Cyber Security Act 2024: Does It Apply to Your Website?

1. What Is the Cyber Security Act 2024?

Quick Answer: The Cyber Security Act 2024 (Act 854) is Malaysia’s law for protecting National Critical Information Infrastructure. It was gazetted on 26 June 2024 and came into force on 26 August 2024. It is enforced by NACSA, the National Cyber Security Agency, and it also licenses certain cyber security service providers.

According to NACSA’s Act 854 page, the Act sets up the National Cyber Security Committee, the powers of NACSA’s Chief Executive, and duties for NCII sector leads and NCII entities. In plain terms, it does three things:

• Protects critical systems. Entities designated as NCII must follow codes of practice, assess risk, get audited and report incidents.
• Creates a reporting chain. Incidents flow from the NCII entity to its sector lead and NACSA.
• Licenses two security services. Managed security operation centre (SOC) monitoring and penetration testing need a NACSA licence.

Notice what is missing: there is no general rule that every business website must meet a security standard. That job still sits mostly with the PDPA, which our guide to PDPA security for web systems covers in detail.

2. Which Sectors Count as NCII in Malaysia?

Quick Answer: NACSA lists 11 NCII sectors, from government and banking to energy, healthcare services and trade. Being in a sector is not enough. A business only takes on Act 854 duties when its sector lead designates it as an NCII entity because it owns or operates a critical system.

The NACSA NCII page defines NCII as systems whose disruption would affect national defence, the economy, public health and safety or the Government’s ability to function. The table shows how an SME usually meets each sector: as a supplier, not the designated entity.

NACSA does not publish a list of designated companies, so you usually hear it from your client or sector lead. If your online store only accepts card payments through a gateway, your card-data duties come from your acquirer, not Act 854; see our guide to PCI DSS for small online stores.

3. Does the Cyber Security Act 2024 Apply to Small Businesses?

Quick Answer: Rarely in a direct way. A normal SME with a company website, lead forms and ads is not an NCII entity and is not a licensed provider, so Act 854 imposes no direct duty on its site. The Act reaches SMEs indirectly, through NCII clients’ contracts and through the security vendors they hire.

The bar table scores common situations by how directly Act 854 touches them. It is illustrative, not a legal ruling.

The middle row is where most SMEs feel the Act, as NCII entities push security clauses down to vendors. Expect questions on admin access, hosting, backups, incident reporting and whether your CRM sits overseas; our guide to cross-border data transfer and overseas CRMs helps with that answer.

4. What Must NCII Entities Do Under the Act?

Quick Answer: NCII entities must follow their sector’s code of practice, run a cyber security risk assessment at least once a year, be audited at least once every two years, and report incidents to NACSA and their sector lead: immediately, with details within six hours and a full report within 14 days.

These timelines come from the regulations made under the Act, listed on NACSA’s legal page, which took effect with the Act on 26 August 2024. These are the clocks behind an NCII client’s questions to you.

A six-hour clock is short. A supplier who needs three days to work out who has admin access to its own site is a risk the client may drop. If personal data is involved, a separate PDPA clock also applies, covered in our guide to data breach notification steps in Malaysia.

5. Does Your Web Agency or Pen Tester Need a NACSA Licence?

Quick Answer: Only if they sell managed SOC monitoring or penetration testing. Those two services need a NACSA licence; applications opened on 1 October 2024 through licence.nacsa.gov.my. Normal web design, hosting setup, plugin updates and SEO are not licensed services under the Act.

NACSA’s licensing page covers both companies and individuals. Providers had a grace period to the end of 2024, so from 2025 offering these services unlicensed risks prosecution. This matters when you buy security work:

• “Security audit” quotes. If the scope includes a penetration test of your site or web app, ask for the vendor’s NACSA licence details before you sign.
• Bundled maintenance plans. Updates, backups and malware scans are routine maintenance. A plan that promises 24/7 SOC monitoring is a licensed service.
• Freelancers. An individual selling pen tests also needs a licence. Hiring an unlicensed one puts your NCII client’s audit trail at risk.

For what routine care looks like and costs, see our guide to website maintenance in Malaysia. If your site has already been compromised, start with our steps to clean malware from a hacked website.

6. Cyber Security Act vs PDPA: Which Law Covers Your Website?

Quick Answer: For a normal business website, the Personal Data Protection Act 2010 is the law that matters. It applies to anyone collecting personal data in commercial transactions, including lead forms, WhatsApp chats and tracking. The Cyber Security Act 2024 adds duties only if you are an NCII entity or a licensed provider.

