Home / Guides / Malaysia Cyber Security Act 2024 (NACSA)
Malaysia Cyber Security Act 2024 (NACSA) Guide for Cybersecurity Vendors and Partners
Malaysia's Cyber Security Act 2024 (Act 854) does two things that matter to anyone selling cybersecurity there. It puts legal duties on organisations that run National Critical Information Infrastructure (NCII). It also makes providers of managed SOC monitoring and penetration testing hold a licence from the National Cyber Security Agency (NACSA). The first creates demand. The second changes who is allowed to deliver it.
Key facts
- In force: 26 August 2024, together with four regulations covering incident notification, risk assessment and audit periods, compounding of offences, and licensing of cyber security service providers.
- Regulator: NACSA, the National Cyber Security Agency, working with an NCII sector lead for each sector. Sector leads were appointed from 11 September 2024.
- Who has duties: entities designated as NCII entities by their sector lead, across 11 sectors.
- Incident notification: notify NACSA's Chief Executive and the sector lead immediately on becoming aware of an incident, then provide further details within 6 hours and a fuller report within 14 days.
- Assurance cycle: a cyber security risk assessment every year and an audit at least every 2 years, or more often if NACSA's Chief Executive directs.
- Licensing: providers of managed SOC monitoring and penetration testing services must hold a NACSA licence. Providing these services without one can mean a fine of up to RM500,000, up to 10 years' imprisonment, or both.
1. The 11 NCII sectors
An organisation only takes on NCII duties once its sector lead designates it. In practice, the large operators in these sectors are where the Act creates new budget.
| Sector | Sector |
|---|---|
| Government | Healthcare Services |
| Banking and Finance | Water, Sewerage and Waste Management |
| Transportation | Energy |
| Defence and National Security | Agriculture and Plantation |
| Information, Communication and Digital | Trade, Industry and Economy |
| Science, Technology and Innovation |
For banking and finance, Bank Negara Malaysia has built the sector Code of Practice into its RMiT policy as Appendix 12. See our BNM RMiT guide.
2. NCII entity duties mapped to product categories
| Duty | What the Act requires | Typical product categories |
|---|---|---|
| Code of practice (s. 21) | Implement the measures, standards and processes in the code of practice for the sector | Depends on the code: typically SOC/MDR, PAM and MFA, vulnerability management, backup |
| Risk assessment (s. 22) | A cyber security risk assessment at least once a year | Risk assessment services, attack surface management, GRC |
| Audit (s. 22) | An audit at least once every 2 years, or more often if directed | Audit and assurance services, compliance evidence and reporting |
| Incident notification (s. 23) | Notify immediately, add details within 6 hours, fuller report within 14 days | SIEM and detection, SOC/MDR, IR retainers, forensics |
| Cyber security exercises (s. 24) | Take part in exercises when NACSA's Chief Executive directs | Cyber drills, tabletop exercises, cyber range |
| Information to sector lead (s. 20) | Provide information on the NCII, including material changes | Asset inventory, CMDB, architecture documentation |
3. Licensing of SOC and penetration testing providers
This is the part of the Act that changes the channel. Under the licensing regulations, two services need a NACSA licence when provided in Malaysia:
- Managed security operation centre (SOC) monitoring
- Penetration testing
Summaries of the regulations note exemptions, including services by government entities, services between related companies, and services for systems located outside Malaysia. Licensees must keep records of the services they provide for at least 6 years, and must apply for renewal at least 30 days before expiry.
What it means for vendors and partners
- MDR and SOC vendors selling into Malaysia need either their own licence or a licensed local partner who delivers the monitoring. This makes licensed MSSPs gatekeepers.
- Penetration testing bought for RMiT, the Act or audits has to come from a licensed provider. Check a partner's licence before you co-sell.
- Distributors and resellers bundling managed services should map which of their partners hold licences. That is a new qualification criterion for recruiting partners.
4. Penalties
Maximum penalties under the Act, as summarised by law firms; check the Act for the exact wording.
| Breach | Section | Maximum penalty |
|---|---|---|
| Failing to implement the code of practice | s. 21(5) | RM500,000 and/or 10 years |
| Failing to notify a cyber security incident | s. 23(2) | RM500,000 and/or 10 years |
| Providing SOC monitoring or pen testing without a licence | s. 27(5) | RM500,000 and/or 10 years |
| Failing to conduct or submit a risk assessment or audit | s. 22(7) | RM200,000 and/or 3 years |
| Failing to comply with incident directions | s. 35(5) | RM200,000 and/or 3 years |
| Failing to provide NCII information to the sector lead | s. 20(6) | RM100,000 and/or 2 years |
| Licensee failing to keep service records | s. 32(3) | RM100,000 and/or 2 years |
5. Using the Act in a sales conversation
- Ask if the customer is a designated NCII entity. Designation turns the annual risk assessment, the two-yearly audit and the 6-hour notification into legal duties with criminal penalties.
- Sell the 6-hour window. Few organisations can produce a detailed incident report within 6 hours without 24x7 detection and a retained IR team.
- Lead with licensed delivery. For SOC and pen testing, "delivered by a NACSA-licensed provider" is now a requirement, not a differentiator. Put the partner's licence in the proposal.
- Know the sector code. The code of practice for the customer's sector defines what "compliant" means. For banks it is RMiT Appendix 12.
Related: BNM RMiT · MAS TRM (Singapore) · Channel Map
Sources
- CMS: Malaysia's new Cyber Security law takes effect
- Halim Hong & Quek: Cyber Security Regulations 2024 — reporting, audit and licensing obligations
- Mayer Brown: Malaysia's new Cyber Security Act 2024 — a summary and comparative analysis
- Baker McKenzie: Cyber Security Act 2024 and subsidiary regulations in force on 26 August 2024
- Bank Negara Malaysia: RMiT policy document (Appendix 12, NCII Code of Practice)