Ketahui kedudukan andaKnow where you stand
Penilaian jurang terhadap Akta 854, PDPA dan Arahan No. 9, dengan pelan tindakan berperingkat.A gap assessment against Act 854, PDPA and Directive No. 9, with a prioritised action plan.
PematuhanCompliance
Undang-undang keselamatan siber Malaysia, dalam bahasa yang mudah.Malaysia's cyber security laws, in plain language.
Ringkasan Akta Keselamatan Siber 2024 (Akta 854), PDPA 2010 dan pindaannya, serta Arahan NACSA No. 9 tentang kriptografi pasca kuantum, dan cara Axiom membantu anda bersedia.A short guide to the Cyber Security Act 2024 (Act 854), the PDPA 2010 and its amendments, and NACSA Directive No. 9 on post-quantum cryptography, and how Axiom helps you prepare.
Keselamatan siberCyber security
Akta Keselamatan Siber 2024 (Akta 854)Cyber Security Act 2024 (Act 854)
Diwartakan pada 26 Jun 2024 dan berkuat kuasa pada 26 Ogos 2024, bersama empat peraturan. Ditadbir oleh Agensi Keselamatan Siber Negara (NACSA).Gazetted on 26 June 2024 and in force since 26 August 2024, together with four sets of regulations. Administered by the National Cyber Security Agency (NACSA).
Siapa yang diliputiWho it covers
Kewajipan utama terpakai kepada entiti infrastruktur maklumat kritikal negara (NCII), iaitu organisasi yang ditetapkan oleh ketua sektor kerana sistemnya penting kepada negara. Ketua Eksekutif NACSA juga boleh mengeluarkan arahan kepada ketua sektor, entiti NCII dan Entiti Kerajaan.The main duties apply to national critical information infrastructure (NCII) entities: organisations designated by their sector lead because their systems are vital to the nation. NACSA's Chief Executive can also issue directives to sector leads, NCII entities and Government entities.
11 sektor NCIIThe 11 NCII sectors
- KerajaanGovernment
- Perbankan dan kewanganBanking and finance
- PengangkutanTransportation
- Pertahanan dan keselamatan negaraDefence and national security
- Maklumat, komunikasi dan digitalInformation, communication and digital
- Perkhidmatan penjagaan kesihatanHealthcare services
- Air, pembetungan dan pengurusan sisaWater, sewerage and waste management
- TenagaEnergy
- Pertanian dan perladanganAgriculture and plantation
- Perdagangan, industri dan ekonomiTrade, industry and economy
- Sains, teknologi dan inovasiScience, technology and innovation
Kewajipan utama entiti NCIIKey obligations for NCII entities
- Penilaian risiko dan audit: menjalankan penilaian risiko keselamatan siber sekurang-kurangnya sekali setahun, dan diaudit mengikut tempoh yang ditetapkan dalam peraturan (P.U.(A) 219/2024).Risk assessment and audit: carry out a cyber security risk assessment at least once a year, and be audited at the intervals set in the regulations (P.U.(A) 219/2024).
- Pemberitahuan insiden: memaklumkan insiden keselamatan siber kepada ketua sektor dan NACSA dengan segera, dengan butiran awal dalam tempoh enam jam selepas mengetahuinya (P.U.(A) 220/2024).Incident notification: report a cyber security incident to the sector lead and NACSA promptly, with initial details within six hours of becoming aware of it (P.U.(A) 220/2024).
- Kod amalan: melaksanakan kod amalan dan langkah yang ditetapkan untuk sektor masing-masing.Codes of practice: implement the codes of practice and measures set for their sector.
Pelesenan pemberi perkhidmatan keselamatan siberLicensing of cyber security service providers
Sesiapa yang menyediakan perkhidmatan pemantauan pusat operasi keselamatan (SOC) terurus atau ujian penembusan perlu memegang lesen daripada NACSA (P.U.(A) 221/2024). Sebab itu Axiom Systems menyampaikan perkhidmatan ini melalui rakan berlesen kami, Mindmatics Sdn Bhd.Anyone providing managed security operation centre (SOC) monitoring or penetration testing services needs a licence from NACSA (P.U.(A) 221/2024). That is why Axiom Systems delivers these services through our licensed partner, Mindmatics Sdn Bhd.
