Malaysia Cyber Security Act 2024: NCII Duties and Provider Licensing

Malaysia's Cyber Security Act 2024 (Act 854) turns cyber security for national critical information infrastructure from guidance into law, with codes of practice, risk assessments, audits, six-hour incident notification and a licence requirement for some cyber security service providers. The Act came into operation on 26 August 2024 and is administered by the National Cyber Security Agency (NACSA). This guide explains who is covered, the main duties of NCII entities and sector leads, the licensing regime for managed SOC monitoring and penetration testing providers, the subsidiary instruments issued so far, and how to plan compliance, including the machine identities and service accounts that NCII systems depend on. It is for CISOs and compliance leads at organisations in the 11 NCII sectors, their suppliers, and security service firms operating in Malaysia.

Source note: this page is based on NACSA's own web pages, which state the dates, sectors and instruments, and on reputable secondary sources for the detailed obligations, because the official text of the Act and its regulations on NACSA's site and the Laws of Malaysia portal could not be accessed for this review. The secondary sources are a Bernama report of the Prime Minister's Office statement published by RTM (Radio Televisyen Malaysia), and summaries by the law firms Mayer Brown and DNH (Donovan & Ho). Each obligation below names its source. Penalty figures and deadlines are given only where two independent sources agree. Confirm against the official text before relying on it.

Key takeaways

• In force since 26 August 2024. NACSA states the Act was gazetted on 26 June 2024 and the Prime Minister appointed 26 August 2024 as the date it came into operation; four regulations took effect the same day, according to RTM.
• Eleven NCII sectors. NACSA lists government; banking and finance; transportation; defence and national security; information, communication and digital; healthcare services; water, sewerage and waste management; energy; agriculture and plantation; trade, industry and economy; and science, technology and innovation.
• Six hours, then 14 days. RTM and DNH both report that an NCII entity must notify a cyber security incident immediately, give initial details within six hours of becoming aware, and supply further information within 14 days.
• Annual risk assessment, audit every two years. Both sources report a cyber security risk assessment at least once a year and an audit at least once every two years, with NACSA's Chief Executive able to require more.
• Licences for SOC monitoring and penetration testing. Both sources report that providers of managed security operation centre monitoring and penetration testing services must hold a licence.

Scope: who and what is covered

NACSA describes national critical information infrastructure (NCII) as critical systems, including electronic information assets, networks, functions, processes, facilities and services, whose disruption could affect national defence and security, economic stability, the national image, government functions, public health and safety or individual privacy.

• Territorial reach: Mayer Brown reports that section 3(2) applies the Act to NCII that is wholly or partly in Malaysia, so a foreign operator of systems partly located in Malaysia may be covered.
• Relationship to existing rules: sector rules still apply alongside the Act; for example, banks remain subject to the Bank Negara Malaysia RMiT policy, and personal data breaches fall under the Malaysia PDPA.

From policy directive to statute

Before Act 854, NCII protection in Malaysia rested mainly on National Security Council Directive No. 26. NACSA's business page says that directive asked NCII agencies to implement ISO/IEC 27001 information security management system certification or an equivalent, and to run cyber incident response and business continuity management procedures, with NACSA as the coordinating agency for threats to NCII. The Act keeps that foundation but adds legal force: named duties for designated entities, fixed notification clocks, a statutory audit cycle, criminal penalties and a licensing regime for service providers.

Our view: an existing ISO/IEC 27001 programme is a strong starting point, but it does not by itself show compliance with a sector code of practice or the notification clocks.

Key obligations

Incident notification in practice

DNH reports that the six-hour notice covers a description of the incident, its severity, the date and how it was discovered, and the 14-day follow-up adds affected hosts, threat details and actions taken. The clock starts when the entity becomes aware, so detection, triage and the decision to notify must fit inside six hours, around the clock. See the Cyber Incident Reporting Requirements Map to align this with other regimes such as the Singapore Cybersecurity Act.

Licensing of cyber security service providers

• Licensed services: managed security operation centre monitoring services and penetration testing services (RTM; DNH).
• Conditions: Mayer Brown reports prerequisites in section 28 (including no fraud-related convictions), application and approval in sections 30 and 31, revocation or suspension in section 33, and a requirement to keep records in section 32.
• Transition: NACSA has issued Chief Executive Directive No. 2 on licensing and Directive No. 6 extending the deferral period for obtaining a licence, and Directive No. 11 on record keeping and reporting by licence holders. Check the current deferral end date with NACSA before relying on it.
• Buyers: NCII entities and others procuring SOC monitoring or penetration testing in Malaysia should ask for the provider's NACSA licence. See the Penetration Testing Guide.

