Introduction
In Malaysia, the Cyber Security Bill 2024 (the “Proposed Act”) was passed in Parliament, after the third reading by Digital Minister Gobind Singh Deo on 3 April 2024. The primary objective of the Proposed Act is to establish an overarching regulatory framework designed to fortify national cyber security by requiring compliance with specific measures, standards and processes in the management of the cyber security threats. For these purposes, the regulatory framework introduces various provisions relating to, among others, the establishment of the National Cyber Security Committee, the duties and powers of the Chief Executive of the National Cyber Security Agency (“NACSA”), national critical information infrastructure sectors (“NCII Sectors”), the appointment of sector leads to regulate each national critical information infrastructure sectors (“NCII Sector Leads”), the designation of national critical information infrastructure entities (“NCII Entities”) as well as licensing requirements for cyber security service providers1 .
Will my business or organisation be subject to the new law?
Private and public entities (i.e. including private businesses) that are designated as NCII Entities and cyber security service providers (as will be discussed below) will be expected to comply with the regulatory requirements under the Proposed Act once it comes into force.
Therefore, this article aims to offer an overview of these key provisions of the Proposed Act which businesses and relevant sectors should consider in preparation for the enactment of the forthcoming legislation although the Proposed Act will still be subject to royal assent by the Yang di-Pertuan Agong.
