National Cyber Security Agency (NACSA), Malaysia

What National Cyber Security Agency (NACSA), Malaysia does

National Cyber Security Agency (NACSA) is a Malaysian federal government agency established in February 2017 under the National Security Council (NSC) of the Prime Minister's Department. It serves as Malaysia's statutory national lead agency for cybersecurity, mandated to coordinate and consolidate the nation's cybersecurity resources, protect National Critical Information Infrastructure (NCII), regulate cyber security service providers, and lead national cyber crisis response. NACSA's operations span ten NCII sectors including defence and security, banking and finance, information and communications, energy, transportation, water, health, government services, emergency services, and food and agriculture, alongside broader engagement with private sector businesses and individual citizens.

The agency's core technology and service portfolio comprises the National Cyber Coordination and Command Centre (NC4) for continuous threat monitoring, alerting, and crisis coordination; the National Cyber Crisis Management Plan (NCCMP) for national-level incident procedures; the Cyber Security (CS) Baseline Assessment Tool for organisational maturity evaluation; and the National Trusted Cryptographic Products (PKTN) evaluation system. Its principal strategic products include the Cyber Security Act 2024 (Act 854) — gazetted 26 June 2024 and in force from 26 August 2024 — which provides the legislative framework for NCII governance and licensing of managed SOC monitoring and penetration testing service providers. Supporting policy frameworks include the Malaysia Cyber Security Strategy (MCSS) 2025-2030 and the MyKriptografi National Cryptography Policy (Cabinet-approved 28 November 2025) with its 2026-2030 Action Plan comprising 4 pillars, 12 strategies, 33 programmes, and 82 activities including quantum readiness initiatives. Awareness programmes include MyCyberHero (school-level education), Cyber Parenting Guidebook, 10 Cyber Safety Measures, and Cyber Games 2025.

NACSA is funded exclusively through Malaysian government budgetary appropriation as a statutory body under the Prime Minister's Department, with no commercial revenue stream. Its go-to-market is entirely governmental — delivering services through its official portal (nacsa.gov.my), NC4 advisory distribution, and direct coordination with NCII sector leads, the Royal Malaysian Police (RMP), Malaysian Communications and Multimedia Commission (MCMC), Personal Data Protection Department (JPDP), and the Chief Government Security Office (CGSO). As of July 2026, the agency had recorded 713,534 portal visitors, and operates with a lean headcount of approximately 27 employees, consistent with a small statutory coordinating authority rather than an operational cybersecurity workforce.

Name

National Cyber Security Agency (NACSA), Malaysia

Legal name

National Cyber Security Agency (NACSA)

Website

https://nacsa.gov.my

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

11–50 employees

Short description

NACSA is Malaysia's national lead cybersecurity agency under the Prime Minister's Department, coordinating national cyber defense, protecting 10 Critical National Information Infrastructure sectors, licensing cyber security service providers under Act 2024, and running national awareness programmes for government, business, and citizens.

Ownership category

akta.pro rank

Product category

National Cybersecurity Services

NAICS

National Security (928110), Public Administration (92)

akta.pro primary industry

Privacy, Data Protection & Cyber Governance (GRC) (BPAHAFAF)

akta.pro secondary industry

Critical Infrastructure Protection (CIP) & NERC-CIP Compliance (HDADAJAC)

Keywords

• National cybersecurity services
• Critical infrastructure protection
• Cyber threat monitoring
• Cybersecurity service licensing
• National cryptography policy

Headquarters

HQ city

Putrajaya

HQ country

Malaysia

HQ region

Asia

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Marketing or Sales

Revenue model

1. Government Appropriation: NACSA is a government agency established under the National Security Council, Prime Minister's Department. As a statutory body, it is funded through government budgetary allocations rather than commercial revenue generation.

Distribution channels2 records

Marketing channels6 records

Core offering

NACSA is Malaysia's national lead agency for cybersecurity, delivering national-level cyber threat monitoring and crisis coordination through the NC4 command centre, protecting National Critical Information Infrastructure across 11 critical sectors, licensing cyber security service providers under the Cyber Security Act 2024, and setting national cyber policy and cryptography standards. It also runs national awareness and education programmes such as My Cyber Hero and provides standardised baseline assessment tools for organisations.