Timeline and current status

The four regulations are the Cyber Security (Period for Cyber Security Risk Assessment and Audit) Regulations 2024, the Cyber Security (Notification of Cyber Security Incident) Regulations 2024, the Cyber Security (Licensing of Cyber Security Service Provider) Regulations 2024 and the Cyber Security (Compounding of Offences) Regulations 2024. NACSA's legal page was last updated on 8 November 2026 and lists the directives in Malay. Status checked 8 November 2026; NACSA continues to add directives, so check the legal page for changes.

Enforcement and penalties

• Criminal offences: failures under the Act are offences punishable by fine, imprisonment or both. Mayer Brown and DNH agree that the maximum fines range from RM100,000 to RM500,000 and maximum prison terms from two to ten years, depending on the offence. The highest band applies to the most serious duties; the per-section amounts are reported by Mayer Brown only, so they are not repeated here.
• Compounding: RTM reports that the Compounding of Offences Regulations allow offences under subsections 20(6), 20(7), 22(7), 22(8), 24(4) and 32(3) to be compounded; DNH agrees there are six compoundable offences, with the Public Prosecutor's consent.
• Investigation: Mayer Brown reports investigation, search and seizure powers and that prosecution needs the Public Prosecutor's consent.

What it means for AI agents and non-human identities

The Act does not mention AI agents or machine identities by name, but its duties reach them in practice:

• Risk assessments and audits: NCII systems run on service accounts, API keys, certificates and integration credentials. An annual risk assessment that ignores them misses the access most likely to be abused. Include an inventory of non-human identities with owners and privileges. See the Critical Infrastructure Identity Security Guide.
• Six-hour notification: confirming whether a credential was misused, and revoking it, must happen quickly. Pre-approve revocation runbooks for high-privilege service accounts and tokens.
• AI agents in operations: where agents act on NCII systems, treat each agent as an identity with its own scoped credentials and logs so that incident details for the 14-day report can be produced.
• Post-quantum migration: Directive No. 9 asks NCII entities for data on post-quantum cryptography migration (title from NACSA). Certificates and keys used by machines are central to that inventory. See the Post-Quantum Migration for NHIs Guide.
• Licensed providers: a managed SOC holds privileged access into its clients; its own accounts and keys need the same governance it monitors.

Compliance steps

1. Confirm status: check whether your sector lead has designated you as an NCII entity, and whether you supply services to one. Ask the sector lead for the current code of practice.
2. Map the duties: build a register of obligations from the official text, using this page as a starting outline, and assign an owner to each.
3. Baseline: complete NACSA's National Cyber Security Baseline self-assessment and record gaps.
4. Set up notification: register for the NC4 system, write a six-hour notification procedure with out-of-hours cover, and test it in an exercise.
5. Schedule assessment and audit: plan an annual risk assessment and a two-yearly audit; NACSA offers a risk management toolkit and a sample risk assessment report.
6. Govern identities: inventory human and non-human privileged access to NCII and fix ownerless or over-privileged accounts.
7. Check providers: confirm SOC monitoring and penetration testing suppliers hold NACSA licences.
8. Review quarterly: watch NACSA's legal page for new directives and orders.

Large versus small entities: large NCII entities with in-house SOCs can usually absorb the six-hour clock but must map many systems to the code of practice; smaller designated entities may rely on a licensed managed SOC and should write the notification hand-off into the contract.

Metrics: time from detection to NACSA notification (target under six hours); percentage of NCII systems covered by the latest risk assessment; open audit findings past due date; percentage of privileged non-human identities with a named owner; percentage of security service suppliers with a verified licence.

Framework mapping

Practitioner checklist

• Confirm NCII designation status with your sector lead and obtain the current code of practice.
• Read the official Act and regulations and record each duty with an owner.
• Complete the National Cyber Security Baseline self-assessment.
• Test a six-hour incident notification through NC4, including weekends.
• Schedule annual risk assessments and two-yearly audits.
• Inventory privileged human and non-human access to NCII systems.
• Verify NACSA licences for SOC monitoring and penetration testing suppliers.
• Track new NACSA directives every quarter, including post-quantum data requests.

Standards and references

• NACSA: Act 854 Cyber Security Act 2024
• NACSA: Legal (Act, Regulations, Orders and Chief Executive Directives)
• NACSA: National Critical Information Infrastructure
• RTM (Bernama): Akta Keselamatan Siber (Akta 854) berkuat kuasa hari ini
• Mayer Brown: Malaysia's New Cyber Security Act 2024, a Summary and Brief Comparative Analysis
• DNH: Introduction of the New Cyber Security Act 2024 and Supporting Regulations

Related NHI Mgmt Group resources: Critical Infrastructure Regulation Map · Singapore Cybersecurity Act Guide · Bank Negara Malaysia RMiT · Critical Infrastructure Identity Security Guide. This guide summarises Malaysia's Cyber Security Act 2024 and is not legal advice. It is based partly on secondary sources; confirm against the official text before relying on it.