Malaysian cybersecurity obligations depend on the organisation, service and regulated activity. Operating a website does not automatically make a business a National Critical Information Infrastructure entity or a licensed communications provider.
This guide was reviewed on 13 September 2026. It is general planning information; confirm the instruments and conditions applicable to your organisation with qualified advisers before relying on a legal interpretation.
Separate the legal regimes
| Regime | Main question for a software buyer |
|---|---|
| Cyber Security Act 2024 | Is the organisation designated NCII, or is a supplier providing a licensable cybersecurity service? |
| Computer Crimes Act 1997 | Who is authorised to access or modify each system? |
| Communications and Multimedia Act 1998 | Does the actual service fall within a licensing category? |
| PDPA | What personal-data processing duties apply? |
| Sector requirements | Are there additional financial-sector, government or contractual controls? |
These scopes overlap but are not interchangeable. A good procurement record identifies the provision or contract clause behind each requirement.
Cyber Security Act: designation and service licensing
The Cyber Security Act 2024 came into operation on 26 August 2024. For NCII, check actual designation and the applicable sector requirements rather than assuming every bank, data centre or cloud supplier is designated. The Act provides for risk assessment, audit, incident handling and other duties within its scope. NACSA Act 854 resources.
A customer may incorporate security, audit and incident-support requirements into a supplier contract. That contractual allocation is distinct from the supplier automatically inheriting every statutory NCII duty. Review the contract and the supplier’s own status.
There is also a separate licensing regime for specified cybersecurity services, including managed security operation centre monitoring and penetration testing. It is not limited to work for NCII customers. Before commissioning those services, establish whether licensing applies and verify the provider’s status. NACSA cybersecurity service licensing.
Computer Crimes Act: authorisation and penalties
The offence conditions matter as much as the maximum sentence. Under Act 563:
| Provision | Offence | Maximum penalty |
|---|---|---|
| Section 3 | Unauthorised access | RM50,000, five years’ imprisonment, or both |
| Section 4 | Unauthorised access with the specified further-offence intent | RM150,000, ten years, or both |
| Section 5 | Unauthorised modification | RM100,000, seven years, or both |
| Section 5 aggravated case | Modification with intent to cause injury as defined in the Penal Code | RM150,000, ten years, or both |
See the official Act 563 reprint hosted by UNIDIR. An accidental outage or contract dispute is not automatically proof that a particular offence was committed.
For engineering, document access authorisations, retain relevant audit records and revoke access when responsibilities end. Penetration testing needs a defined scope and permission even when its purpose is defensive.
MCMC licensing: identify the actual service
The eight-million-user framework concerns internet messaging and social-media services, not every website or application. A deeming mechanism under section 46A applies to qualifying services from 1 January 2026. Do not use this threshold as a general exemption for unrelated communications services. MCMC framework statement, MCMC-hosted 2026 announcement.
Cloud-service licensing requires its own service and establishment analysis. A business buying cloud hosting is not necessarily itself the cloud provider, and serving Malaysian customers alone does not resolve every provider’s licensing position. Review the supplier’s service model and applicable exemptions with the MCMC cloud regulatory material.
Turn findings into a delivery plan
Create a register linking each applicable obligation to an owner, control, evidence item and review date. Include access management, incident escalation, supplier oversight and recovery arrangements appropriate to the system.
For regulated financial-sector work, obtain the current applicable Bank Negara requirements and the customer’s procurement conditions. Government procurement similarly needs the specific tender or policy instrument. A broad digital-economy initiative is not a substitute for a binding requirement.
Encryption algorithms, WAF products and monitoring tools are implementation choices unless an applicable instrument or contract specifies them. Hiring locally does not guarantee compliance or remove statutory liability.
Prepare an applicability record before claiming compliance
This illustrative worksheet deliberately leaves legal conclusions open. Record the proposed activity, who provides it, recipient, system location, relevant designation or contract, and the adviser responsible for determining applicability. “Build an internal dashboard”, “operate a monitoring service” and “perform an assessment” are different activities; a broad “IT services” label is insufficient.
For a supplier review, attach the exact scoped activity, any required authorisation evidence, expiry/review date, responsible party and unresolved question. Mark a requirement pending qualified review until the responsible adviser has assessed the current law and facts. The engineering team then maps the confirmed obligations to access, logging, incident and operating deliverables. This is a preparation method, not a licensing determination.
Frequently Asked Questions
Does owning software or holding a licence authorise every related activity?
Do not infer that. Verify the activity and permitted scope with the responsible authority or qualified adviser, using the official references linked here.
What can a development engagement deliver while applicability is unresolved?
It can document architecture, access, data flows and the proposed operating responsibilities. Keep legal conclusions and deployment commitments pending the appropriate review. Use the scope preparation guide to identify those dependencies.
Before turning a legal category into a software requirement, record the organisation’s activity, any formal designation or licence status, the service supplied, the regulator’s current source and the contract clause. Have the appropriate legal reviewer decide whether the rule applies. The technical team can then document evidence, owners and implementation work without presenting every recommended security control as a statutory mandate.
Does every SME website fall under NCII duties?
No. Check designation and the relevant legal scope. Supplier contracts may impose related controls even where the supplier is not itself designated.
Is a software development contract a cybersecurity-service licence?
No. If the scope includes a licensable service such as penetration testing, assess the separate licensing requirement.
Where should a build assessment start?
With the organisation’s activities, designation, data flows and contracts. Use our architecture audit service to scope the technical evidence, alongside appropriate legal review.
