Cyber Security Act 2024 (Act 854): what SMEs need to know
Not legal advice. This page is general education, written from public official sources linked below. It is not legal advice and may be out of date. For decisions about your business, check the official source or ask a Malaysian lawyer.
The Cyber Security Act 2024 (Act 854) came into operation on 26 August 2024 (NACSA). It is administered by the National Cyber Security Agency (NACSA). This page explains, in plain terms, what it means for a typical small business.
Who the Act is mainly about
Most of the Act's duties fall on national critical information infrastructure (NCII) entities, designated by sector leads in these sectors listed by NACSA:
- Government
- Banking and finance
- Transportation
- Defence and national security
- Information, communication and digital
- Healthcare services
- Water, sewerage and waste management
- Energy
- Agriculture and plantation
- Trade, industry and economy
- Science, technology and innovation
Sector leads were first appointed with effect from 11 September 2024 (NACSA). Being in one of these sectors does not by itself make a business an NCII entity; entities are designated. Most SMEs are not NCII entities.
Why it can still affect an SME
- You supply an NCII entity. Banks, hospitals, utilities and government agencies may pass security requirements down to suppliers in contracts and questionnaires.
- You hire a security provider. NACSA says the Act regulates cyber security service providers through licensing (NACSA). Before you hire someone for security services, ask whether the service needs a NACSA licence and check the NACSA licensing portal.
- You sell security services. Check the licensing rules with NACSA before you offer them.
What to do now
- Get the basics right; they are what supplier questionnaires ask about: MFA, updates, backups, email authentication. Start with our email check and website check.
- Write down how you would handle an incident, including who you would call. For scams, that is NSRC 997.
- If you handle personal data, follow the PDPA security checklist; that law applies to most businesses.
- Read the Act itself, linked from NACSA's page, if a customer says it applies to your contract.
FAQ
Does the Cyber Security Act 2024 apply to my small business?
Its main duties apply to designated NCII entities. Most SMEs are not designated, but customers that are may pass requirements to you by contract.
When did Act 854 come into force?
26 August 2024, according to NACSA.
Is a free online security check a penetration test?
No. A passive check like ours only reads public DNS records and one normal web response. It is not a penetration test.