Data peribadiPersonal data
PDPA 2010 dan pindaan 2024PDPA 2010 and the 2024 amendments
Akta Perlindungan Data Peribadi 2010 (Akta 709) mengawal pemprosesan data peribadi dalam urus niaga komersial. Akta Perlindungan Data Peribadi (Pindaan) 2024 (Akta A1727) berkuat kuasa secara berperingkat pada 1 Januari, 1 April dan 1 Jun 2025.The Personal Data Protection Act 2010 (Act 709) governs the processing of personal data in commercial transactions. The Personal Data Protection (Amendment) Act 2024 (Act A1727) came into force in stages on 1 January, 1 April and 1 June 2025.
Apa yang berubahWhat changed
- Pemberitahuan kebocoran data: pengawal data perlu memaklumkan Pesuruhjaya Perlindungan Data Peribadi secepat mungkin apabila berlaku kebocoran data peribadi. Garis panduan Pesuruhjaya menetapkan tempoh 72 jam. Individu yang terjejas juga perlu dimaklumkan jika kebocoran itu mungkin menyebabkan kemudaratan yang ketara.Data breach notification: data controllers must notify the Personal Data Protection Commissioner as soon as practicable after a personal data breach. The Commissioner's guideline sets a 72-hour window. Affected individuals must also be told where the breach is likely to cause significant harm.
- Pegawai Perlindungan Data (DPO): pengawal data dan pemproses data perlu melantik DPO, mengikut kriteria dalam garis panduan Pesuruhjaya (berkuat kuasa 1 Jun 2025).Data Protection Officer (DPO): data controllers and data processors must appoint a DPO, according to the criteria in the Commissioner's guideline (in force from 1 June 2025).
- Pemproses data kini tertakluk secara langsung kepada Prinsip Keselamatan, dan had penalti maksimum telah dinaikkan.Data processors are now directly bound by the Security Principle, and maximum penalties have been raised.
- Istilah “pengguna data” kini dikenali sebagai “pengawal data”.The term “data user” is now “data controller”.
Siapa yang diliputiWho it covers
Organisasi yang memproses data peribadi dalam urus niaga komersial, termasuk GLC, syarikat dan PKS. Kerajaan Persekutuan dan Kerajaan Negeri tidak tertakluk kepada PDPA, tetapi kontraktor dan syarikat milik mereka mungkin tertakluk.Organisations that process personal data in commercial transactions, including GLCs, companies and SMEs. The Federal and State Governments are outside the PDPA, but their contractors and companies may be covered.
Kriptografi pasca kuantumPost-quantum cryptography
Arahan Ketua Eksekutif NACSA No. 9NACSA Chief Executive Directive No. 9
Penyediaan data dan maklumat pelaksanaan migrasi kriptografi pasca kuantum (PQC) oleh entiti NCII. Dikeluarkan di bawah Akta 854 dan berkuat kuasa pada 22 September 2025.Preparing data and information for post-quantum cryptography (PQC) migration by NCII entities. Issued under Act 854 and in force since 22 September 2025.
Mengapa ia pentingWhy it matters
Komputer kuantum pada masa hadapan dijangka mampu memecahkan kaedah penyulitan yang digunakan hari ini. Arahan ini bertujuan mengenal pasti tahap kesediaan inventori kriptografi terhadap risiko itu, supaya migrasi PQC dilaksanakan mengikut keutamaan.Future quantum computers are expected to be able to break encryption methods in use today. The directive aims to identify how ready cryptographic inventories are for that risk, so PQC migration can be prioritised.
Apa yang diperlukanWhat it requires
- Entiti NCII perlu menyediakan data dan maklumat pelaksanaan migrasi PQC yang merangkumi sistem, aplikasi, perkhidmatan dan infrastruktur maklumat kritikal masing-masing.NCII entities must prepare data and information on PQC migration covering their critical systems, applications, services and infrastructure.
