Cyber Security Act 2024: NCII duties, NACSA and incident reporting in Malaysia

What the Cyber Security Act 2024 is

The Cyber Security Act 2024 (Act 854) is Malaysia’s first law dedicated to cyber security. It was gazetted on 26 June 2024 and came into force on 26 August 2024, together with four sets of regulations made under it, gazetted on 22 August 2024:

• Cyber Security (Period for Cyber Security Risk Assessment and Audit) Regulations 2024, P.U.(A) 219
• Cyber Security (Notification of Cyber Security Incident) Regulations 2024, P.U.(A) 220
• Cyber Security (Licensing of Cyber Security Service Provider) Regulations 2024, P.U.(A) 221
• Cyber Security (Compounding of Offences) Regulations 2024, P.U.(A) 222

The Act does three things. It sets up the National Cyber Security Committee and gives powers to the Chief Executive of the National Cyber Security Agency (NACSA). It places duties on the organisations that run the country’s critical systems. And it brings in a licensing regime for cyber security service providers (CSSPs).

It has extraterritorial reach: it applies to acts by any person outside Malaysia in relation to NCII that is wholly or partly in Malaysia. A foreign attacker or a foreign-based supplier is not outside its scope just because it sits abroad.

NCII sectors and sector leads

The Act does not apply to every company. Its core duties fall on NCII entities: the government bodies and organisations that own or operate a computer or computer system designated as national critical information infrastructure, the systems the country depends on for essential services.

The Act lists 11 NCII sectors:

Each sector has one or more NCII sector leads, usually the ministry or regulator that already oversees that sector. NACSA announced the sector leads in September 2024. A sector lead designates the NCII entities in its sector, keeps a register of them, and prepares the sector’s code of practice. NACSA’s Chief Executive can also designate an entity directly.

If your organisation is not designated, the Act’s NCII duties do not bind you. But if you supply IT, cloud, telecoms or managed services to an NCII entity, expect its code of practice and audit findings to flow into your contract.

Duties of NCII entities

Once designated, an NCII entity carries five main duties:

1. Provide information. Give the sector lead the information it asks for about the NCII the entity owns or operates, and keep it up to date. Failure carries a fine of up to RM100,000 and/or up to 2 years’ jail.
2. Implement the code of practice. Each sector code sets the cyber security measures, standards and processes the sector must follow. NACSA has published a template for these codes on its legal page. Failure to implement the code carries a fine of up to RM500,000 and/or up to 10 years’ jail.
3. Risk assessment and audit. Under the risk assessment and audit regulations, an NCII entity must carry out a cyber security risk assessment at least once a year and an audit at least once every two years, or more often if the Chief Executive directs, and submit the reports. Failure carries up to RM200,000 and/or up to 3 years.
4. Take part in exercises. The Chief Executive can direct an entity to join a cyber security exercise to test its readiness. Ignoring the direction carries up to RM100,000.
5. Notify incidents. Report cyber security incidents to NACSA’s Chief Executive and the sector lead (next section). Failure to notify carries up to RM500,000 and/or up to 10 years.

The Act defines a cyber security incident as an act or activity carried out on or through a computer or computer system, without lawful authority, that jeopardises or adversely affects the cyber security of that or another computer or computer system. There is no size threshold in the definition, so plan to report early and refine later.

Liability is not limited to the organisation. Law firm summaries note that the Act can extend to employees and agents of the entity. That makes it a training matter, not only an IT one: the people who notice an incident first are usually not the ones who report it to NACSA.

Incident notification timelines

The Cyber Security (Notification of Cyber Security Incident) Regulations 2024 set a three-step clock for NCII entities:

Six hours is short. It only works if staff know what an incident looks like, who to call at 2 a.m., and who is authorised to file. Write the contacts into your incident response plan, keep a template with the six-hour fields ready, and rehearse it with a tabletop drill. The Ransomware & Cyber Incident Response lesson takes staff through the first minutes, the SOC and the crisis room, and Recovery Readiness & Backup Drills covers protected backups and safe restoration.

If the incident also involves personal data, the PDPA has its own breach notification duty with a separate clock. See Data breach notification in Malaysia.

Cyber security service provider licensing

The Act requires a licence to provide a cyber security service, or to advertise or hold yourself out as a provider of one. The licensing regulations currently prescribe two services:

• Managed security operation centre (SOC) monitoring
• Penetration testing

One licence can cover both services. NACSA opened applications on 1 October 2024, and a grace period ran until 31 December 2024; since 1 January 2025 it has been unlawful to offer these services without a licence. NACSA publishes the list of licensed providers on its licensing portal, and renewals must be filed at least 30 days before the licence expires.

Law firm guidance notes exemptions where services go only to related companies in the same group, or where every service recipient is outside Malaysia. Subcontractors that deliver SOC or penetration testing for a main contractor need their own licence. Applicants must meet the Chief Executive’s requirements and must not have convictions for fraud, dishonesty or moral turpitude.

For buyers, the practical rule is simple: before you sign a SOC or penetration testing contract, check the provider and any subcontractor on NACSA’s licensed list. Providing these services unlicensed carries a fine of up to RM500,000 and/or up to 10 years’ jail.

Penalties at a glance

Maximum penalties under Act 854, as summarised by law firms (check the Act for the exact wording):

Under the Compounding of Offences Regulations 2024 (P.U.(A) 222), offences listed in their First Schedule can be compounded, meaning settled by payment instead of prosecution, but only with the Public Prosecutor’s written consent.

What to do now

1. Confirm your status. Find out whether your sector lead has designated you, or a customer, as an NCII entity. If you are a supplier, ask which of your services touch their NCII.
2. Get the code of practice for your sector and map each requirement to an owner and a control.
3. Diarise the cycle: risk assessment every year, audit every two years, with time to fix findings before the next one.
4. Make the six-hour clock real. Name your authorised persons, keep NACSA and sector lead contacts in the incident plan, prepare a notification template, and run a drill.
5. Check your providers’ licences for SOC monitoring and penetration testing, including subcontractors.
6. Train beyond IT. Most incidents start with a click, a reused password or an unreported oddity. Staff need to recognise them and report fast.

The NACSA & the Cyber Security Act lesson walks through a national exercise: the committee, sectors and leads, codes of practice, audits, notification and licensed providers. Pair it with Phishing & Social Engineering and Passwords, MFA & Identity for the everyday habits that stop most attacks. For the staff awareness side, see Phishing awareness training.