Cybersecurity Malaysia: Who Must Comply With the Cyber Security Act 2024? 

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. It sets out a legal framework to strengthen national cybersecurity, protect critical information infrastructure, manage cyber incidents and regulate certain cybersecurity service providers. 

For businesses looking into cybersecurity Malaysia requirements, the key point is this: the Act does not place the same obligations on every organisation. What applies to you depends on your role, whether you have been designated as a National Critical Information Infrastructure (NCII) entity, and whether you provide cybersecurity services that fall under the licensing rules. 

Knowing these differences helps you work out which requirements actually apply to your business. 

1. National Critical Information Infrastructure (NCII) Entities

A large part of the Act focuses on protecting National Critical Information Infrastructure. NCII covers the systems, networks, information assets, facilities and services whose disruption could affect national security, the economy, public health and safety, or the government’s ability to function. 

The 11 NCII Sectors 

Malaysia identifies 11 NCII sectors: 

• Government 

• Banking and finance 

• Transportation 

• Defence and national security 

• Information, communication and digital 

• Healthcare services 

• Water, sewerage and waste management 

• Energy 

• Agriculture and plantation 

• Trade, industry and economy 

• Science, technology and innovation 

Operating in one of these sectors does not automatically make an organisation an NCII entity. Designation and the relevant regulatory framework still need to be considered. 

Responsibilities of Designated NCII Entities 

Designated NCII entities carry specific responsibilities. These include putting the required cybersecurity measures in place, carrying out risk assessments and audits, and reporting qualifying cybersecurity incidents. 

2. Cybersecurity Service Providers Covered by Licensing Requirements

The Act also regulates certain cybersecurity service providers through a licensing framework. 

Under the Cyber Security (Licensing of Cyber Security Service Provider) Regulations 2024, the prescribed services are: 

• Managed Security Operation Centre (SOC) monitoring services: Monitoring systems and security events to identify potential cyber threats. 

• Penetration testing services: Testing computer systems to find security vulnerabilities that could be exploited. 

Providers of these prescribed services generally need a licence, subject to any applicable exemptions. If you want to understand what a managed SOC actually does day to day, see our guide on how Security Operation Centres respond to a cyber crisis. 

This is especially relevant to IT companies and cybersecurity firms offering managed SOC monitoring or penetration testing. Other IT support and cybersecurity services do not automatically fall into these categories, so providers should check the service definitions and the latest requirements on NACSA’s official Act 854 page. 

3. What Are the Main Compliance Requirements?

For organisations covered by the Act, compliance involves much more than installing security software or running a firewall. NCII entities have specific legal duties tied to protecting their critical information infrastructure. 

Key requirements include: 

Cybersecurity Measures and Standards 

NCII entities must implement the cybersecurity measures, standards and processes set out in the relevant code of practice and regulatory directions. 

Cybersecurity Risk Assessments 

Covered entities must carry out a cybersecurity risk assessment at least once a year, in line with the applicable requirements. 

Cybersecurity Audits 

A cybersecurity audit must be conducted at least once every two years, or more often if the relevant authority directs it. 

Cyber Incident Reporting 

NCII entities must report qualifying cybersecurity incidents to the relevant authorities within the prescribed timeframes. These reporting steps should be built into your incident response procedures. 

Ongoing Security Readiness 

Organisations should keep the right processes, records and technical capabilities in place to show compliance and respond effectively when an incident happens. 

The exact obligations depend on the applicable legislation, regulations, codes of practice and directions.

4. Do SMEs and Other Private Businesses Need to Comply?

Not every SME or private company is automatically subject to the obligations placed on NCII entities. 

However, a business may still need to comply with the Act’s licensing provisions if it provides prescribed cybersecurity services, such as managed SOC monitoring or penetration testing. 

Even if your business is not directly covered by these obligations, other cybersecurity, privacy, contractual or sector-specific requirements may still apply. 

For businesses exploring cybersecurity in Malaysia, the practical first step is to assess your activities and regulatory status, rather than assuming the Act either applies in full or does not apply at all. An independent review can help here, which is one of the reasons businesses bring in a cybersecurity consultant. 

5. What Happens If an Organisation Does Not Comply?

Non-compliance can have both legal and operational consequences. The Act sets out offences and penalties for certain breaches, while the related regulations and directions add further requirements. 

For example, Section 27 sets penalties for providing or advertising prescribed cybersecurity services without the required licence. On conviction, the maximum penalty under that section is a fine of up to RM500,000, imprisonment of up to 10 years, or both. 

The consequences depend on the specific offence and circumstances. If you are unsure about your obligations, seek qualified legal or regulatory advice. 

How ACEiT Supports Cybersecurity Malaysia Requirements 

Understanding the Cyber Security Act 2024 is an important starting point. Businesses also need to understand their own security risks and find practical ways to address them. 

ACEiT provides cybersecurity services covering managed security services, threat intelligence, network security, endpoint protection and Security Operation Centre services. As part of the ACEiT Group of specialist IT companies, the team brings together networking and cybersecurity expertise across Malaysia and Singapore. 

Unsure whether your organisation is ready for Malaysia’s cybersecurity requirements? Talk to ACEiT. 

The ACEiT team can review your current IT security environment, identify potential gaps and recommend suitable cybersecurity solutions based on how your business operates.