Someone forwards you a news item about the new cyber law and asks, “Does this apply to us?” The honest answer is a short one, and it starts with a word most IT teams have never had to look up: designation.
Who the Act actually binds
The Cyber Security Act 2024 (Act 854) came into operation on 26 August 2024. Its heaviest duties land on a National Critical Information Infrastructure (NCII) entity. That is a government entity or a company that a sector lead has designated because it “owns or operates a national critical information infrastructure” (section 17).
The Act’s Schedule names eleven sectors: government, banking and finance, transportation, defence and national security, information, communication and digital, healthcare services, water, sewerage and waste management, energy, agriculture and plantation, trade, industry and economy, and science, technology and innovation. The Minister appoints a sector lead for each sector, and NACSA publishes the names on its website.
Operating in a listed sector does not make you an NCII entity. Designation does. If nobody has designated you, the NCII duties below do not apply to you directly. If you are not sure, ask your sector lead, and get the answer in writing.
What an NCII entity must do
| Duty | What the law says | Source |
|---|---|---|
| Follow the code of practice | Implement the measures, standards and processes in your sector’s code of practice | Act, s.21 |
| Assess risk | A cyber security risk assessment at least once a year | P.U. (A) 219/2024 |
| Be audited | An audit by an auditor approved by the Chief Executive, at least once every two years, or more often if directed | Act s.22, P.U. (A) 219/2024 |
| Submit reports | Send the assessment or audit report to the Chief Executive within 30 days of completing it | Act, s.22(2) |
| Notify incidents | Notify immediately, give particulars within six hours, supplementary information within fourteen days | Act s.23, P.U. (A) 220/2024 |
Two details are easy to miss. First, the Chief Executive of NACSA can order an extra assessment or audit, including after a material change to the design, configuration, security or operation of the infrastructure. Second, if you already meet security requirements under another law, section 21(4) treats you as compliant with the code-of-practice duty, provided those measures do not contravene the code.
The six-hour clock is the part to rehearse
The incident duty is wider than it sounds. It applies when an incident “has or might have occurred”, and the clock starts when the incident comes to the entity’s knowledge. The regulations require the authorised person to notify immediately by electronic means, then submit within six hours the details of the person, the entity, its sector and sector lead, and the type, severity, time of discovery and method of discovery of the incident. Within fourteen days of the notification they must add, as far as practicable, details such as the affected infrastructure, the estimated number of hosts and the threat actor.
NACSA’s FAQ points to an online incident report form and a CERT mailbox for reporting.
This is an IT problem, not a legal one. Six hours is not enough time to discover who is allowed to notify, or where the logs live. Practical preparation:
- Name the authorised person and a deputy now, in writing.
- Know which systems count as the designated infrastructure.
- Make sure you can answer “which hosts, which accounts, when” from logs you actually keep.
- Rehearse the notification with a fake incident.
What changes if you are not designated
Not much in law, quite a lot in practice. Customers and partners who are NCII entities have to flow requirements down to their suppliers, so expect security questionnaires that mirror the code of practice. The Act itself does not say how an NCII entity must treat its suppliers, so that pressure comes from contracts, not from the statute.
What changes if you sell security services
Part VI of the Act requires a licence to provide a prescribed cyber security service, and advertising yourself as a provider without one is an offence with a fine of up to RM500,000, up to ten years’ imprisonment, or both. The 2024 licensing regulations prescribe two services: managed security operation centre monitoring and penetration testing. They do not apply to government entities, to services between related companies, or to systems located outside Malaysia. If your IT team does either job for outside clients, check licensing before the next engagement.
Where Auris fits
Be sceptical of any product that claims to make you compliant with Act 854. The Act turns on designation, the code of practice for your sector, and audits by an approved auditor. A tool cannot supply any of those.
What a tool can do is reduce the exposed surface you will be asked about and produce evidence. SSHepherd® closes externally exposed listening ports on servers, so administrators and servers connect outbound to a broker, and it provides session monitoring and recording with a kill-switch. That is useful when an auditor or an incident review asks who reached which server and what they did. The SSHepherd page has the details, and the Linux SSH use case shows the typical setup.
The bottom line
Act 854 puts hard duties on designated NCII entities: follow the sector code, assess risk yearly, audit every two years, and notify incidents within six hours. If you are not designated, your exposure is mostly contractual, unless you sell penetration testing or managed SOC monitoring, in which case you need a licence. Find out your designation status first, then rehearse the six-hour clock.
This is general information, not legal advice.