Product overview

NACSA operates as Malaysia's national lead agency for cybersecurity, established in February 2017, coordinating the nation's cybersecurity efforts across government, critical infrastructure, and the public. The agency's offerings comprise regulatory frameworks (Cyber Security Act 2024), threat monitoring and advisory services (NC4), national programs (MyKriptografi cryptography policy, MyCyberHero education), strategic planning tools (MCSS 2025-2030, NCCMP), licensing oversight for cyber security service providers, and practical resources including the NCSB self-assessment tool, PRKM guidelines, and the Cyber Parenting Guidebook. These products and services work together to form an integrated national cybersecurity ecosystem spanning prevention, detection, response, and capacity building.

Differentiator

Problem solved

Functional benefit

Brands

• MyKriptografi: National Cryptography Policy and Action Plan 2026-2030 operationalizing the strategic framework for cryptography in Malaysia.
• My Cyber Hero (MYCH)
• Malaysia Cyber Security Strategy (MCSS)
• National Cyber Crisis Management Plan (NCCMP)
• National Cyber Coordination and Command Centre (NC4)

Products and services

• National Cyber Coordination and Command Centre (NC4) The national cyber threat monitoring, coordination, and command centre that continuously monitors Malaysia's cyber threat landscape and issues alerts and advisories to organisations.
• Cyber Security Act 2024 (Act 854) National cybersecurity legislation gazetted in June 2024 establishing the legal framework for cybersecurity governance, NCII protection, and regulation of cyber security service providers through licensing.
• National Critical Information Infrastructure (NCII) Protection Protecting Malaysia's national critical information infrastructures across 11 sectors including defence, banking, energy, transportation, health, and government services.
• Cyber Security Service Provider Licensing Licensing programme for cyber security service providers offering managed Security Operations Centre (SOC) monitoring services and penetration testing services.
• Malaysia Cyber Security Strategy (MCSS) 2025-2030 The national cybersecurity strategy framework guiding Malaysia's cybersecurity direction for 2025-2030.
• MyKriptografi - National Cryptography Policy The updated national cryptography policy approved in November 2025, providing a comprehensive strategic framework for cryptographic governance across government and NCII entities.
• MyKriptografi Action Plan 2026-2030 Implementation roadmap for MyKriptografi with four core pillars, 12 strategies, 33 programmes, and 82 activities focusing on cryptographic governance, expertise development, PKTN adoption, and RDCI for quantum readiness.
• My Cyber Hero (MYCH) National-level cybersecurity education initiative for primary and secondary school students in Malaysia, enhancing cybersecurity competency and awareness among youth.
• National Cyber Crisis Management Plan (NCCMP) National-level plan providing procedures for detection, response, communication, and coordination in the event of cyberattacks affecting Critical National Information Infrastructure across 11 critical sectors.
• National Cyber Security Baseline (NCSB) Self Assessment Standardised assessment tool for evaluating organizational cybersecurity maturity, providing agencies with a format for self-evaluation.
• Cyber Games 2025 National cybersecurity competition initiative launched by NACSA to promote cybersecurity awareness and skills development.
• Information Security Risk Management (PRKM) Guideline Guideline video provided to public sector organisations as a reference for implementing information security risk management.
• Cyber Parenting Guidebook Guidance resource to help parents engage in their children's online lives and promote safe cybersecurity practices at home.
• 10 Cyber Safety Measures Cybersecurity awareness programme for the public sector launched in October 2017, providing fundamental safety guidelines for internet users.

Quantifiable outcome

• 12 strategies, 33 programmes and 82 activities
• +1 more outcomes

Segments3 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature5 records

Partnerships

Seven partnerships are on record, tiered core.

