The Cyber Security Act 2024 turned cyber compliance from a business decision into a legal requirement for many Malaysian organisations. If you run systems that the country depends on, this law now applies directly to you.
These organisations are called National Critical Information Infrastructure entities. The law covers eleven sectors:
Government
Banking and finance
Transportation
Defence and national security
Information, communication and digital
Healthcare services
Water, sewerage and waste management
Energy
Agriculture and plantation
Trade, industry and economy
Science, technology and innovation
Once designated, you must follow your sector’s Code of Practice, conduct a commercial risk assessment, and complete an independent audit at least once every two years. Serious breaches can cost up to RM 500,000 in fines, and directors or officers may face up to ten years in prison. Investigations can also disrupt day-to-day operations.
The law took effect on 26 August 2024. Sector leads have already started designating entities and reviewing readiness. You can no longer schedule this for later. It is now part of how critical systems must be run in Malaysia.
Mandatory Licensing for Cybersecurity Service Providers
Act 854 brought in a licensing rule for certain cybersecurity service providers. This changes how NCII entities choose vendors for specific work.
The NACSA Mandate:
Act 854, read together with the Cyber Security (Licensing of Cyber Security Service Provider) Regulations 2024, requires a licence from the National Cyber Security Agency for two specific services: managed SOC monitoring and penetration testing. If a company wants to sell or advertise these services in Malaysia, it must hold a valid NACSA licence. The licence is valid for one year.
If you are an NCII entity and need either of these services, you must use a licensed provider. The Code of Practice is clear on this. When regulators check your compliance work, they look at whether the vendor holds a proper licence.
Risks of Unlicensed Vendors:
Using an unlicensed firm creates a lot of problems.
The test results or monitoring reports may not be accepted.
You stay responsible for the choice of vendor.
You can still fail the compliance check even if the technical work looked fine.
Unlicensed firms are not under the same ongoing checks that licensed ones face.
The licensing process simply confirms the firm has the right people and certifications. Without it, the work sits outside the legal framework. That gap becomes your problem later.
Why Qualysec for Act 854 Testing Work
Qualysec comes with the credentials and practical approach many Malaysian organisations look for when they need penetration testing as part of their risk assessment or compliance preparation:
Specialises in thorough VAPT across web apps, mobile, APIs, cloud and related systems
Reports written so they can sit directly with your other Act 854 evidence
Explains findings in plain language and supports retesting after you fix the issues
Keep the CREST credentials and the full test reports on file. Auditors and sector leads look for this kind of supporting evidence when they review your security testing work.
Secure Your Business with a Expert-Led Security Assessment
Partner with certified security specialists to identify, prioritize, and remediate real-world risks across your systems.
The Cost of Non-Compliance: Fines and Legal Penalties
Act 854 sets out clear financial and personal penalties for NCII entities that fail to meet their duties.
Financial Penalties Under Act 854:
The highest fine is RM 500,000. This applies to serious breaches such as failing to implement the sector code of practice or failing to notify a cyber security incident. Imprisonment of up to ten years can also be imposed, or both fine and imprisonment.
Other common breaches carry lower maximums. Failing to conduct or submit the required risk assessment or audit can attract a fine of up to RM 200,000 or imprisonment of up to three years, or both.
Summary of the main maximum penalties:
Obligation breached
Maximum fine
Maximum imprisonment
Failure to implement code of practice
RM 500,000
10 years
Failure to notify cyber security incident
RM 500,000
10 years
Failure to conduct or submit risk assessment/audit
RM 200,000
3 years
Providing prescribed cyber security services without licence
RM 500,000
10 years
Some of these offences can be compounded (settled by paying a reduced amount) with the Public Prosecutor’s consent. Even so, the headline figures show why boards take the obligations seriously.
Operational and Business Consequences:
The fine is only part of the problem.
Regulators can investigate and that can slow or stop systems while they check.
Business partners often ask for proof of compliance before they keep working with you.
