Cybersecurity Act · 2024 Revised Edition · Part · General
38. Regulations
Official textFrom Attorney General's Chambers, unchanged
The Minister may, with the consent of His Majesty the Sultan and
Yang Di-Pertuan, make regulations as he considers necessary or expedient for giving effect to or carrying out the purposes and provisions of this Act, including the prescription of fees and of any other thing required to be or which may be prescribed under this Act, and for the due administration thereof, and such regulations may include such incidental, consequential and supplementary provision as he considers necessary or expedient.
Notwithstanding subsection (1), the Minister may make regulations for or in respect of all or any of the following matters —
the procedure for the designation of a critical information infrastructure;
the technical or other standards relating to cybersecurity to be maintained in respect of a critical information infrastructure;
the responsibilities and duties of the owner of a critical information infrastructure;
the type of changes that are considered material changes to the design, configuration, security or operations of a critical information infrastructure to be reported by the owner of the critical information infrastructure;
Cybersecurity 53
the type of cybersecurity incidents in respect of a critical information infrastructure that are required to be reported by the owner of the critical information infrastructure;
the manner in which an appeal may be made to, and the procedure to be adopted in the hearing of any appeal by, the Minister;
the requirements for, and the manner for the carrying out of, cybersecurity audits and cybersecurity risk assessments required to be conducted by the owner of a critical information infrastructure;
the form and nature of cybersecurity exercises that may be conducted;
the fees to be paid in respect of any matter or thing required for the purposes of this Act, including the refund and remission
(in whole or part) of such fees;
the prescribing of the offences which may be compounded and the method and procedure by which they may be compounded; and
all matters and things which by this Act are required or permitted to be prescribed or which are necessary or expedient to be prescribed to give effect to this Act.
Except as otherwise expressly provided in this Act, the regulations —
may be of general or specific application;
may provide that any contravention of any specified provision of the regulations shall be an offence; and
may provide for penalties not exceeding a fine of $50,000, imprisonment for a term not exceeding 12 months or both for each offence and, in the case of a continuing offence, a further penalty not exceeding a fine of 10 per cent of the maximum fine prescribed for that offence for every day or part thereof during which the offence continues after conviction.
Cybersecurity 54
Terms defined in s 2
critical information infrastructure
Defined · s 2“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
owner
Defined · s 2“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;