What Is ICT Spec? — The มศอ. 4003 Standard for Log-Storage Devices
What is ICT Spec (มศอ. 4003)? Thailand's log-storage device standard — Type 1-3 categories, required specs, and how to verify compliance. From ฿4,000/month.
What is ICT Spec? — Thailand's มศอ. 4003 Standard for Log Storage Devices
What is ICT Spec?
"ICT Spec" is the informal name the Thai IT industry uses for two related but separate government documents. The first is มศอ. 4003-1-2560 (formally NTS 4003.1-2560), a NECTEC technical standard that sets general requirements for computer traffic-data retention systems — access control, automatic time sync, data-integrity protection, and a minimum 90-day retention window. It's a NECTEC standard, not a TIS (Thai Industrial Standard) — NECTEC has proposed it to the Thai Industrial Standards Institute (TISI) for possible future formal adoption, but as of our last check no such designation has been announced. The second is the เกณฑ์ราคากลางและคุณลักษณะพื้นฐานการจัดหาอุปกรณ์และระบบคอมพิวเตอร์ — Thailand's periodically-updated government computer-equipment price/spec schedule, published by the Ministry of Digital Economy and Society (MDES) — and it's this document that actually defines the 3-Type classification and pricing below, listing มศอ. 4003.1-2560 as one accepted certification a device can hold to qualify.
In plain English: ICT Spec = the minimum checklist a log storage device must meet to be bought through Thai government procurement, which includes meeting the retention rule in the Computer Crime Act (B.E. 2560).
Why should you know about ICT Spec?
Government agencies and organizations that procure log storage equipment through official procurement channels must specify whether the device passes the ICT Spec standard — without certification, the procurement may not be approved.
Who needs ICT Spec compliance?
- Government agencies — procurement rules require ICT Spec reference
- State enterprises — e.g. the Electricity Authority, Government Savings Bank
- Large private organizations — especially those audited by government bodies
- ISPs and Internet service providers — legally required to retain traffic logs
Device types under the price/spec schedule
The MDES procurement schedule classifies อุปกรณ์จัดเก็บ Log File ระบบเครือข่าย (network log file storage devices) into 3 types based on capacity:
| Type | EPS (Events/sec) | Best for |
|---|
| Type 1 | 1,000 EPS | SMEs, small offices |
| Type 2 | 7,000 EPS | Mid-size organizations |
| Type 3 | 20,000 EPS | Large enterprises, government agencies |
What the price/spec schedule actually requires
Checked directly against the MDES schedule's own device-level criteria (December 2025 edition) — the baseline list for this category is shorter than you might expect:
1. Log Collection
- Collect Syslog from network devices — routers, switches, firewalls, VPNs, servers
- Aggregate events from at least 3 devices (Type 1), 10 devices (Type 2), or 15 devices (Type 3), normalized into one common display format
2. Storage & Integrity
- Hash integrity using MD5 or SHA-1, or a stronger algorithm — the schedule's own wording, not a mandated SHA-256
- Back up to external storage (tape, DVD, or other external media)
- Comply with the Computer Crime Act's log-retention requirement and hold a recognized log-security certification — the schedule names มศอ. 4003.1-2560 as one accepted example
3. Management
- Administrable via HTTPS, Command Line Interface, and SSH
That's the actual baseline. The schedule does not itself specify a required search speed, a reporting format, an encryption-at-rest algorithm, or RBAC — those are capabilities vendors compete on above the minimum, not ICT Spec requirements. The 90-day retention figure holds regardless, since it's set independently by the Computer Crime Act's own retention rule (Section 26).
💡 zcrLog and ICT Spec
zcrLog's ICT1/ICT2/ICT3 appliances are each built to match a Type's capacity requirement directly, and go well past the schedule's actual baseline:
| Capability | Required by the schedule? | zcrLog |
|---|
| Syslog collection | ✅ Required | ✅ RFC 5424 + RFC 3164 |
| Hash integrity (MD5/SHA-1 or better) | ✅ Required | ✅ MD5 + SHA-256 |
| External backup | ✅ Required | ✅ |
| 90-day retention (Computer Crime Act) | ✅ Required | ✅ up to 2 years |
| HTTPS / CLI / SSH management | ✅ Required | ✅ |
| SNMP Trap / Windows Event Log collection | Not required | ✅ + API Integration |
| Encryption at rest | Not required | ✅ AES-128 |
| Sub-30-second search | Not required | ✅ |
| RBAC | Not required | ✅ |
| Admin audit log | Not required | ✅ |
| Extras | — | Threat analysis and detection rules, AI Analysis, MITRE ATT&CK |
🎯 See zcrLog →
How to verify a device is ICT Spec certified
- Request the vendor's มศอ. 4003.1-2560 compliance documentation (there is no separate "TIS 4003 certificate" — see the note above on NECTEC vs. TISI)
- Confirm the Type matches your requirements
- Check the test list is fully passed
- Look at the certificate's expiry date
📖 Read more: How to collect logs under Thailand's Computer Crime Act
Summary
ICT Spec — the MDES procurement schedule and the มศอ. 4003.1-2560 standard it references together — sets the baseline for log storage devices bought through Thai government channels. zcrLog meets every Type's baseline and adds threat-analysis and AI capabilities the schedule doesn't require.
📞 Free consultation
Sources
- เกณฑ์ราคากลางและคุณลักษณะพื้นฐานการจัดหาอุปกรณ์และระบบคอมพิวเตอร์ ฉบับเดือนธันวาคม 2568, Ministry of Digital Economy and Society, announced 2025-12-01, accessed 2026-09-16. Primary source for the Type 1/2/3 pricing, EPS thresholds, and the log-storage-device baseline requirements (items 21–23 in the schedule).
- มศอ. 4003.1-2560 (NTS 4003.1-2560) — ระบบเก็บรักษาข้อมูลจราจรทางคอมพิวเตอร์ เล่ม 1 ข้อกำหนด, NECTEC, in force from 2017-04-02, accessed 2026-09-16. Primary source confirming the 90-day minimum retention requirement and the general system requirements (access control, time sync, data-integrity protection) this standard sets — confirms it does not itself define the Type 1/2/3 EPS classification.
Related articles
Continue with these related guides for the comparison and operating detail:
Related product
See zcrLog for the product scope, the pricing page for published prices, and the inputs to confirm with your delivery partner