Act 854, the Cyber Security Act 2024, is Malaysia’s main law for national cyber security. Among other things, it requires companies that provide certain cyber security services, including penetration testing, to be licensed by the National Cyber Security Agency (NACSA).
If your organisation hires an external team to test its systems, Act 854 directly affects who you can work with. This guide explains the key points in plain language.
This article is general information, not legal advice. Always check the latest requirements on the official NACSA website or with your legal adviser.
What is Act 854?
The Cyber Security Act 2024 was passed in 2024 and came into force on 26 August 2024. It is administered by NACSA, which sits under the National Security Council.
The Act has two main areas that matter to most organisations:
- Duties of National Critical Information Infrastructure (NCII) entities. Organisations designated as NCII in key sectors, such as government, banking and finance, energy, transport, telecommunications, healthcare and water, must meet specific cyber security obligations.
- Licensing of cyber security service providers. Companies offering prescribed services must hold a licence from NACSA.
Which services need a licence?
Under the licensing regulations made under Act 854, two services currently require a licence:
- Penetration testing
- Managed security operation centre (SOC) monitoring
This means any company that offers penetration testing to organisations in Malaysia must hold a valid NACSA licence for that service.
Why the licence matters when you hire a provider
Providing a licensable service without a licence is an offence under Act 854, with significant penalties, including heavy fines and possible imprisonment. However, the practical reasons to insist on a licensed provider go beyond legal compliance:
- Vetting. Licensing involves checks on the company and its key personnel.
- Accountability. Licensed providers have obligations to keep proper records of their engagements.
- Assurance for auditors. Using a licensed provider makes it easier to show regulators and customers that your testing was done properly.
In short, an unlicensed provider is a risk to your project, your data and your compliance position.
How to check a penetration testing provider
Before you sign a contract, ask the provider for:
- Their NACSA licence number and the service it covers.
- The validity period of the licence.
- The names of the personnel who will perform the test.
- A sample report and their penetration testing methodology.
You can then confirm the details with NACSA directly.
What NCII entities need to know
If your organisation is designated as an NCII entity, Act 854 adds further duties, such as following the codes of practice for your sector, carrying out regular cyber security risk assessments and audits, and reporting cyber security incidents to NACSA within set timeframes.
Penetration testing and red teaming are practical ways to support these obligations, because they show how well your controls work against real attack techniques.
What this means for smaller organisations
Even if you are not an NCII entity, Act 854 still matters to you when you buy security services. Choosing a licensed provider protects you from legal and quality risks, and it gives your customers confidence that your systems were tested by a qualified team.
Frequently asked questions
When did Act 854 come into force?
The Cyber Security Act 2024 came into force on 26 August 2024.
Does an in-house security team need a licence to test our own systems?
The licensing requirement applies to providers offering the service to others. If you are unsure about your situation, check with NACSA or your legal adviser.
Is vulnerability scanning covered by the licence?
The licence covers prescribed services, currently penetration testing and managed SOC monitoring. Ask your provider exactly which services their licence covers.
Work with a NACSA-licensed team
RC.MY is licensed by NACSA as a cyber security service provider for penetration testing, licence number 20312-02. Learn more about our penetration testing services, read what is penetration testing, or contact us to plan your next assessment.
