MalaysiaCyber Security Act, Notification of a Cyber Security Incident to the Chief Executive and the Sector Lead
Cyber Security Act 2024 (Act 854), s. 23
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://lom.agc.gov.my/ilims/upload/portal/akta/outputaktap/2177706_BI/Act%20854.pdfIn force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a national critical information infrastructure (NCII) entity, meaning a Government Entity or person that a national critical information infrastructure sector lead designates under section 17, or the Chief Executive of the National Cyber Security Agency designates under section 18, because it owns or operates a national critical information infrastructure (reached by declaring that you operate an essential service).
- When it comes to your knowledge that a cyber security incident has or might have occurred in respect of the national critical information infrastructure you own or operate, notify the Chief Executive and your national critical information infrastructure sector lead within the period and in the manner prescribed (section 23(1)). The Act itself states no clock.
- A cyber security incident is an act or activity carried out on or through a computer or computer system, without lawful authority, that jeopardizes or adversely affects the cyber security of that computer or computer system or another one (section 4).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 23(2) makes contravening the notification duty an offence punishable on conviction with a fine not exceeding five hundred thousand ringgit, imprisonment for a term not exceeding ten years, or both.
Penalty structure
Section 23(2) sets a fine not exceeding five hundred thousand ringgit for an NCII entity that contravenes the duty to notify a cyber security incident; the same offence also carries imprisonment for a term not exceeding ten years.
- Rule
- Fixed only
- As of
- Currency
- MYR
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The Chief Executive of the National Cyber Security Agency, who may issue such directive as the Chief Executive considers necessary to ensure compliance with the Act under section 13(1).
Settledness
- As of
- Open questions
- What period and manner of notification apply, given that section 23(1) leaves both to be prescribed by regulations?
What this law does
Section 23(1) requires an NCII entity that learns that a cyber security incident has or might have occurred in respect of the infrastructure it owns or operates to notify the Chief Executive and its sector lead within the period and in the manner prescribed. Section 23(2) makes a contravention of section 23 an offence with a fine not exceeding five hundred thousand ringgit or imprisonment for a term not exceeding ten years or both.
Section 4 defines a cyber security incident as an act or activity carried out on or through a computer or computer system, without lawful authority, that jeopardizes or adversely affects the cyber security of that computer or computer system or another one.
Section 4 defines a national critical information infrastructure as a computer or computer system whose disruption or destruction would have a detrimental impact on the delivery of a service essential to the security, defence, foreign relations, economy, public health, public safety or public order of Malaysia. Section 4 defines an NCII entity as any Government Entity or person designated as a national critical information infrastructure entity under section 17 or 18.
Section 2 binds the Federal Government and State Governments, and renders neither liable to prosecution for an offence under the Act. The Prime Minister appointed as the date on which the Act comes into operation.
When LexLint raises it
When your app profile says your app runs an essential service.