Loading...
Loading...
Free scoping call. Four-week gap assessment. Board-ready remediation plan. Get ahead of NACSA before your sector regulator gets ahead of you.
The Cyber Security Act 2024 (Act 854) is Malaysia's first dedicated cyber security statute. It puts NACSA on a statutory footing, establishes designated National Critical Information Infrastructure (NCII) operators, and creates binding obligations on those operators: a sector-specific cyber security code of practice, mandatory cyber security risk assessments, mandatory audits, and a mandatory incident-notification regime with statutory time limits.
For most boards, this is the first time cyber-security non-compliance has carried direct statutory criminal liability rather than indirect sectoral penalties.
The Act applies to entities designated as National Critical Information Infrastructure (NCII) operators across 11 sectors: government, banking and finance, transport, defence and national security, information and communications, healthcare, water, sewerage and waste management, energy, agriculture and plantation, trade, industry and economy, and science, technology and innovation. If your sector regulator has identified your assets as NCII, you are in scope.
The Cyber Security Act 2024 (Act 854) came into operation on 26 August 2024. NACSA has issued the Cyber Security (Risk Assessment and Audit Compliance) Regulations 2024 and the Cyber Security (Notification of Cyber Security Incident) Regulations 2024. Designated NCII operators must comply with the cyber security code of practice for their sector and conduct risk assessments and audits on the prescribed cycle.
Section 21 of Act 854 makes failure to comply with NACSA directions an offence. Penalties on conviction can include fines up to RM500,000 and imprisonment up to ten years for the most serious offences, with separate offences for failing to notify incidents within the prescribed time. Beyond statutory penalties, regulator action and reputational damage are material.
We perform a 4-week structured gap assessment against your sector's NACSA Code of Practice and Act 854 obligations: scoping the in-scope NCII assets, mapping your current controls, identifying gaps with risk-rated remediation actions, drafting an incident-notification procedure aligned to the 2024 Regulations, and producing an executive board paper. You leave with a clear, prioritised path to compliance.
Yes. We run a complimentary 45-minute scoping call to confirm whether your organisation is likely in NCII scope, what your sector regulator expects, and what a full readiness engagement would cost and contain. No obligation. Book through the /quote form.
No slide deck, no obligation. We'll tell you straight whether you're likely in NCII scope and what a sensible compliance path looks like for your organisation.
Book Free Scoping Call