Cambodia Cybersecurity and Digital Growth Explained

Published Date: November 12, 2026 Author: Content Team

Category: Blogs Tags: Cybersecurity, MDR

Is Cambodia cybersecurity keeping pace with digital growth? A CISO's view of regulation, exposure and the resilience priorities that matter now.

TL;DR

Cambodia’s digital economy is scaling faster than its national security capability, with the ITU Global Cybersecurity Index 2024 placing it in Tier 4, “evolving”. Plan on the assumption that the surrounding ecosystem will not absorb your risk.
Two instruments bind today: the technology-based fraud law and, for banks and financial institutions, the National Bank of Cambodia guidelines. The cybersecurity and personal data protection laws remain in draft.
Do not wait for final legislation. Build to ISO/IEC 27001 or the NIST Cybersecurity Framework, secure continuous monitoring, and test incident response until you can show the evidence.

Cambodia’s digital build-out is visible in Bakong, the KHQR payment standard and the long-term agenda set by the Digital Economy and Society Policy Framework 2021-2035. DataReportal counted 12.0 million internet users in October 2025.
Each of those milestones also means more exposure: more payment flows, more cloud workloads and more third-party connections, all governed by rules that are still being written.

The question a board will ask is whether security operations, governance and incident response are scaling at the same rate as the business. This article aims to answer it, covering where Cambodia cybersecurity stands, which obligations apply today and what to fix first.

Is Cambodia Cybersecurity Capacity Keeping Up with Digital Growth?

Not yet, judging by the available benchmarks. The ITU Global Cybersecurity Index 2024 places Cambodia in Tier 4, “evolving”, and Internet Society Pulse lists its score at 37.09 out of 100. The index scores five pillars: legal, technical, organisational, capacity development and cooperation.

That is a national assessment, not a verdict on any single organisation. It does, however, describe the environment you operate in. Cambodia’s Digital Government Policy 2022-2035 itself calls for a national cybersecurity framework and standards for sensitive government and public data, which signals intent rather than a finished structure.

What a Tier 4 Ecosystem Means for Your Risk Register

Treat the ranking as a list of assumptions you can no longer make. Do not assume that suppliers run mature monitoring, that a regulator will define your baseline for you, or that specialist analysts can be hired quickly. Three risks move up the register:

Expanding attack surface: More applications, APIs and cloud environments create more points of exploitation.
Interconnected operational risk: A compromise at a payment partner or service provider can reach well beyond that one organisation.
Operational load: Demand for monitoring, investigation and response grows faster than most teams can staff it.

Continue the conversation at Cambodia Cybersecurity Summit 2026.
Join us on 20 November 2026 to discuss the priorities shaping the Cambodia’s cybersecurity landscape, including the launch of a new Managed SOC.

Cybersecurity Obligations in Cambodia Today

Two instruments carry weight today, and they do different jobs. The Law on Combating Technology-Based Fraud creates criminal offences and penalties for technology-enabled fraud, while the National Bank of Cambodia (NBC) guidelines set technology and cyber risk expectations for regulated financial institutions. Neither is a general cybersecurity law. A general cybersecurity law and a personal data protection law are still in draft.

Law on Combating Technology-Based Fraud: The National Assembly approved it unanimously on 30 March 2026, with 112 votes in favour. The Senate subsequently passed it, and it was promulgated on 6 April 2026. It is criminal law: reporting indicates it covers cybercrime, scam recruitment, specialised money laundering and the malicious collection of personal data. It does not set control requirements for organisations.
NBC Technology and Cyber Risk Management Guidelines: The updated guidelines, reported as issued in January 2026, replace the 2019 guidance. Published summaries indicate that they set assessable expectations across governance, cybersecurity, resilience, outsourcing and cloud, including a cybersecurity operations function, SOC capability for larger institutions, threat intelligence, annual incident response testing and incident reporting to the regulator.
Draft Cybersecurity Law: The Ministry of Post and Telecommunications (MPTC) continued technical review meetings in July 2026.
Draft Law on Personal Data Protection: MPTC held a validation workshop on 5 August 2026. Sources reviewed through August 2026 show that no comprehensive statute has been enacted.