Both laws talk about “security” and “incidents”, so they are often mixed up. Here is where each one bites for a marketing website.

Guidance from the Personal Data Protection Commissioner is where your website obligations really sit. Pay attention to the higher-risk areas:

• Sensitive data in forms. Health, religion or financial fields carry extra rules; see sensitive personal data in lead forms.
• Tracking tools. Heatmaps can capture typed data; see heatmaps and session recordings under PDPA.
• Customer requests. People can now ask for their data in a usable format; see data portability and your CRM.

7. Website Security Checklist for SMEs Supplying NCII Clients

Quick Answer: List everyone with admin access, turn on two-factor login, keep the CMS and plugins updated, run daily off-site backups, keep activity logs, know where your data is hosted, and write a one-page incident plan with named contacts. These cover most questions in an Act 854-driven supplier questionnaire.

1. Map your access. List every admin, editor, agency and plugin account on the site and remove anyone who has left.
2. Lock the login. Use strong passwords, two-factor authentication and limited login attempts for every admin.
3. Patch on a schedule. Update the CMS, theme and plugins at least monthly, and delete unused plugins.
4. Back up off-site. Keep daily backups stored away from the web server and test a restore twice a year.
5. Keep logs. Record logins, changes and form submissions so you can build an incident timeline quickly.
6. Know your data flows. Note where the site, forms, CRM and e-invoice tools store data, in Malaysia or overseas.
7. Write the incident plan. One page: who decides, who calls the client, who calls the host, and the PDPA and contract deadlines.

Illustrative example. The Klang Valley logistics SME found four admin accounts on its site, two belonging to former staff, and no logs. After the checklist it had two named admins with two-factor login, monthly updates, off-site backups and an activity log, and the questionnaire took one afternoon instead of a week.

Payments and invoicing tools add their own surface. Our guides to payment gateway integration in Malaysia and an e-invoice request form on your website show how to add them safely. Check your public pages too: e-commerce website legal requirements lists what must be shown, and our guide to the Copyright Act 1987 for marketers covers the content side.

8. How Should You Budget and Account for Security Work?

Quick Answer: Treat routine website security, such as updates, backups and monitoring, as an ongoing running cost in your maintenance plan. Larger one-off work, like a rebuild to meet a client’s security terms, may be treated differently in your accounts. Ask your tax agent how to classify it.

Security spending raises three practical money questions for SMEs:

• Capitalise or expense? A new secure portal is a different accounting call from monthly patching; see website development cost accounting.
• SST on the invoice. Web and IT services may carry service tax depending on the provider and scope; see SST on website design.
• Ongoing support costs. Compare maintenance tiers and response times in our guide to web app maintenance costs.

Keep the vendor’s scope and reports either way; they double as evidence for your NCII client’s audit.

9. Conclusion

The Cyber Security Act 2024 is a serious law, but it is aimed at critical infrastructure and at licensed security providers. For most SMEs, it does not apply directly to the company website. It reaches you through NCII clients, their contracts, and the security vendors you hire. The PDPA remains the law for your lead forms and tracking. As at October 2026, we found no amendment widening Act 854 to ordinary business websites, but NACSA can update codes and designations, so check its site before relying on this guide.

10. Frequently Asked Questions

1. Does the Cyber Security Act 2024 apply to my company website?

Usually not directly. The Act binds designated NCII entities and licensed cyber security service providers. A normal SME website with lead forms is mainly governed by the PDPA, though NCII clients may impose security terms through contracts.

2. When did Act 854, the Cyber Security Act, come into force?

Act 854 was gazetted on 26 June 2024 and came into force on 26 August 2024. Its four main regulations on incident notification, risk assessment and audit, licensing and compounding took effect at the same time.

3. Does my web designer need a NACSA licence?

Not for web design, hosting setup, updates or SEO. A licence is needed only for managed security operation centre monitoring or penetration testing services, whether offered by a company or an individual.

4. How fast must an NCII entity report a cyber incident?

Immediately after it becomes aware, with incident details within six hours and a full report within 14 days, to NACSA and its sector lead. Suppliers to NCII entities are often asked to support these timelines by contract.

5. Is my business an NCII entity if I work in the energy or finance sector?

Not automatically. Only entities designated by their sector lead because they own or operate NCII take on the duties. If you are unsure, ask your sector lead or a lawyer.