Runs an essential service, in Malaysia

Cyber Security Act 2024 (Act 854), s. 23 · Read the law's page

• When it comes to your knowledge that a cyber security incident has or might have occurred in respect of the national critical information infrastructure you own or operate, notify the Chief Executive and your national critical information infrastructure sector lead within the period and in the manner prescribed (section 23(1)). The Act itself states no clock.
• This binds a national critical information infrastructure (NCII) entity, meaning a Government Entity or person that a national critical information infrastructure sector lead designates under section 17, or the Chief Executive of the National Cyber Security Agency designates under section 18, because it owns or operates a national critical information infrastructure (reached by declaring that you operate an essential service).
• A cyber security incident is an act or activity carried out on or through a computer or computer system, without lawful authority, that jeopardizes or adversely affects the cyber security of that computer or computer system or another one (section 4).

Cyber Security Act 2024 (Act 854), ss. 17, 20 to 22 and 24 · Read the law's page

• Implement the measures, standards and processes specified in the code of practice to ensure the cyber security of the national critical information infrastructure you own or operate, or alternative measures that you prove to the Chief Executive's satisfaction give equal or higher protection (section 21(1) and (2)).
• Within the prescribed period, conduct a cyber security risk assessment of that infrastructure in accordance with the code of practice and the Chief Executive's directive, and cause an audit by an auditor the Chief Executive approves to be carried out, then submit the assessment or audit report to the Chief Executive within thirty days after completing it (section 22(1) and (2)).
• Follow the Chief Executive's directions to re-evaluate the cyber security risk, rectify an insufficient audit report, or carry out a further assessment or audit (section 22(3) to (6)).
• Comply with your sector lead's request for information about the infrastructure you own or operate, give it the same information for any additional computer or computer system you consider to be national critical information infrastructure, and notify it of a material change to the design, configuration, security or operation of the infrastructure within thirty days from the date the change was completed (section 20(1) to (3)).
• Notify your sector lead in writing without delay if you consider that a computer or computer system you own or operate has ceased to be national critical information infrastructure, or you no longer own or operate any (section 17(6)).
• Follow the Chief Executive's directions for a cyber security exercise (section 24(3)).
• This binds a national critical information infrastructure (NCII) entity, meaning a Government Entity or person that a national critical information infrastructure sector lead designates under section 17, or the Chief Executive of the National Cyber Security Agency designates under section 18, because it owns or operates a national critical information infrastructure (reached by declaring that you operate an essential service).