News of a failure can hurt customer trust.
Cyber insurance may refuse to pay if the company knowingly broke the law.
Personal Liability for Directors:
Section 58 of the Act lets directors, compliance officers and similar managers be charged together with the company. If the company is found guilty, those people can face the same penalties unless they can show the offence was committed without their knowledge, or without their consent or connivance and that they took all reasonable precautions and exercised due diligence to prevent it.
This personal risk changes how many boards look at the issue. Compliance is no longer just a company cost. It can affect the people in charge.
Core Compliance Requirements for NCII Entities
Act 854 sets clear duties for every NCII entity across the eleven sectors.
Key Timelines:
Requirement
How often / when
Who does it
Cyber security risk assessment
At least once a year
The NCII entity
Submit risk assessment report
Within 30 days of finishing it
The NCII entity
Independent audit
At least once every two years
Auditor approved by NACSA
First incident notification
Immediate electronic notice + prescribed particulars within 6 hours of it coming to the knowledge of the NCII entity
Authorised person of the NCII entity
Regular Cyber Risk Assessments:
You must run a cyber security risk assessment at least once a year. The assessment must follow your sector’s Code of Practice and any directives from NACSA or the sector lead. It looks at the risks to the systems you own or operate.
After you finish the assessment, send the report to the Chief Executive within 30 days. You also need an independent Cyber Security Act 2024 compliance audit by an auditor approved by NACSA at least once every two years. This audit checks that you are meeting the Act.
You must also provide information about your NCII systems when the sector lead asks for it, and notify them of any material changes or new systems that qualify as NCII.
Keep the reports, findings, and proof of any fixes. Regulators will ask for them.
Data Breach Notification Requirements:
When a cyber security incident happens (or might have happened) on your NCII systems, notify NACSA and your sector lead right away. An immediate electronic notification is required as soon as the incident comes to the knowledge of the NCII entity, followed by the prescribed particulars within six hours. Later you send the fuller details required by the regulations.
Keep a clear log of every notification. This log is part of your compliance evidence.
Note: Notifying affected individuals sits under the Personal Data Protection Act if personal data is involved.
Incident Response and Reporting:
Have practical steps ready so your team knows what to do when something goes wrong. Your sector’s Code of Practice will set out the expected details. Test those steps so people know the reporting path and who to call. Delays during a real incident create extra problems.
Human-Led Penetration Testing:
The Act itself does not force annual human-led penetration testing. Your sector’s Code of Practice may require or recommend it. If you hire a provider for penetration testing or managed SOC monitoring, that provider must hold a valid NACSA licence. Human-led testing finds issues that automated scans often miss.
Business Continuity and Disaster Recovery:
Your sector’s Code of Practice will normally require plans so critical services can continue or recover after an attack. Regular testing of backups and recovery steps is expected. Keep the plans documented and make sure the right people know their roles.
Staff Training and Awareness:
Most sector Codes of Practice require regular cybersecurity awareness training for staff. Training usually covers basic threat awareness, how to report incidents, and the role each person plays. Keep records of who completed the training and when.
Record Retention and Documentation:
You must keep clear records that show you are meeting the Act. These include:
Keep the records safe, easy to find, and available when regulators ask for them.
The Qualysec Solution:
When you need technical testing to support your annual risk assessment, Qualysec offers CREST-accredited penetration testing and clear VAPT reports that can sit directly with your other Act 854 records. They also walk your team through the findings and can retest after fixes.
Vendor Selection Checklist for Act 854 Audits
Choosing the wrong vendor can put your compliance at risk under the current cybersecurity laws in Malaysia. Use this simple checklist when you select a provider for testing or related work under Act 854.
Legal Standing:
If the vendor will do penetration testing or managed SOC monitoring, they must hold a valid NACSA licence for that service.
Check these points:
Confirm the licence is active on the official NACSA portal (do not rely only on the vendor’s claim)
Check the licence has not been suspended or revoked
Ask for proof of the licence number and expiry date
Prefer vendors who already work with Malaysian organisations in your sector
This quick check takes only a few minutes and avoids later problems.
