Licensing for Cybersecurity Service Providers Under Malaysia's Cyber Security Act 2024

Summary

In this episode of the Legal Insight podcast, experts discuss the Cyber Security Act 2024 (CSA 2024) and its licensing requirements for cybersecurity service providers. They emphasize the importance of these regulations in ensuring trust, accountability, and quality in the cybersecurity industry. Key points covered include which companies need licenses, the different types of cybersecurity services under the new law, and the application process. The discussion also touches on exemptions, penalties for non-compliance, and advice for companies preparing for these new requirements. The podcast provides valuable insights for those in the tech industry looking to stay compliant.

Takeaways

• 😀 The Cyber Security Act 2024 (CSA 2024) introduces licensing requirements for cyber security service providers in response to escalating cyber threats and incidents.
• 😀 Licensing helps ensure that only credible and reliable cyber security service providers are engaged, fostering trust in the market.
• 😀 Cyber security service providers are considered the first line of defense against cyber threats, vital to securing digital environments.
• 😀 The licensing requirements apply to companies advertising or providing cyber security services, regardless of whether they are subcontracting those services.
• 😀 Two main types of services require licensing: Managed Security Operation Center (SOC) monitoring and penetration testing (pentest) services.
• 😀 Companies offering both types of cyber security services can apply for a single license, but if they add a new service in the future, a new application is required.
• 😀 Subcontractors, who provide services under a main contractor, also need to be licensed under the CSA 2024 if they are providing cyber security services.
• 😀 There is an exemption for companies providing services exclusively to related entities within a corporate group, such as subsidiaries, who do not need to apply for a license.
• 😀 Foreign cyber security service providers need to obtain a license to operate in Malaysia, even if they are already licensed elsewhere, with an exception for services provided to related companies in Malaysia.
• 😀 Non-compliance with the licensing requirements can result in severe penalties, including fines of up to 500,000 ringgit or imprisonment for up to 10 years.
• 😀 Companies must begin the licensing application process by October 2024, with a grace period until December 31, 2024, after which unlicensed providers will face penalties.

Q & A

What is the focus of the Legal Insight podcast episode?

The episode discusses the importance of licensing for cybersecurity service providers under the Cyber Security Act 2024 (CSA 2024), particularly focusing on the necessity and implications of licensing in the tech industry.

Why is it crucial for cybersecurity service providers to be licensed under the CSA 2024?

With the increasing number of cyber threats, licensing ensures that companies engage credible and reliable cybersecurity providers. It acts as a quality assurance mechanism to guarantee that service providers are competent and trustworthy.

How are cybersecurity service providers considered the 'first line of defense' against cyber threats?

Cybersecurity service providers are tasked with constantly monitoring and managing IT environments for unauthorized access or cyber threats. They play a critical role in detecting and responding to threats before they escalate, unlike firewalls, which act as a final line of defense.

What role does the licensing regime play in the cybersecurity landscape?

The licensing regime helps build trust and accountability within the cybersecurity industry. It ensures that only licensed providers are offering services, reducing the risk of unreliable or unqualified companies providing cybersecurity solutions.

What are the key criteria for determining whether a company needs to apply for a cybersecurity service provider license?

A company that either provides cybersecurity services directly or advertises itself as offering such services needs to apply for a license. This requirement applies even if the company subcontracts services to third parties or subsidiaries.

Can a company apply for a license if it provides both managed security operation center services and penetration testing services?

Yes, a company providing both types of services can apply for both under a single license application. However, if a company starts with one type of service and later wants to provide the other, a separate application is required.

Do subcontractors need a separate cybersecurity service provider license?

Yes, subcontractors, whether or not they advertise their services, need to apply for a license. The requirement applies to any entity providing cybersecurity services, regardless of whether they are the primary contractor or a subcontractor.

Are companies that provide cybersecurity services exclusively to related companies required to obtain a license?

No, if a company provides cybersecurity services solely to related parties within its corporate group, it is exempt from licensing requirements. However, this exemption only applies to related companies as defined by the Companies Act.

What are the consequences of non-compliance with the Cyber Security Act 2024's licensing requirements?

Non-compliance with licensing requirements under the CSA 2024 can result in severe penalties, including fines up to 500,000 ringgit, imprisonment for up to 10 years, or both.

What steps should companies take to prepare for the upcoming licensing requirements?

Companies should first assess whether they provide cybersecurity services. If they do, they should consult with legal professionals to understand the application process and prepare for the licensing requirements, as the official application period starts in October 2024 with a grace period until December 31, 2024.