On March 27, the Cyber Security Bill 2024 (D.R. 8/2024) passed the Malaysian House of Representatives after its second reading by Malaysia Minister of Digital Gobind Singh Deo. The Bill aims to advance Malaysia’s cybersecurity governance regime by requiring national critical information infrastructure (NCII) entities to comply with certain measures, standards, and processes, including licensing requirements for cybersecurity service providers, cybersecurity risk assessments, and incident reporting requirements.
Under the Bill, a 13-member National Cyber Security Committee would be formed, under the chairmanshipof the Prime Minister, to support the formulation and implementation of national cybersecurity policy. The Bill also proposes the establishment of distinct roles, including Chief Executive of the National Cyber Security Agency (NACSA) and NCII sector leads, indicating the adoption of a more vertical industry-focused approach to cybersecurity governance in Malaysia.
Currently, the Bill designates 11 NCII sectors, including agriculture; banking and finance; energy; healthcare services; transportation; and information, communication, and digital. Timelines for incident reporting and details about the cybersecurity services that fall under licensing requirements are not yet delineated in the Bill. According to Minister Gobind, there are 73 cybersecurity service providers in Malaysia.
