For Malaysian organizations building or rebuilding an ISMS to ISO/IEC 27001:2022, whether a 2013 certificate lapsed at the October 2025 cutoff or the amended PDPA, NACSA or Bank Negara now asks for more. We design the ISMS so its controls produce the evidence those regimes expect. Our consultants work from Coimbatore and Chennai, India, two and a half hours behind Kuala Lumpur.
Three things changed for Malaysian ISMS owners in two years: the 2013 edition reached the end of its life, the PDPA gained breach notification and DPO duties, and critical infrastructure got its own Act. An ISMS designed before those changes probably does not reflect them.
We are consultants, not a certification body. We build the ISMS and prepare you for the audit; an accredited certification body decides. Our ISO 27001 certification consulting covers gap analysis, risk treatment, the Statement of Applicability, documentation and internal audit. Malaysian engagements are handled online by consultants based in Coimbatore and Chennai, India. There is no Malaysian office.
ISO/IEC 27001 asks you to identify the legal and regulatory requirements that apply to you. In Malaysia in 2026, that list is longer than it was.
Standards Malaysia accredits ISMS certification bodies under its Accreditation of Certification Bodies scheme. On 1 November 2026 its directory listed four: SIRIM QAS International, CyberSecurity Malaysia, BSI Services Malaysia and NIOSH Certification. It has been an IAF MLA signatory for ISO/IEC 27001 since July 2017, the arrangement through which accreditation is recognized between countries.
Act A1727 took effect in three stages. From 1 April 2025, data processors must meet the Security Principle directly, biometric data became sensitive personal data, and the maximum penalty rose to RM1 million or three years. From 1 June 2025, controllers must notify breaches, appoint a data protection officer and act on data portability requests.
The Commissioner's guideline requires notice within 72 hours of a breach that causes or is likely to cause significant harm, including any affecting more than 1,000 people, and notice to individuals within seven days after that. A DPO is required above 20,000 data subjects, or 10,000 for sensitive data, and must be resident in Malaysia or easily contactable, and proficient in Bahasa Melayu and English.
NCII entities in 11 sectors must carry out a cyber security risk assessment at least once a year and an audit by a NACSA-approved auditor at least every two years, report incidents immediately with particulars within six hours, and follow their sector's code of practice. NACSA's guidance asks NCII agencies to hold ISO/IEC 27001 certification or an equivalent.
RMiT, effective 28 November 2025, expects quarterly vulnerability assessments, annual intelligence-led penetration tests by suitably accredited testers, an independent compromise assessment at least every three years, an annual cyber drill, and a third-party review before critical systems first move to public cloud. Its NCII code of practice names ISO/IEC 27001:2022 among the standards a cyber security policy must align with.
| Aspect | ISO/IEC 27001:2022 Annex A | Malaysian obligation it supports |
|---|---|---|
| Incident handling | 5.24 to 5.28: planning, assessment, response, lessons learned, evidence | PDPA 72-hour breach notice; Act 854 six-hour particulars and 14-day follow-up |
| Privacy | 5.34 Privacy and protection of PII | PDPA principles, DPO appointment, data portability |
| Legal register | 5.31 Legal, statutory, regulatory and contractual requirements | A maintained list of PDPA, Act 854, RMiT and sector code duties |
| Suppliers and cloud | 5.19 to 5.23, including information security for use of cloud services | Processor duties under the PDPA; RMiT review before first public cloud use for critical systems |
| Vulnerabilities | 8.8 Management of technical vulnerabilities | RMiT quarterly assessments and annual penetration tests |
| Independent review | 5.35 Independent review of information security | Act 854 audit every two years; RMiT compromise assessment |
| Continuity | 5.29 and 5.30: security during disruption, ICT readiness | RMiT annual cyber drill and resilience reviews |
| Awareness | 6.3 Awareness, education and training | RMiT annual awareness training for staff |
Treat the table as a starting point. Your risk assessment decides which controls apply, and the Statement of Applicability records why, citing the Malaysian obligation where one exists. For privacy work beyond the ISMS, the data mapping, DPIA and breach procedures from our GDPR data protection compliance service carry over well to the PDPA.
A scope you can defend at Stage 1, with the context analysis that clause 4.1 now requires to consider whether climate change is a relevant issue, following Amendment 1:2024.
A risk register built from your assets and processes, with treatment plans that name owners and dates rather than generic intentions.
All 93 Annex A controls considered, each included or excluded with a reason tied to a risk or a Malaysian obligation.
Only the documents the ISMS needs, including a breach procedure that runs the PDPA and NCII clocks side by side.
An internal audit against the 2022 edition and a minuted management review, both of which the certification body will ask to see.
Annex A 6.3 training through our security awareness training program, and tabletop tests of the breach procedure drawn from our incident response practice, leaving records a BNM or NACSA review can examine.
Preparation for Stage 1 and Stage 2 with the accredited body you choose, and help closing any nonconformities afterwards.
