Malaysia’s Cyber Security Act has set firm duties for critical infrastructure. The next test is whether organisations can turn those duties into fast, practised action.

WHEN the next cyber incident disrupts a hospital, payment system, water operator or transport network, the public will not ask whether the organisation had completed a compliance spreadsheet. People will ask whether services were restored, damage was contained and the authorities were informed in time.

That is the practical test facing Malaysia after the Cyber Security Act 2024 (Act 854) came into force on Aug 26, 2024. The law gives the country a clearer structure for protecting National Critical Information Infrastructure (NCII) — the systems whose disruption could harm national security, economic stability, public health, safety or the government’s ability to function.

Its reach covers 11 sectors: government; banking and finance; transportation; defence and national security; information, communication and digital services; healthcare; water, sewerage and waste management; energy; agriculture and plantation; trade, industry and economy; and science, technology and innovation.

The framework is significant. Yet legislation alone cannot defend a network. Its strength will be measured by what happens inside organisations at 2am, when an alert appears and staff must decide whether it is an incident, who has authority to act and how quickly accurate information can reach the right agencies.

The most demanding feature is the incident-notification timetable. An NCII entity must notify the chief executive of the National Cyber Security Agency (Nacsa) and its sector lead immediately after an incident has, or might have, come to its knowledge. Specified initial details must follow within six hours. Supplementary information is due, as far as practicable, within 14 days.

This is more than a reporting rule. It requires a clear internal chain from technical detection to management decision-making. Security teams need agreed thresholds, an authorised reporting officer, current contact details and a short process for obtaining legal and operational input without losing hours in internal debate.

A six-hour requirement cannot be met through a document that no one has rehearsed. Organisations should test it through exercises involving technology, legal, communications, operations and senior management. The exercise should begin with an incomplete alert, since that is how real incidents usually arrive.

Act 854 requires NCII entities to conduct a cybersecurity risk assessment at least once a year and an audit at least once every two years, or more often if directed. Reports must be submitted within 30 days of completion. These duties place cybersecurity within organisational governance, not solely within the information technology unit.

Boards and senior leaders need a clear view of the systems that support critical services, the risks that remain after controls are applied, and the resources required to close gaps. They should ask whether recovery plans have been tested, whether backup systems are isolated and usable, and whether the organisation can continue its most important services during an attack.

The penalties reinforce the seriousness of these duties. Failure to implement an applicable code of practice, or to notify a qualifying incident, can attract a fine of up to RM500,000, imprisonment for up to 10 years, or both. Failure to conduct the required assessment or audit, or to submit the report, can attract a fine of up to RM200,000, imprisonment for up to three years, or both.

The better reason to act, though, is operational continuity. A penalty arrives after a failure. A well-prepared response can limit the failure itself.

Few critical services operate within one organisation’s walls. Cloud providers, software companies, telecommunications partners, maintenance contractors and managed security teams may hold the first evidence that something has gone wrong.

NCII entities should identify which suppliers can affect critical operations and write rapid notification, evidence preservation and incident-support duties into their contracts. Contact paths should be tested. Access granted to vendors should be limited, monitored and removed when no longer needed.

Licensing checks require precision. Under the 2024 regulations, the licensing regime applies to managed security operations centre monitoring and penetration-testing services, subject to stated exceptions. Procurement teams should verify the status and scope of a provider’s licence rather than assuming that a general security credential is sufficient.

NCII entities may already answer to sector regulators and to laws such as the Personal Data Protection Act. Treating each requirement as a separate project creates repeated audits, duplicated evidence and staff fatigue.

The answer is a single control map showing how each security measure meets the Nacsa code of practice, sector rules and other legal duties. Act 854 permits alternative measures that provide equal or higher protection to the satisfaction of the chief executive. It also recognises measures implemented under other written laws, provided they do not conflict with the applicable code of practice.

This gives organisations room to build one coherent system rather than several disconnected compliance programmes. Common evidence — asset inventories, access reviews, test results, incident records and recovery exercises — can support several obligations when it is current and reliable.

The immediate agenda is practical. Each organisation should confirm its NCII designation and sector lead, identify the systems within scope, assign executive accountability, map its controls against the applicable code, test the six-hour reporting process and review critical suppliers. Risk assessments and audits should sit on the corporate calendar with named owners and budgets.

Nacsa and sector leads have a matching role: keep guidance accessible, communicate changes clearly and promote consistent expectations across sectors. Smaller entities and suppliers will need usable templates, exercises and access to qualified professionals, not only legal language.

Malaysia now has a statutory foundation for protecting the digital systems on which daily life relies. The next stage is to make compliance visible in real decisions: faster escalation, clearer ownership, tested recovery and honest reporting.

The strongest evidence of success will not be a certificate on a wall. It will be a critical service that continues, or recovers quickly, when an attack occurs.

The views expressed are the writer’s own. This article provides general information and does not constitute legal advice.