- Maklumat dikemukakan kepada Ketua Eksekutif NACSA dalam tempoh tiga bulan dari tarikh notis bertulis, menggunakan Borang Pelaksanaan Migrasi PQC.The information is submitted to NACSA's Chief Executive within three months of a written notice, using the PQC Migration Implementation Form.
- Ketua sektor NCII menyelaras dan memantau penyediaan ini dalam sektor masing-masing. Pusat Teknologi dan Pengurusan Kriptologi Malaysia (PTPKM) ditetapkan sebagai penyelaras di bawah penyeliaan NACSA.NCII sector leads coordinate and monitor this within their sectors. The Malaysian Cryptology Technology and Management Centre (PTPKM) is the coordinator under NACSA's supervision.
Bagaimana Axiom membantuHow Axiom helps
Bersedia sebelum diminta.Ready before you are asked.
Sediakan buktiPrepare the evidence
Penilaian risiko, dokumentasi dan inventori kriptografi yang tersusun, sedia untuk audit dan permintaan NACSA.Risk assessments, documents and a cryptographic inventory, organised and ready for audits and NACSA requests.
Bertindak dengan pantasRespond quickly
Pemantauan 24x7 dan sokongan respons insiden bersama rakan berlesen kami, supaya anda boleh memenuhi tempoh pemberitahuan.24x7 monitoring and incident response support with our licensed partner, so you can meet notification windows.
Ini ialah maklumat umum, bukan nasihat undang-undang.This is general information, not legal advice.
Disemak pada 13 November 2026. Undang-undang dan garis panduan boleh berubah; rujuk teks rasmi untuk keputusan.Checked on 13 November 2026. Laws and guidelines can change; rely on the official texts for decisions.
SumberSources
- NACSA, Akta Keselamatan Siber 2024 (Akta 854) dan peraturannya:NACSA, Cyber Security Act 2024 (Act 854) and its regulations: nacsa.gov.my/act854.php
- Peraturan-Peraturan Keselamatan Siber (Tempoh bagi Penilaian Risiko Keselamatan Siber dan Audit) 2024, P.U.(A) 219/2024:Cyber Security (Period for Cyber Security Risk Assessment and Audit) Regulations 2024, P.U.(A) 219/2024: lom.agc.gov.my
- Peraturan-Peraturan Keselamatan Siber (Pemberitahuan Insiden Keselamatan Siber) 2024, P.U.(A) 220/2024, dan (Pelesenan Pemberi Perkhidmatan Keselamatan Siber) 2024, P.U.(A) 221/2024, di portal Undang-Undang Malaysia:Cyber Security (Notification of Cyber Security Incident) Regulations 2024, P.U.(A) 220/2024, and (Licensing of Cyber Security Service Provider) Regulations 2024, P.U.(A) 221/2024, on the Laws of Malaysia portal: lom.agc.gov.my
- NACSA, Arahan Ketua Eksekutif No. 9: Penyediaan Data dan Maklumat Pelaksanaan Migrasi Kriptografi Pasca Kuantum oleh Entiti Infrastruktur Maklumat Kritikal Negara (berkuat kuasa 22 September 2025):NACSA, Chief Executive Directive No. 9: Preparing Data and Information for Post-Quantum Cryptography Migration by National Critical Information Infrastructure Entities (in force 22 September 2025): nacsa.gov.my
- Jabatan Perlindungan Data Peribadi (JPDP), Akta 709, Akta A1727 dan garis panduan Pesuruhjaya tentang Pemberitahuan Kebocoran Data dan Pelantikan DPO:Personal Data Protection Department (JPDP), Act 709, Act A1727 and the Commissioner's guidelines on Data Breach Notification and DPO Appointment: pdp.gov.my
Tidak pasti di mana anda berada?Not sure where you stand?
Mulakan dengan taklimat. Kami akan membantu anda memahami apa yang terpakai kepada organisasi anda.Start with a briefing. We will help you understand what applies to your organisation.