Cyber Security Act 2024 Malaysia: The NACSA Compliance Guide

Last updated: 6 November 2026

Malaysia's Cyber Security Act 2024, known as Act 854, was gazetted on 26 June 2024 and came into force on 26 August 2024. It places legal duties on organisations that run the country's most critical systems. It also requires a NACSA licence for certain cyber security service providers. If your business operates critical infrastructure or sells these services, the Act very likely applies to you.

This guide explains what the Act requires in 2026. It covers who counts as critical infrastructure, the incident-reporting timeline, licensing for service providers, penalties and how to approach compliance. It is written for boards, IT and security leaders, compliance teams and service providers in Malaysia.

What is the Cyber Security Act 2024?

The Act is Malaysia's primary legislation for national cyber security. It is administered by the National Cyber Security Agency (NACSA), whose Chief Executive holds the main enforcement powers. It also sets up a National Cyber Security Committee chaired by the Prime Minister to guide national policy.

Four sets of regulations give the Act its operational detail. They cover incident notification, the period for risk assessment and audit, compounding of offences, and licensing of cyber security service providers. All came into force on 26 August 2024.

The Act also has extraterritorial reach. It can apply to offences committed outside Malaysia where they involve national critical information infrastructure located wholly or partly in Malaysia.

Who must comply?

The Act applies to two groups. You may fall into one or both.

National Critical Information Infrastructure (NCII) entities

NCII means a computer or computer system whose disruption would seriously harm national security, defence, foreign relations, the economy, public health, public safety or public order. The Act groups NCII into eleven sectors: government; banking and finance; transportation; defence and national security; information, communication and digital; healthcare services; water, sewerage and waste management; energy; agriculture and plantation; trade, industry and economy; and science, technology and innovation.

If your organisation holds a Malaysian Communications and Multimedia Commission (MCMC) licence, read this alongside our MCMC compliance guide.

The Minister appoints a sector lead for each sector, on the recommendation of the NACSA Chief Executive. A sector lead can then designate a government entity or organisation in its sector as an NCII entity. Once you are formally designated, the duties below apply to you directly.

Cyber security service providers

The second group is anyone who provides a licensable cyber security service in Malaysia. These providers must hold a NACSA licence, whether or not they are NCII entities themselves.

What NCII entities must do

Designation triggers a defined set of duties.

Baseline self-assessment

After designation, an NCII entity must complete the National Cyber Security Baseline (NCSB) self-assessment within two weeks. The NCSB is set out in a NACSA directive and lists minimum cyber security controls. It is the starting blueprint for the entity.

Annual risk assessment and biennial audit

An NCII entity must carry out a cyber security risk assessment at least once a year. It must also complete a cyber security audit at least once every two years. The NACSA Chief Executive can direct an audit more often. These are recurring, evidenced exercises, not one-off tasks.

Codes of practice

NCII entities must comply with the codes of practice that apply to their sector. Failing to implement an applicable code is an offence under the Act.

The incident-reporting clock

This duty most often catches organisations out. It runs on hours, not days, and it starts when the incident comes to your knowledge, before you know how serious it is. The timeline has three steps.

Immediately: your authorised person notifies the NACSA Chief Executive and your sector lead that an incident has or may have occurred.

Within six hours of becoming aware: the same person submits the first report through the National Cyber Coordination and Command Centre System. It covers the nature and seriousness of the incident, the date and time you became aware, and how it was discovered.

Within 14 days after the immediate notification: a supplementary report follows with further information about the incident.

You cannot report inside six hours if you cannot detect and understand an incident inside six hours. The clock rewards organisations with real detection and response capability.

Licensing for cyber security service providers

The Act introduces a licensing regime for cyber security service providers. It currently covers two services: managed security operations centre (SOC) monitoring, and penetration testing. The licensing portal opened on 1 October 2024.

Licensed providers must keep records of each engagement and retain them for at least six years. The regime does not apply to Government Entities, to services provided between related companies, or to systems outside Malaysia. A separate exemption order, in effect since 1 February 2025, exempts certain named cloud service companies from parts of the regime. It does not exempt government bodies.

For buyers of penetration testing or managed SOC services in Malaysia, this changes procurement. You should ask providers to show their NACSA licence before you engage them. For how penetration testing is scoped and priced, see our penetration testing guide for Malaysia.

Penalties

Failing to implement a code of practice, failing to notify an incident, or providing a licensable service without a licence can each carry a fine of up to RM500,000, imprisonment of up to ten years, or both. Providers can also face licence suspension or revocation. Lesser offences can be compounded under the compounding regulations. For a critical infrastructure operator, the reputational cost of a public finding can be as damaging as the fine.

How to approach compliance

For a designated NCII entity, start with the clock you cannot control. Designate your authorised persons, rehearse reporting through the national system, and confirm your detection can surface an incident within six hours. In parallel, complete the NCSB self-assessment, put the annual risk assessment and biennial audit in your calendar, and map your controls to your sector's code of practice.

For a service provider, confirm your licensing position for the two services and set up six-year record-keeping.

Financial institutions should note that Bank Negara Malaysia's RMiT policy says NCII-designated institutions must also comply with the NCII requirements. Read this guide alongside our BNM RMiT compliance guide.

Where a managed security partner fits

Several duties in the Act depend on security operations capability. The six-hour report is only achievable if you can detect and understand an incident within hours. That is what a managed detection and response and security operations centre service is built to support.

Regular vulnerability assessment and penetration testing helps you find weaknesses before an incident does. Threat intelligence adds early warning of threats to your environment. A structured security services programme can help you plan the annual risk assessment and audit.

Primary Guard supports organisations in Malaysia, Indonesia and Thailand with these capabilities. If you want to benchmark your readiness against the Act's timelines, contact us to discuss a security posture assessment.

Key takeaway

The Act makes cyber security a legal duty for Malaysia's critical infrastructure and for the providers that serve it. The six-hour incident-reporting clock is the duty most likely to test you. Treat compliance as an operational readiness programme built on fast detection and rehearsed reporting, not a paperwork exercise.

Sources: Cyber Security Act 2024 (Act 854), NACSA | Regulations, directives and exemption order, NACSA legislation page | BNM RMiT policy, Sep 2026

This article is for general information and is not legal advice. Refer to the Cyber Security Act 2024 and its regulations, and consult qualified advisers on your specific obligations.