• Royal Malaysian Police (RMP)coreStrategic or Co-development Partner · 13 June 2022NACSA continuously collaborates with Royal Malaysian Police in efforts to ensure national digital space is secure, including joint responses to data breach incidents and cyberattacks affecting Malaysian citizens.
• Malaysian Communications and Multimedia Commission (MCMC)coreStrategic or Co-development Partner · 13 June 2022NACSA collaborates with MCMC on national cybersecurity efforts, particularly in protecting Malaysian citizens from cyber threats and ensuring secure digital communications infrastructure.
• Personal Data Protection Department (JPDP)coreStrategic or Co-development Partner · 13 June 2022NACSA partners with JPDP to enhance data protection compliance and enforcement, collaborating on initiatives to prevent data breaches affecting Malaysian citizens' personal information.
• Chief Government Security Office (CGSO)coreStrategic or Co-development Partner · 13 June 2022NACSA works closely with CGSO on government cybersecurity matters, including protection of classified information and coordination of security measures across government agencies.
• National Critical Information Infrastructure (NCII) OrganisationscoreStrategic or Co-development Partner · 13 June 2022NCII sector leads and organisations across 10 critical sectors (banking and finance, information and communications, energy, transportation, water, health, government services, emergency services, defence and security, food and agriculture) collaborate with NACSA for protection of critical national infrastructure.
• National Security Council (MKN)coreStrategic or Co-development PartnerNACSA operates under the National Security Council, Prime Minister's Department. The National Security Council has repealed NSC Directive No.26 (National Cyber Security Management) as it is now superseded by the Cyber Security Act 2024 [Act 854] administered by NACSA.
• Attorney General's ChamberscoreStrategic or Co-development PartnerThe Attorney General's Chambers gazetted the Cyber Security Act 2024 (Act 854) on 26 June 2024, establishing the legislative framework for NACSA's operations.

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Cybersecurity and Infrastructure Security Agency (CISA): US federal lead agency for national cybersecurity and critical infrastructure protection. Closely comparable in mandate scope (NCII/cyber coordination, advisories, sector lead engagement) and statutory positioning as the national cybersecurity coordinator.
• Korea Internet & Security Agency (KISA): South Korea's national internet and cybersecurity agency handling threat monitoring, incident response and national cybersecurity policy. Comparable in centralised national cybersecurity coordination role.
• Australian Cyber Security Centre (ACSC): Australia's national cyber hub within ASD, focused on threat intelligence sharing, critical infrastructure protection, and government cybersecurity guidance. Direct peer in commonwealth-aligned national cybersecurity model.
• National Cyber Security Centre (NCSC UK): UK's national cybersecurity authority under GCHQ, providing threat monitoring, incident response coordination, and critical infrastructure guidance. Direct functional peer in operating a national cyber coordination capability.
• Cyber Security Agency of Singapore (CSA): Singapore's national cybersecurity agency with mandate over CII protection, threat monitoring and ecosystem development. Closest regional peer in Southeast Asia with comparable sector-lead coordination model.
• ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information): France's national cybersecurity agency under the SGDSN, with mandate over NIS regulation, CII protection, and cryptography policy. Comparable in combining regulatory authority, NCII oversight and national cryptography framework.
• JPCERT/CC: Japan's national computer emergency response team coordinating incident response, vulnerability handling and CSIRT network. Peer in national-level cyber incident coordination and CSIRT operations.
• National Cyber Security Centre (NCSC Netherlands): Netherlands' national cybersecurity authority focused on threat intelligence, NCII coordination and crisis response. Comparable peer in central national coordination model for cybersecurity and critical infrastructure.
• Federal Office for Information Security (BSI Germany): Germany's federal cybersecurity authority overseeing critical infrastructure protection, IT baseline standards and cryptography policy. Comparable in regulatory scope and statutory mandate over NCII/CIP.

Broad incumbents

• ENISA (European Union Agency for Cybersecurity): EU-level cybersecurity agency providing guidance, capacity building and CSIRT network coordination across member states. Broader regional peer with comparable awareness, standards and NCII coordination focus.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks5 records

Key highlights6 records

Customer concentration

• YouTubeyoutube.com/channel/UCYI40LhWUrVcQQ9lT4s-4KQ
• LinkedInlinkedin.com/company/nacsamalaysia

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about National Cyber Security Agency (NACSA), Malaysia