ShieldCheckFree security checks for Malaysian SMEs
This page has no affiliate links. If we add any later, they will be marked and will never change our rankings. How we make money

Cyber Security Act 2024 (Act 854): what SMEs need to know

Last reviewed: 8 November 2026

Not legal advice. This page is general education, written from public official sources linked below. It is not legal advice and may be out of date. For decisions about your business, check the official source or ask a Malaysian lawyer.

The Cyber Security Act 2024 (Act 854) came into operation on 26 August 2024 (NACSA). It is administered by the National Cyber Security Agency (NACSA). This page explains, in plain terms, what it means for a typical small business.

Who the Act is mainly about

Most of the Act's duties fall on national critical information infrastructure (NCII) entities, designated by sector leads in these sectors listed by NACSA:

Sector leads were first appointed with effect from 11 September 2024 (NACSA). Being in one of these sectors does not by itself make a business an NCII entity; entities are designated. Most SMEs are not NCII entities.

Why it can still affect an SME

Does the Act reach your business?Answer each question. More than one can apply.

  1. Has your business been designated as an NCII entity?

    YesThe Act's main duties apply to you. Most SMEs are not designated.

  2. Do you supply an NCII entity, such as a bank, hospital, utility or government agency?

    YesThey may pass security requirements to you in contracts and questionnaires.

  3. Are you hiring someone for security services?

    YesNACSA says the Act regulates cyber security service providers through licensing (NACSA). Ask whether the service needs a NACSA licence and check the NACSA licensing portal.

  4. Do you sell security services?

    YesCheck the licensing rules with NACSA before you offer them.

No to allThe Act is unlikely to affect you directly. The basics below still protect you, and the PDPA probably applies.

What to do now

  1. Get the basics right; they are what supplier questionnaires ask about: MFA, updates, backups, email authentication. Start with our email check and website check.
  2. Write down how you would handle an incident, including who you would call. For scams, that is NSRC 997.
  3. If you handle personal data, follow the PDPA security checklist; that law applies to most businesses.
  4. Read the Act itself, linked from NACSA's page, if a customer says it applies to your contract.

FAQ

Does the Cyber Security Act 2024 apply to my small business?

Its main duties apply to designated NCII entities. Most SMEs are not designated, but customers that are may pass requirements to you by contract.

When did Act 854 come into force?

26 August 2024, according to NACSA.

Is a free online security check a penetration test?

No. A passive check like ours only reads public DNS records and one normal web response. It is not a penetration test.

Sources

Related