Technical Accreditations:
Look for globally recognised standards that show the quality of the testing.
Priority credentials:
Current CREST accreditation for penetration testing
Current ISO 27001 certification
Relevant individual certifications held by the testers (for example OSCP, CREST certifications, or similar)
Clear experience testing systems for organisations in Malaysia or similar regulated environments
Understanding of the specific requirements that apply to NCII entities
CREST accreditation shows the firm meets international standards for penetration testing. ISO 27001 shows they manage their own information security properly.
Remediation Capabilities:
Choose a vendor that stays independent.
Prefer vendors who focus on testing and give clear, unbiased findings
Avoid vendors who push their own products or services as the only fix
Check whether they will explain the findings to your team in plain language
Ask if they offer retesting after you fix the issues
Confirm they will help you document the results so the reports can sit with your other Act 854 evidence
Good post-test support makes the difference between a report you can use and a report that just creates more work.
Qualysec holds current CREST accreditation and ISO 27001 certification. Their reports are structured so they work as supporting evidence for risk assessments and audits.
Prepare for Your Next Cybersecurity Audit with Qualysec
Choose a partner that helps you identify and fix real security risks before attackers do. We are here to help.
The Cyber Security Act 2024 has made compliance a legal requirement for NCII entities across the eleven sectors. It is no longer just good practice. Non-compliance can bring fines of up to RM 500,000, possible jail time, and personal risk for directors.
The main duties are clear. Follow your sector’s Code of Practice. Run a cyber security risk assessment at least once a year and submit the report on time. Complete an independent audit by an approved auditor at least once every two years. Notify NACSA and your sector lead of any cyber security incident immediately (with the prescribed particulars within six hours of it coming to the knowledge of the NCII entity). Keep proper records of everything you do.
If you need penetration testing or managed SOC monitoring, use a provider that holds a valid licence for that service. Most sector Codes of Practice also expect staff awareness training and workable business continuity plans.
Next steps you can take now:
Check whether you have been designated as an NCII entity
Confirm your incident notification process can meet the six-hour rule
Get your key documentation in order
Taking these steps early keeps you ahead of problems and protects both the organisation and the people responsible for it
Frequently Asked Questions
1. What qualifies an organization as an NCII entity under Act 854?
An organisation is designated as an NCII entity by the sector lead or NACSA Chief Executive if it owns or operates systems whose disruption would seriously affect essential services in one of the eleven critical sectors under the cyber security act Malaysia.
2. What are the maximum financial fines for failing an Act 854 compliance audit?
The highest fine is RM 500,000 (plus up to 10 years’ imprisonment) for serious breaches such as failing the code of practice or incident notification. Other failures carry lower maximums, for example, RM 200,000.
3. Can corporate directors be held personally liable for company data breaches under the new law?
Yes. Under Section 58, directors and similar officers can face the same penalties as the company unless they prove the offence was committed without their knowledge, or without their consent or connivance, and that they took all reasonable precautions and exercised due diligence to prevent it.
4. Does an existing ISO 27001 certification automatically guarantee Act 854 compliance?
No. ISO 27001 helps but does not meet Act 854 duties. You still need to follow your sector’s Code of Practice, conduct the required assessments and audits, and meet notification rules.
5. How has the Cyber Security Act 2024 changed the process for selecting VAPT vendors in Malaysia?
Providers of penetration testing or managed SOC monitoring must hold a valid NACSA licence. Always verify the licence yourself on the official NACSA portal rather than relying only on the vendor’s claim.
About Piyush Bhuyan
Pabitra Kumar Sahoo is the Co-Founder and Chief Operating Officer (COO) at Qualysec. With a deep commitment to elevating global cybersecurity standards, he directs corporate operations and service strategy, helping enterprises mitigate compliance debt and defend their digital infrastructure through elite, human-led penetration testing.
