Malaysia Cyber Security Act and RMiT Training

Our Cyber Security Act 2024 training helps Malaysian organisations understand their duties as national critical information infrastructure (NCII) entities, meet Bank Negara Malaysia’s Risk Management in Technology (RMiT) policy, and comply with the amended Personal Data Protection Act. SSC delivers practical courses live online or on-site in Kuala Lumpur and across Malaysia.

Cyber Security Act 2024 training and related courses

Cyber Security Act 2024 (Act 854)

The Cyber Security Act 2024 came into force on 26 August 2024. It is administered by the National Cyber Security Agency (NACSA) and places duties on entities designated as national critical information infrastructure across 11 sectors, including government, banking and finance, transportation, defence and national security, information, communication and digital, healthcare, water, sewerage and waste management, energy, agriculture and plantation, trade, industry and economy, and science, technology and innovation. Duties include providing information on NCII, complying with codes of practice, conducting risk assessments and audits, and notifying cyber security incidents.

Cyber Security Act 2024 for NCII entities

Typical duration: 1 day. Who it is for: leadership, risk and security teams in designated or likely NCII entities.

• The roles of NACSA, NCII sector leads and NCII entities
• Codes of practice, risk assessments and audits
• Incident notification duties and how to prepare for them
• Penalties and how to evidence compliance

You will be able to: explain your organisation’s obligations under the Act and plan how to meet them.

BNM Risk Management in Technology (RMiT)

Bank Negara Malaysia’s RMiT policy document applies to licensed banks, insurers, takaful operators, development financial institutions, and specified payment and e-money providers. It covers technology risk governance, technology operations, cyber security, cloud services, multi-factor authentication, third-party risk and resilience. BNM re-issued the document in September 2026, adding a code of practice for financial institutions designated as NCII. Our practitioner course covers the requirements, the self-assessment, and how to evidence compliance to supervisors.

PDPA amendments and NCII operations

The Personal Data Protection (Amendment) Act 2024 introduced mandatory data breach notification to the Personal Data Protection Commissioner, a requirement to appoint a data protection officer, direct obligations for data processors and a right to data portability. Our PDPA course covers each change and how to run a breach assessment quickly. Our incident response tabletop brings these obligations together in one realistic exercise.

How the Malaysian framework training is delivered

• Live online. Instructor-led virtual classes over Microsoft Teams or Zoom, with breakout exercises, shared workbooks and the option to split longer courses into half-day sessions across a week or two.
• On-site at your premises. Private training for your team at your office, delivered by a consultant who can use your own policies, systems and examples in the exercises.
• Private and tailored. Every course can be run for a single organisation, with case studies drawn from your sector and the depth adjusted to your team’s experience.

What participants receive

• A course workbook and the slides used in class
• Reusable templates and checklists, such as audit checklists, risk registers and report formats, depending on the course
• A case study pack and practice questions
• A certificate of completion from Security Solution Consultants

Certificates and accredited exams

Every participant who completes a course receives a certificate of completion from Security Solution Consultants. Lead Auditor and Lead Implementer courses can include an accredited certification exam through our accredited training partner, for standards where the partner offers one. Your quote confirms the exam body, exam format and certificate for each course, so there are no surprises on the day.

Why train with SSC

• Taught by practitioners. Our trainers are working consultants and auditors who work with Malaysian clients and build NACSA and BNM framework modules into GRCLens, so examples come from real engagements rather than slides.
• We hold ourselves to the same standard. SSC is certified to ISO/IEC 27001 and follows a Secure by Design approach. See our Trust Centre.
• Hands-on with real tools. Exercises can use GRCLens, the GRC platform built by SSC, so participants practise with risk registers, control libraries and evidence the way they will at work.
• Training that connects to delivery. If your team needs help after the course, the same people can support implementation, internal audits and certification readiness.

Related: the GRCLens NACSA baseline and BNM RMiT modules and the Malaysia framework pack. See all training courses.