Bank Negara Malaysia revises Policy on Risk Management in Technology to include Cyber Security Code of Practice
On 25 September 2026, Bank Negara Malaysia (“BNM”) issued the revised Policy Document on Risk Management in Technology (“RMiT PD”), which supersedes the previous RMiT PD issued on 1 June 2023. The key amendment to the RMiT PD is the insertion of a new Appendix 12, which sets out the Code of Practice (“CoP”) for National Critical Information Infrastructure (“NCII”) entities designated by BNM under the banking and finance sector pursuant to the Cyber Security Act 2024 (“CSA”).
This article summarises the key cyber security obligations imposed on NCII entities under Appendix 12.
Background
Under the CSA, an NCII sector lead (which includes BNM for the banking and finance sector) is required to prepare a code of practice detailing the measures, standards, and processes in ensuring the cyber security of an NCII within its own industry. In this regard, BNM, as a NCII sector lead for the banking and finance sector, has published the CoP applicable to NCII entities within its purview (“NCII entities”).
Scope of application
The CoP is legally binding on NCII entities and will come into effect upon endorsement by the Chief Executive of the National Cyber Security Agency (“NACSA”). Notwithstanding the foregoing, an NCII entity may implement alternative measures, standards, and processes if it can demonstrate to the Chief Executive of NACSA that such alternatives provide an equivalent or higher level of protection to the NCII owned or operated by the NCII entity.
NCII entities must maintain proper documentation of their cyber-related activities and provide such documentation to the Chief Executive of NACSA where required to demonstrate compliance with the CoP.
Key obligations applicable to NCII entities under Appendix 12
Appendix 12 prescribes additional cyber security measures, standards, and processes that must be implemented by NCII entities within the banking and finance sector. Key obligations, among other things, include the following:
- Governance: Senior management must define, assign, and communicate the roles and responsibilities prescribed under the CSA across all levels of the organisation.
- Policies: An NCII entity must establish a cyber security policy outlining its overall approach to cyber security, which must align with recognised industry standards. Further, an NCII entity must develop and implement a comprehensive IT Acceptable Use Policy (AUP) to ensure responsible use of enterprise IT assets within the organisation.
- Objectives: An NCII entity must develop cyber security objectives aligned with its cyber security policy and communicate them to all staff and stakeholders.
- Organisational development: An NCII entity must establish well-defined cyber security roles and responsibilities and allocate a cyber security budget to support the implementation of the relevant strategy. An NCII entity must also collaborate with the relevant authorities and special interest groups for effective communication and provide cyber security awareness training to personnel regarding best practices in handing cyber security matters.
- Audit and risk assessment: An NCII entity must establish a cyber security audit plan that defines the audit scope, objectives and methodology. The audit must be conducted at least once every two years. In addition, an NCII entity must establish a cyber security risk assessment process that aligns with industry best practices. Such risk assessments must be conducted annually and when there is a significant change to the NCII.
- Management of third-party suppliers: An NCII entity must define a supply chain management (SCM) policy to ensure that third-party suppliers adhere to a defined cyber security baseline to safeguard its assets and operations. An NCII entity must ensure that any external service providers engaged for security operations centre (SOC) monitoring services or penetration testing services hold a valid licence under the CSA.
- Asset and capacity management: An NCII entity must establish and maintain a centralised IT asset inventory which covers NCII computers and computer systems, as well as the corresponding maintenance plan. An NCII entity must also establish a capacity management plan to ensure adequacy of IT resources, system resilience, and a comprehensive business continuity plan.
- Change management: An NCII entity must establish a change management procedure (CMP) to ensure structured and controlled changes to its IT assets.
- Data, physical and network security: An NCII entity must establish and implement a data leakage prevention (DLP) solution across its environment, comprehensive data privacy and protection procedures, cyber security guidelines for IT development, IT configuration procedures, comprehensive physical security procedures, comprehensive network security policies and procedures, and robust access controls.
- Contractual arrangements: An NCII entity must develop non-disclosure agreements (“NDAs”) and ensure all relevant parties (including internal and external stakeholders) sign such NDAs before granting access to sensitive data.
- Technical vulnerabilities: An NCII entity must establish a vulnerability management procedure (VMP) that aligns with industry standards and define a vulnerability assessment plan (VAP).
- Event and incident management: An NCII entity must establish a security monitoring procedure (SMP) to monitor any real-time potential threats and security breaches. An NCII entity must also establish a cyber security incident management procedure (CSIMP) and ensure that cyber security incidents are responded to and handled in accordance with the CSIMP and the CSA.
- Business continuity: An NCII entity must establish a business continuity plan (BCP) to ensure there is continuity in critical business functions during and after disruptive events.
Consequences of non-compliance
Failure to comply with the duty to implement the CoP (or equivalent alternatives) may attract a fine of up to RM500,000 and/or imprisonment of up to 10 years.
Conclusion
NCII entities within the banking and finance sector should start assessing the potential impact of these additional obligations and implement the necessary measures, standards and procedures before the CoP is endorsed by the Chief Executive of NACSA.
Further information
This article has been prepared with the assistance of Senior Associate Ng Hong Syuen and Associate Muhammad Izzad Danial Bin Yusri Izzudin.
