Legislation Updates

Cyber Security Act 2024

Share:

Print
26 August 2024

Act 854: Cyber Security Act 2024 comes into operation on 26 August 2024.

An Act to enhance the national cyber security by providing for the establishment of the National Cyber Security Committee, duties and powers of the Chief Executive of the National Cyber Security Agency, functions and duties of the national critical information infrastructure sector leads and national critical information infrastructure entities and the management of cyber security threats and cyber security incidents to national critical information infrastructures, to regulate the cyber security service providers through licensing, and to provide for related matters.

To clarify and set out the specific requirements in relation to some of the obligations imposed by the Act, four (4) Regulations under the Act has been gazetted.

These Regulations and their Key Takeaways are as below:

1. Cyber Security (Period for Cyber Security Risk Assessment and Audit) Regulations 2024
National Critical Information Infrastructure (“NCII”) entities must conduct a cyber security risk assessment at least once a year and carry out an audit at least once in every two years or at such higher frequency as may be directed by the Chief Executive of the National Cyber Security Agency.
Click Here for more details.

2. Cyber Security (Notification of Cyber Security Incident) Regulations 2024
An authorized person of a NCII entity must promptly notify the relevant authority of a cyber security incident by electronic means. Within six hours, they must provide key details about the incident, including the entity's particulars, the sector involved, and the incident's type, severity, and discovery method. Within fourteen days, further details such as affected infrastructure, threat actors, and the incident's impact must be submitted. Ongoing updates may be required, and all information must be submitted through the designated system or an alternative if disrupted.
Click Here for more details.

3. Cyber Security (Licensing of Cyber Security Service Provider) Regulations 2024
Managed security operation center monitoring services and penetration testing services are to obtain a license under the Act. These services involve monitoring cyber security, identifying threats, testing vulnerabilities, and recommending mitigation measures. However, licensing is not required if the service is provided by a government entity, by a person, other than a company, to its related company, or if the computer system is located outside Malaysia. Applications for licenses must be submitted electronically to the Chief Executive of the National Cyber Security Agency and shall be accompanied by payment of the fee as prescribed in the Regulation.
Click Here for more details.

4. Cyber Security (Compounding of Offences) Regulations 2024
There are six (6) offences under the Act which are prescribed as compoundable offences. These are:
 - subsection 20(6)
 - ⁠subsection 20(7)
 - ⁠subsection 22(7)
 - ⁠subsection 22(8)
 - ⁠subsection 24(4)
 - ⁠subsection 32(3)
Click Here for more details.

Click here for the Cyber Security Act 2024.