# Bank of Thailand Cyber Resilience Guidelines for Financial Institutions

Framework id: `bot_cyber`. Financial Regulation. Publisher: Bank of Thailand (BOT). Version: 2023. Region: Thailand. Mapping licence: CC BY-SA 4.0.
Source text: https://www.bot.or.th/

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (26, average coverage 77%)
- Ch1.1 IT Governance and Board Oversight: PM-01, PM-02, PM-03, PM-09, PM-13, PS-09, PL-01 (68%)
- Ch1.2 IT Risk Management Framework: PM-01, PM-09, PM-28, RA-01, RA-02, RA-03, RA-07, RA-09, PL-09, PM-32 (80%)
- Ch1.3 IT Compliance and Regulatory Reporting: CA-01, CA-02, CA-07, PM-14, PM-15, PM-04 (55%)
- Ch2.1 IT Asset Management and Configuration: CM-01, CM-02, CM-03, CM-05, CM-06, CM-07, CM-08, CM-09, CM-10, CM-11, CM-12, CM-14, RA-09 (90%)
- Ch2.2 Identity and Access Management: AC-01, AC-02, AC-03, AC-04, AC-05, AC-06, AC-07, AC-08, AC-09, AC-10, AC-11, AC-12, AC-13, AC-14, AC-16, AC-17, AC-24, AC-25, IA-01, IA-02, IA-03, IA-04, IA-05, IA-06, IA-07, IA-08, IA-09, IA-10, IA-11, IA-12 (88%)
- Ch2.3 Data Security and Classification: MP-01, MP-02, MP-03, MP-04, MP-05, MP-06, MP-07, SC-08, SC-12, SC-13, SC-28, SI-12, SI-19, PT-02, PT-03, PT-04, PT-05 (78%)
- Ch2.4 Network Security: SC-01, SC-02, SC-03, SC-04, SC-05, SC-07, SC-08, SC-10, SC-20, SC-21, SC-22, SC-23, SC-32, SC-39, SC-40, SC-47, AC-04, AC-17, AC-18 (88%)
- Ch2.5 Application Security: SA-03, SA-04, SA-08, SA-10, SA-11, SA-15, SA-16, SA-17, SA-20, SA-21, SA-22, SI-10, SI-11 (85%)
- Ch2.6 Endpoint Security: SC-41, SC-42, SI-03, SI-04, SI-07, SI-16, CM-07, CM-11, AC-19, AC-20 (82%)
- Ch2.7 Cryptographic Controls: SC-12, SC-13, SC-08, SC-17, SC-28, SC-40 (87%)
- Ch2.8 Physical and Environmental Security: PE-01, PE-02, PE-03, PE-04, PE-05, PE-06, PE-08, PE-09, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-17, PE-18 (86%)
- Ch3.1 Security Monitoring and Threat Detection: SI-04, AU-02, AU-03, AU-04, AU-06, AU-07, AU-09, AU-12, AU-13, AU-14, CA-07, PM-16, RA-10, SC-26, SC-44 (88%)
- Ch3.2 Vulnerability Management and Penetration Testing: RA-05, CA-02, CA-08, SI-02, SI-05, PM-14, RA-09 (87%)
- Ch4.1 Cyber Incident Response and Management: IR-01, IR-02, IR-03, IR-04, IR-05, IR-06, IR-07, IR-08, IR-09, PM-16, SI-05 (75%)
- Ch4.2 Business Continuity and IT Disaster Recovery: CP-01, CP-02, CP-03, CP-04, CP-06, CP-07, CP-08, CP-09, CP-10, CP-11, CP-12, CP-13, SC-24, SI-13, SI-17 (82%)
- Ch5.1 IT Outsourcing and Third-Party Risk Management: SA-04, SA-09, SR-01, SR-02, SR-03, SR-04, SR-05, SR-06, SR-07, SR-08, SA-21, PM-30 (72%)
- Ch5.2 Cloud Services Risk Management: SA-09, AC-20, SC-07, CA-03, CA-09, SR-01, PM-30 (65%)
- Ch6.1 IT Audit: CA-01, CA-02, CA-05, CA-06, CA-07, AU-01, AU-02, AU-06, AU-16, PM-14 (70%)
- Ch6.2 IT Project Management: SA-03, SA-04, SA-08, SA-15, SA-17, PM-07, SA-20, PL-07, PL-08 (70%)
- Ch7.1 Cybersecurity Awareness and Training: AT-01, AT-02, AT-03, AT-04, AT-06, PM-13, PM-16 (82%)
- Ch7.2 Personnel Security: PS-01, PS-02, PS-03, PS-04, PS-05, PS-06, PS-07, PS-08, PS-09 (85%)
- Ch8.1 Cyber Threat Intelligence and Information Sharing: PM-15, PM-16, SI-05, RA-03, RA-10, SC-26 (72%)
- Ch8.2 Digital Fraud Prevention: SI-04, SI-03, AU-06, SC-07, AC-02, AC-07, IA-02, SC-23 (60%)
- Ch9.1 Mobile Banking and E-Payment Security: SC-07, SC-08, SC-13, SC-23, SC-45, IA-02, AC-17, AC-19, SI-07 (62%)
- Ch9.2 Customer Data Protection and Privacy: PT-01, PT-02, PT-03, PT-04, PT-05, PT-06, PT-07, PT-08, SI-12, SI-19, PM-20, PM-25, PM-26 (68%)
- Ch10.1 IT Operations Management: CM-03, CM-04, SI-02, SI-06, SI-14, MA-01, MA-02, MA-03, MA-04, MA-05, MA-06, CA-07 (75%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=bot_cyber
- Control-to-clause mappings as JSON: /api/v1/frameworks/bot_cyber?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/bot-cyber.json
- Page for people: /frameworks/bot-cyber/