitoring Physical Access
Ch2.8
PE-08 Visitor Access Records
Ch2.8
PE-09 Power Equipment and Cabling
Ch2.8
PE-10 Emergency Shutoff
Ch2.8
PE-11 Emergency Power
Ch2.8
PE-12 Emergency Lighting
Ch2.8
PE-13 Fire Protection
Ch2.8
PE-14 Environmental Controls
Ch2.8
PE-15 Water Damage Protection
Ch2.8
PE-17 Alternate Work Site
Ch2.8
PE-18 Location of System Components
Ch2.8

PL Planning

Control Name BOT Cyber Resilience References
PL-01 Policy and Procedures
Ch1.1
PL-07 Concept of Operations
Ch6.2
PL-08 Security and Privacy Architectures
Ch6.2
PL-09 Central Management
Ch1.2

PM Program Management

Control Name BOT Cyber Resilience References
PM-01 Information Security Program Plan
Ch1.1Ch1.2
PM-02 Information Security Program Leadership Role
Ch1.1
PM-03 Information Security and Privacy Resources
Ch1.1
PM-04 Plan of Action and Milestones Process
Ch1.3
PM-07 Enterprise Architecture
Ch6.2
PM-09 Risk Management Strategy
Ch1.1Ch1.2
PM-13 Security and Privacy Workforce
Ch1.1Ch7.1
PM-14 Testing, Training, and Monitoring
Ch1.3Ch3.2Ch6.1
PM-15 Security and Privacy Groups and Associations
Ch1.3Ch8.1
PM-16 Threat Awareness Program
Ch3.1Ch4.1Ch7.1Ch8.1
PM-20 Dissemination of Privacy Program Information
Ch9.2
PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research
Ch9.2
PM-26 Complaint Management
Ch9.2
PM-28 Risk Framing
Ch1.2
PM-30 Supply Chain Risk Management Strategy
Ch5.1Ch5.2
PM-32 Purposing
Ch1.2

PS Personnel Security

Control Name BOT Cyber Resilience References
PS-01 Policy and Procedures
Ch7.2
PS-02 Position Risk Designation
Ch7.2
PS-03 Personnel Screening
Ch7.2
PS-04 Personnel Termination
Ch7.2
PS-05 Personnel Transfer
Ch7.2
PS-06 Access Agreements
Ch7.2
PS-07 External Personnel Security
Ch7.2
PS-08 Personnel Sanctions
Ch7.2
PS-09 Position Descriptions
Ch1.1Ch7.2

PT Personally Identifiable Information Processing and Transparency

Control Name BOT Cyber Resilience References
PT-01 Policy and Procedures
Ch9.2
PT-02 Authority to Process Personally Identifiable Information
Ch2.3Ch9.2
PT-03 Personally Identifiable Information Processing Purposes
Ch2.3Ch9.2
PT-04 Consent
Ch2.3Ch9.2
PT-05 Privacy Notice
Ch2.3Ch9.2
PT-06 System of Records Notice
Ch9.2
PT-07 Specific Categories of Personally Identifiable Information
Ch9.2
PT-08 Computer Matching Requirements
Ch9.2

RA Risk Assessment

Control Name BOT Cyber Resilience References
RA-01 Policy and Procedures
Ch1.2
RA-02 Security Categorization
Ch1.2
RA-03 Risk Assessment
Ch1.2Ch8.1
RA-05 Vulnerability Monitoring and Scanning
Ch3.2
RA-07 Risk Response
Ch1.2
RA-09 Criticality Analysis
Ch1.2Ch2.1Ch3.2
RA-10 Threat Hunting
Ch3.1Ch8.1