Penetration testing and managed SOC monitoring for systems in Malaysia are licensable services under the Cyber Security Act 2024, and NACSA's licensing FAQ says a foreign company providing cyber security services to companies in Malaysia must apply for a license. ISO 27001 consulting is not a licensable service. When your risk treatment calls for a penetration test, check that the tester holds a NACSA license.
Malaysia Time is UTC+8 with no daylight saving, and India Standard Time is UTC+5:30. Kuala Lumpur therefore runs 2 hours 30 minutes ahead: a 2:00 p.m. meeting in Kuala Lumpur is 11:30 a.m. in Chennai, and the Malaysian afternoon from noon to 6:00 p.m. sits inside a 9:30 a.m. to 6:30 p.m. Indian working day.
Interviews with process owners by video, booked in your afternoons, plus a document review against the 2022 edition. You get a written gap report and a plan.
A facilitated session to agree assets, threats, risk criteria and owners, recorded straight into the risk register.
Policies, procedures and the Statement of Applicability drafted in a shared workspace and reviewed with your team weekly.
The ISMS runs for a period so that monitoring, incident and training records exist before anyone audits them, with staff sessions from our security awareness training where needed.
Our auditor checks the system against the standard; your management reviews the results and signs off.
Stage 1 and Stage 2 with your certification body, with us on call for evidence questions.
Timing: Implementation usually takes several months, because the ISMS must operate, be audited internally and be reviewed by management before the certification audit. We set the plan after the gap assessment, not before.
Institutions mapping RMiT expectations into one management system.
Organizations in the 11 NCII sectors, and vendors whose customers now ask for evidence.
Software and IT service firms whose overseas buyers ask for ISO 27001.
Healthcare services are an NCII sector, and patient data is sensitive personal data under the PDPA.
Companies that missed the 31 October 2025 transition and need certification to the 2022 edition.
Service providers now bound directly by the PDPA Security Principle.
Controls are chosen from your risk register, so the Statement of Applicability survives an auditor's questions.
Findings in access control, logging or vulnerability handling can be fixed by our engineers, not just written up.
We never certify you. The accredited body you choose does, which keeps the certificate credible.
PDPA duties and ISO 27001 controls are designed in one program, not two.
Six shared hours a day for calls, with written status in your inbox each morning.
Founded in 2008, with 5,203+ clients across four continents.
Send us your current scope, any existing ISMS documents and the regimes you answer to: PDPA, Act 854, RMiT or customer contracts. A consultant will come back by the next business day with the gaps we would check first and a proposed plan.
Prefer email? info@xcodefixglobal.com
Talk to the specialist who would scope the work — not a call-centre script.
Ask us directlyBuild and run an ISMS that meets ISO/IEC 27001:2022, carry out an internal audit and management review, then engage a certification body for a Stage 1 and Stage 2 audit. Choose a body accredited for ISMS, which you can check in Standards Malaysia's online directory. A consultant can build the ISMS with you, but only the certification body can certify it.
There are two separate costs: the certification body's audit fees and the effort to implement the ISMS, whether internal or consultant-led. We have not found reliable published price lists for Malaysian certification audits, so ask each accredited body for a quote based on your headcount and scope. We price implementation after a gap review.
Usually several months. The ISMS has to operate long enough to produce records, then pass an internal audit and management review before the Stage 1 and Stage 2 audits. A company with mature security practices and a narrow scope moves faster than one starting from scratch across several sites. We give a timeline after the gap assessment.
Not for most companies. NACSA's guidance asks NCII agencies to hold ISO/IEC 27001 certification or an equivalent, and BNM's code of practice for banking NCII entities names ISO/IEC 27001:2022 among the standards a cyber security policy must align with. For everyone else, the push usually comes from customers and tenders.
No. Under IAF's transition rules, all certifications based on ISO/IEC 27001:2013 expired or were withdrawn at the end of the transition period on 31 October 2025. An organization still holding one needs certification to the 2022 edition, which in practice means a new audit by an accredited certification body.
Since 1 June 2025, a DPO is required if you process personal data of more than 20,000 data subjects, sensitive personal data of more than 10,000, or carry out regular and systematic monitoring, according to the Commissioner's DPO guideline. Processors are covered too. The DPO must be resident in Malaysia or easily contactable, and the Commissioner must receive the DPO's contact details within 21 days of appointment.
Annex A now holds 93 controls in four themes, organizational, people, physical and technological, down from 114 in the 2013 edition. Eleven controls are new, and the set now includes controls such as 5.23 on information security for use of cloud services and 5.30 on ICT readiness for business continuity. Amendment 1:2024 also requires you to consider whether climate change is a relevant issue.
Yes. Interviews, workshops and document reviews work well over video, and the time difference with India is only two and a half hours, so afternoons overlap fully. ISO 27001 consulting is not a licensable service under the Cyber Security Act 2024. Penetration testing for Malaysian systems is, so use a NACSA-licensed tester. Our SOC 2 page for Singapore covers the regional attestation side.
