How do we verify a cybersecurity service provider is properly licensed?

The Cyber Security Act 2024 introduces licensing for providers of prescribed services — initially SOC monitoring and penetration testing. Procurement should request the licence reference at tender stage and verify against NACSA's published register.

What is in scope for the biennial cybersecurity audit?

Compliance with the Act, regulations, and any code of practice or directive — covering policy and governance, technical controls, incident detection and response, third-party and supply-chain controls, and evidence of annual risk assessment and timely incident reporting.

What is the incident reporting timeline to NACSA?

The entity must notify NACSA and the sector lead within the timeframe prescribed under the regulations, which specify trigger categories and a tiered timeline from initial notification through to a fuller incident report.

What constraints apply to pentesting production public-sector systems?

Citizen-facing portals cannot be taken offline during business hours, identity systems carry whole-of-government blast radius, and classified environments fall under separate handling regimes — engagements use non-disruptive techniques on production and mirrored staging for higher-intensity testing.

Cyber Security Act 2024 · NACSA · NCII designation

Government & public sector cybersecurity Malaysia

Cybersecurity for Malaysian ministries, agencies, GLCs and statutory bodies. Cyber Security Act 2024 readiness, the full NCII obligation lifecycle, licensed-provider trust language, and procurement-friendly evidence packs designed for audit, internal risk and NACSA scrutiny.

Request scoping call Compliance standards

State-aligned, hacktivist and criminal pressure

Public-sector entities sit at the intersection of three threat streams: sustained state-aligned collection against ministerial communications and citizen identity datasets; hacktivist defacement and denial-of-service around geopolitical flashpoints; and criminal ransomware, which has demonstrated public administration is squarely in the target set. A fourth pressure point is the supply chain — a compromised panel systems integrator yields access into many agencies at once, the same pattern behind SolarWinds and Kaseya globally.

The NCII obligation lifecycle

Identify which systems constitute NCII; assess risk annually; commission an independent audit at least once every two years; report incidents to NACSA and the sector lead within the prescribed timeframe; remediate with re-test attestation. The Cyber Security Act 2024 also introduces a licensing regime for cybersecurity service providers offering prescribed services — initially SOC monitoring and penetration testing.

Our service stack

Cyber Security Act 2024 Readiness Assessment

Delivered as a licensed-provider engagement, mapping the entity against NCII obligations — risk assessment cadence, biennial audit readiness, incident reporting workflow, policy framework.

Public-Sector Penetration Testing

Scoped around production constraints for citizen-facing portals, identity systems and legacy mainframes. Non-disruptive on production, intensive on mirrored staging.

NCII Risk Assessment & Biennial Audit Support

Annual cybersecurity risk assessment evidence pack and biennial audit preparation, aligned to NACSA and sector-lead expectations.

Incident Response Retainer for NCII Entities

Pre-positioned forensics, named regulator-notification workflow aligned with CSA 2024 reporting timelines, and after-action documentation designed to survive audit.

Security Policy Development & Governance

Policy framework build, control mapping and governance documentation suitable for the biennial audit and internal risk function.

Vulnerability Assessment & Continuous Assurance

Recurring vulnerability assessment across citizen portals, identity, hybrid cloud and third-party SI access surfaces, feeding the annual risk assessment.

Frequently asked questions

Whether the computer systems the entity owns or operates are essential to service delivery within one of the prescribed NCII sectors, and whether disruption would have a debilitating impact on national security, the economy, public health or public order.

Protect your operations

30-minute scoping call with a sector-credentialed consultant.

Request scoping call

Not sure what you need?

Tell us what needs testing and we come back with a fixed fee within 48 hours — no hourly estimates.

Request a scoped quote WhatsApp us