SA System and Services Acquisition

Control Name BOT Cyber Resilience References
SA-03 System Development Life Cycle
Ch2.5Ch6.2
SA-04 Acquisition Process
Ch2.5Ch5.1Ch6.2
SA-08 Security and Privacy Engineering Principles
Ch2.5Ch6.2
SA-09 External System Services
Ch5.1Ch5.2
SA-10 Developer Configuration Management
Ch2.5
SA-11 Developer Testing and Evaluation
Ch2.5
SA-15 Development Process, Standards, and Tools
Ch2.5Ch6.2
SA-16 Developer-provided Training
Ch2.5
SA-17 Developer Security and Privacy Architecture and Design
Ch2.5Ch6.2
SA-20 Customized Development of Critical Components
Ch2.5Ch6.2
SA-21 Developer Screening
Ch2.5Ch5.1
SA-22 Unsupported System Components
Ch2.5

SC System and Communications Protection

Control Name BOT Cyber Resilience References
SC-01 Policy and Procedures
Ch2.4
SC-02 Separation of System and User Functionality
Ch2.4
SC-03 Security Function Isolation
Ch2.4
SC-04 Information in Shared System Resources
Ch2.4
SC-05 Denial-of-service Protection
Ch2.4
SC-07 Boundary Protection
Ch2.4Ch5.2Ch8.2Ch9.1
SC-08 Transmission Confidentiality and Integrity
Ch2.3Ch2.4Ch2.7Ch9.1
SC-10 Network Disconnect
Ch2.4
SC-12 Cryptographic Key Establishment and Management
Ch2.3Ch2.7
SC-13 Cryptographic Protection
Ch2.3Ch2.7Ch9.1
SC-17 Public Key Infrastructure Certificates
Ch2.7
SC-20 Secure Name/Address Resolution Service (Authoritative Source)
Ch2.4
SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
Ch2.4
SC-22 Architecture and Provisioning for Name/Address Resolution Service
Ch2.4
SC-23 Session Authenticity
Ch2.4Ch8.2Ch9.1
SC-24 Fail in Known State
Ch4.2
SC-26 Decoys
Ch3.1Ch8.1
SC-28 Protection of Information at Rest
Ch2.3Ch2.7
SC-32 System Partitioning
Ch2.4
SC-39 Process Isolation
Ch2.4
SC-40 Wireless Link Protection
Ch2.4Ch2.7
SC-41 Port and I/O Device Access
Ch2.6
SC-42 Sensor Capability and Data
Ch2.6
SC-44 Detonation Chambers
Ch3.1
SC-45 System Time Synchronization
Ch9.1
SC-47 Alternate Communications Paths
Ch2.4

SI System and Information Integrity

Control Name BOT Cyber Resilience References
SI-02 Flaw Remediation
Ch3.2Ch10.1
SI-03 Malicious Code Protection
Ch2.6Ch8.2
SI-04 System Monitoring
Ch2.6Ch3.1Ch8.2
SI-05 Security Alerts, Advisories, and Directives
Ch3.2Ch4.1Ch8.1
SI-06 Security and Privacy Function Verification
Ch10.1
SI-07 Software, Firmware, and Information Integrity
Ch2.6Ch9.1
SI-10 Information Input Validation
Ch2.5
SI-11 Error Handling
Ch2.5
SI-12 Information Management and Retention
Ch2.3Ch9.2
SI-13 Predictable Failure Prevention
Ch4.2
SI-14 Non-persistence
Ch10.1
SI-16 Memory Protection
Ch2.6
SI-17 Fail-safe Procedures
Ch4.2
SI-19 De-identification
Ch2.3Ch9.2

SR Supply Chain Risk Management

Control Name BOT Cyber Resilience References
SR-01 Policy and Procedures
Ch5.1Ch5.2
SR-02 Supply Chain Risk Management Plan
Ch5.1
SR-03 Supply Chain Controls and Processes
Ch5.1
SR-04 Provenance
Ch5.1
SR-05 Acquisition Strategies, Tools, and Methods
Ch5.1
SR-06 Supplier Assessments and Reviews
Ch5.1
SR-07 Supply Chain Operations Security
Ch5.1
SR-08 Notification Agreements
Ch5.1