Cyber Security Act 2024 (Act 854): Does It Apply to Your Business?

Malaysia's Cyber Security Act 2024 (Act 854) came into force on 26 August 2024, and it's a common source of confusion for businesses trying to work out whether it actually applies to them. It runs two separate tracks: obligations on entities designated as National Critical Information Infrastructure, and a licensing requirement for companies that provide certain cyber security services, regardless of who their client is.

What Act 854 actually is

The Act introduces the concept of National Critical Information Infrastructure (NCII) — a computer or system that, if disrupted, would harm key national or government functions, public safety, or public order. It applies across 11 defined sectors: Government, Banking and Finance, Transportation, Defence, Healthcare, Energy, Water, Agriculture, Trade, Science & Technology, and Information/Communication.

Who counts as NCII

Not every business in those 11 sectors is automatically designated — NCII status is a specific designation confirmed by the relevant sector authority, not a blanket industry rule. Port and terminal operators are one example within the Transportation sector where designation is a live question given the operational stakes involved; the same applies to banks, utilities, and healthcare providers running systems that genuinely underpin critical services. Designation status should be confirmed, not assumed either way.

The separate licensing track: cyber security service providers

Anyone who advertises or holds themselves out as a cyber security service provider needs a licence under the Cyber Security (Licensing of Cyber Security Service Provider) Regulations 2024 — currently covering two specific licensed service categories, including managed security operations centre (SOC) monitoring. This applies to the provider directly, independent of whether their client is NCII-designated. If your organisation is NCII-designated, the practical implication is upstream: confirming that any security service provider you engage for a licensed service category actually holds that licence, rather than assuming a supplier automatically inherits Act 854 duties simply by being connected to a critical system. A vendor that isn't itself providing a licensed service and isn't NCII-designated doesn't take on statutory Act 854 obligations by association — though an NCII client may still impose its own security requirements through contract as part of meeting its own duties.

What NCII status requires in practice

Designated entities must run a cyber security risk assessment at least annually and an audit at least once every two years, against a sector-specific code of practice that each NCII Sector Lead develops for its own sector, plus formal incident reporting. Those sector codes of practice are typically where operational specifics — like separating operational technology (the systems actually running physical operations) from standard office IT — actually get spelled out, rather than the Act itself naming that requirement directly. Confirm your sector's actual code of practice rather than assuming the same technical controls apply everywhere.

What happens if you don't report an incident

Failing to report a cybersecurity incident under the Act carries real consequences — a fine of up to RM500,000, imprisonment of up to 10 years, or both, per current guidance. Confirm the current figure and exact scope against the Act and your own counsel before relying on it — this is a summary, not legal advice.

How to find out if you're in scope

NCII designation is confirmed by the relevant sector authority, not self-assessed, and the licensed-service-provider track is a separate question from NCII status entirely. If you operate in one of the 11 sectors, supply into one, or provide services like SOC monitoring, it's worth confirming your actual status on both tracks rather than assuming either way — and building network segmentation and incident reporting capability that would hold up under the Act regardless of formal designation, since the underlying risk doesn't disappear just because the paperwork hasn't caught up.

Source: Cyber Security Act 2024 (Act 854), National Cyber Security Agency (NACSA).