# NACSA and CyberSecurity Malaysia: Who Does What > Malaysia runs two national cyber bodies that are easy to confuse. NACSA is the policy, coordination and regulatory lead under the Prime Minister's Department; CyberSecurity Malaysia is the technical specialist agency under the Ministry of Digital that runs incident response (MyCERT/Cyber999) and security certification. - Category: technology - Language: en - Status: published - Updated: 2026-08-01 - Canonical: https://negaraku.md/en/technology/nacsa-cybersecurity-malaysia --- Two Malaysian government bodies carry "cyber security" in their name, and people route the wrong thing to the wrong one all the time — a licence question to the incident hotline, a hacked-account report to the policy agency. The names sound interchangeable. Their jobs are not. ## Which is which? One is a regulator; the other is a doer. NACSA — the National Cyber Security Agency — is the national lead for policy, coordination and law. CyberSecurity Malaysia is the national technical specialist agency that does the hands-on work: responding to incidents, running forensics, certifying products. | | NACSA | CyberSecurity Malaysia | | --- | --- | --- | | Full name | National Cyber Security Agency | CyberSecurity Malaysia | | Type | Government agency (national lead) | Company Limited by Guarantee | | Sits under | National Security Council, Prime Minister's Department | Ministry of Digital | | Established | February 2017 | Incorporated 14 March 2006 | | Primary role | Policy, coordination, regulation | Technical services and assurance | | Flagship function | Administers the Cyber Security Act 2024 | Incident response via MyCERT / Cyber999 | ## What does NACSA do? NACSA describes itself as the national lead agency for cyber security matters. It was established in February 2017 and operates under the National Security Council within the Prime Minister's Department, at the Perdana Putra building in Putrajaya. Its remit is national and strategic: - Developing and implementing national cyber security policies and strategies. - Protecting National Critical Information Infrastructure (NCII). - Coordinating national expertise to counter cyber threats. - Spearheading awareness and capacity-building programmes. - Advising organisations on cyber risk management. - Building regional and global cyber security partnerships. The role that most changed after 2024 is regulatory. NACSA administers the **Cyber Security Act 2024 [Act 854]**, which was gazetted on 26 June 2024 and came into force on 26 August 2024. According to NACSA, the Act now supersedes the earlier **National Security Council Directive No. 26** (The National Cyber Security Management), which the National Security Council has repealed. The Act sets out, among other things, provisions to regulate cyber security service providers, the duties of NACSA's Chief Executive, and the obligations of NCII sector leads and entities. ## What does the Cyber Security Act 2024 make NACSA responsible for? Two things stand out for organisations. First, the Act creates a framework around NCII — the systems whose disruption would seriously affect national security, the economy or public services. Second, it introduces provisions to regulate cyber security service providers **through licensing**. Under NACSA's licensing framework, an application to provide cyber security services is made to the **Chief Executive**, and NACSA identifies two regulated service categories: 1. **Managed security operation centre (SOC) monitoring service.** 2. **Penetration testing service.** Providers offering these services in Malaysia apply to NACSA for a licence. This is the concrete, day-to-day reason a business might deal directly with NACSA rather than with CyberSecurity Malaysia. ## What does CyberSecurity Malaysia do? CyberSecurity Malaysia is the national cyber security specialist agency, now under the purview of the Ministry of Digital. It is structured as a Company Limited by Guarantee, incorporated on 14 March 2006 after Cabinet approval to spin it off from MIMOS Berhad into an independent national entity. Where NACSA writes and enforces the rules, CyberSecurity Malaysia provides the technical muscle: | Service | What it covers | | --- | --- | | MyCERT / Cyber999 | Reporting and handling of computer security incidents | | Digital forensics | Accredited forensic laboratory services | | Security certification | ISMS and Common Criteria product evaluation | | MySEF | Malaysian Security Evaluation Facility | | Training | CyberGuru competency and certification programmes | ## Where do most people actually meet these agencies? For the public, the everyday touchpoint is **Cyber999**. It is operated by **MyCERT** — the Malaysia Computer Emergency Response Team — which was formed on 13 January 1997 and operates from the office of CyberSecurity Malaysia. Cyber999 is the national point of contact for reporting computer security incidents, from fraud and hacked accounts to malware, and it accepts reports through an online form and a mobile app. So the simple routing rule: if something has been compromised and you need help now, that is CyberSecurity Malaysia's MyCERT/Cyber999. If your question is about national policy, NCII obligations, or a service-provider licence, that is NACSA. ## What's next If you run a business, first work out which body your issue belongs to — a live incident goes to Cyber999, while licensing, NCII duties and compliance questions go to NACSA. Cyber security service providers offering managed SOC monitoring or penetration testing should check the licensing requirements at `nacsa.gov.my`. For the exact obligations under the Cyber Security Act 2024, read the Act text via the Attorney General's Chambers legislation portal rather than relying on summaries, and confirm current service and reporting channels at `cybersecurity.my` and `mycert.org.my`. ## Sources - National Cyber Security Agency (NACSA) — Official Portal — https://www.nacsa.gov.my/ (National Cyber Security Agency (NACSA)) - Cyber Security Act 2024 [Act 854] — https://www.nacsa.gov.my/act854.php (National Cyber Security Agency (NACSA)) - Corporate Overview — https://www.cybersecurity.my/portal-main/about-us/corporate-overview (CyberSecurity Malaysia) - MyCERT — Malaysia Computer Emergency Response Team — https://www.mycert.org.my/ (MyCERT, CyberSecurity Malaysia) --- Source of truth: https://github.com/negaraku-md/NegaraKu.md License: CC BY-SA 4.0