Keep a simple register with three columns: in force, issued as guidance, and in draft. Review it with the board each quarter so that planning reflects what binds you now while leaving room for what is coming.

Why Does Regulatory Fragmentation Raise Enterprise Risk?

Fragmentation raises risk because no single instrument gives you a complete baseline, and the distance between what is required and what is defensible grows when rules are uneven. Banks face specific technical expectations, while other sectors operate under general law and sector guidance.

Groups operating across jurisdictions feel this most. Local requirements must be reconciled with group policy, contractual obligations and risk appetite. Hosting deserves early attention: summaries of the NBC guidelines indicate that primary data centres should be in Cambodia and that offshore hosting needs prior approval, a risk assessment and an exit strategy.

Waiting for new legislation before testing controls leaves little time to close gaps in governance, evidence and reporting. A steadier approach is to align controls with ISO/IEC 27001 or the NIST Cybersecurity Framework, which gives you a defensible basis whatever the final laws require. A compliance-focused assessment can test existing controls against those frameworks and the NBC expectations.

CISO’s Checklist to Strengthen Cyber Resilience in Cambodia?

Prioritise measurable weaknesses over additional tools, and connect each regulatory obligation to an operational capability. A practical sequence:

Map obligations once: Consolidate NBC expectations, the fraud law and anticipated data protection duties into one control framework, with named owners and retained evidence.
Secure continuous detection and response: Confirm coverage of critical systems, overnight investigation and defined escalation. Where internal resources fall short, outsourcing SOC operations gives access to monitoring and expertise without a long build.
Validate controls through testing: Test networks, applications, APIs and cloud environments regularly, rank findings by exploitability and business impact, and track remediation to closure.
Govern third parties by tier: Concentrate assessment on suppliers with access to payments, sensitive data or core infrastructure.
Exercise incident response: Rehearse decision-making, containment, communication and regulatory reporting at least annually, and verify that corrective actions are completed.

The aim is to move from documented policy to demonstrable operational readiness. For board reporting, a short set of indicators is more persuasive than a long dashboard: the share of critical systems under continuous monitoring, time to detect and contain incidents, remediation closure rates for high-severity findings, the share of critical suppliers assessed, and the date of the last response exercise. Each indicator links directly to an obligation or a risk the board already recognises.

How Can Managed SOC in Cambodia Close the Operational Gap?

A managed SOC closes the gap by supplying continuous monitoring, threat intelligence and coordinated response where an internal team cannot sustain them. Before committing to a model, a SOC Maturity Assessment evaluates people, processes, technology and governance, and produces a prioritised roadmap.

Where gaps remain, Ampcus Cyber’s Managed SOC services extend your team. Global Security Operations Centres in the USA, UAE, India and the Philippines support a Follow-the-Sun model. Proprietary ShadowOpsIntel threat intelligence informs detection, and experienced analysts lead investigation and response. For organisations in Cambodia, the benefit is faster visibility and containment, with audit-ready records, without a lengthy recruitment cycle.

What Could Be the Road Ahead for Cambodia’s Cybersecurity

Cambodia’s cybersecurity is advancing, but not yet at the pace of digital adoption. The fraud law and updated banking guidelines show momentum, while the draft cybersecurity and data protection laws point to further change. Waiting for the landscape to settle is not a security strategy. Organisations that invest in continuous monitoring, intelligence-led detection, tested response and measurable governance will manage today’s risks and be ready for tomorrow’s obligations.

This is exactly why Ampcus Cyber is leading the effort of advancing Cambodia’s Cybersecurity.

Meet us at the Cambodia Cybersecurity Summit on 20 November and explore how technology, regulations, and collaboration can advance the cyber resilience.