MalaysiaCyber Security Act, National Critical Information Infrastructure Entities, Code of Practice, Risk Assessment and Audit
Cyber Security Act 2024 (Act 854), ss. 17, 20 to 22 and 24
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://lom.agc.gov.my/ilims/upload/portal/akta/outputaktap/2177706_BI/Act%20854.pdfIn force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- This binds a national critical information infrastructure (NCII) entity, meaning a Government Entity or person that a national critical information infrastructure sector lead designates under section 17, or the Chief Executive of the National Cyber Security Agency designates under section 18, because it owns or operates a national critical information infrastructure (reached by declaring that you operate an essential service).
- Implement the measures, standards and processes specified in the code of practice to ensure the cyber security of the national critical information infrastructure you own or operate, or alternative measures that you prove to the Chief Executive's satisfaction give equal or higher protection (section 21(1) and (2)).
- Within the prescribed period, conduct a cyber security risk assessment of that infrastructure in accordance with the code of practice and the Chief Executive's directive, and cause an audit by an auditor the Chief Executive approves to be carried out, then submit the assessment or audit report to the Chief Executive within thirty days after completing it (section 22(1) and (2)).
- Follow the Chief Executive's directions to re-evaluate the cyber security risk, rectify an insufficient audit report, or carry out a further assessment or audit (section 22(3) to (6)).
- Comply with your sector lead's request for information about the infrastructure you own or operate, give it the same information for any additional computer or computer system you consider to be national critical information infrastructure, and notify it of a material change to the design, configuration, security or operation of the infrastructure within thirty days from the date the change was completed (section 20(1) to (3)).
- Notify your sector lead in writing without delay if you consider that a computer or computer system you own or operate has ceased to be national critical information infrastructure, or you no longer own or operate any (section 17(6)).
- Follow the Chief Executive's directions for a cyber security exercise (section 24(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 21(5) makes failing to implement the code of practice an offence punishable on conviction with a fine not exceeding five hundred thousand ringgit, imprisonment for a term not exceeding ten years, or both.
Penalty structure
Section 21(5) sets a fine not exceeding five hundred thousand ringgit, alongside imprisonment for a term not exceeding ten years, for an NCII entity that fails to implement the code of practice. The other offences in this row carry lower ceilings.
- Rule
- Fixed only
- As of
- Currency
- MYR
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The Chief Executive of the National Cyber Security Agency, who may issue such directive as the Chief Executive considers necessary to ensure compliance with the Act under section 13(1).
Settledness
- As of
- Open questions
- Which periods for the risk assessment and the audit apply, given that section 22(1) leaves the period to be prescribed by regulations?
What this law does
Section 17(1) allows a national critical information infrastructure sector lead to designate a Government Entity or person as a national critical information infrastructure entity if it is satisfied that the entity owns or operates a national critical information infrastructure. Section 21(1) requires an NCII entity to implement the measures, standards and processes specified in the code of practice to ensure the cyber security of the infrastructure it owns or operates.
Section 21(5) makes a contravention of section 21(1) an offence with a fine not exceeding five hundred thousand ringgit or imprisonment for a term not exceeding ten years or both. Section 22(1) requires an NCII entity, within the period prescribed, to conduct a cyber security risk assessment and to cause an audit to be carried out by an auditor the Chief Executive approves, and section 22(2) requires it to submit the report to the Chief Executive within thirty days after completion.
Section 22(7) makes a contravention of section 22(1) or (2) an offence with a fine not exceeding two hundred thousand ringgit or imprisonment for a term not exceeding three years or both. Section 20(1) requires an NCII entity to comply with a request of its sector lead to provide information about the infrastructure it owns or operates.
Section 20(3) requires an NCII entity to notify its sector lead of a material change to the design, configuration, security or operation of the infrastructure within thirty days from the date the change was completed. Section 24(3) allows the Chief Executive to give directions to an NCII entity for a cyber security exercise, and section 24(4) makes a failure to comply an offence with a fine not exceeding one hundred thousand ringgit.
Section 25(1) requires a national critical information infrastructure sector lead to prepare a code of practice, to be endorsed by the Chief Executive, containing measures, standards and processes to ensure the cyber security of the infrastructure in its sector. Section 13(1) allows the Chief Executive to issue a directive considered necessary to ensure compliance with the Act.
Section 2 binds the Federal Government and State Governments, and renders neither liable to prosecution for an offence under the Act. The Prime Minister appointed as the date on which the Act comes into operation. The Act received Royal Assent on and was published in the Gazette on .
When LexLint raises it
When your app profile says your app runs an essential service.