PDPA amendments
The Personal Data Protection (Amendment) Act 2024 introduces mandatory data breach notification, data protection officer appointments and data portability, increasing accountability for personal data.
Home/Listed companies/Cybersecurity
Cybersecurity and Compliance for Listed Companies in Malaysia
Cyber risk is now a standing board agenda item for listed companies in Malaysia. Crest helps public listed companies strengthen security with Microsoft Defender, Entra ID, Purview and Sentinel, prepare data for AI and meet growing PDPA and Cyber Security Act expectations.
- Microsoft Defender
- Microsoft Purview
- PDPA amendments
- Cyber Security Act 2024
Cybersecurity
Stronger security from the Microsoft platform you already run
Crest licenses Microsoft security, reviews your Microsoft 365 security posture and data exposure, and connects you with managed security partners, so boards get clear evidence that cyber risk is under control.
- Microsoft 365 E5 Security, Defender, Entra ID, Purview and Sentinel
- Data exposure review before Copilot rollout
- PDPA and Cyber Security Act control mapping
- Backup and ransomware recovery
Why now
Cybersecurity is now a board-level disclosure topic
71% of the Bursa Malaysia annual reports we reviewed discuss cybersecurity, rising to 84% in energy, 85% in property and 88% in healthcare. New laws and AI adoption are raising the bar again.
Figures come from Crest’s 2026 review of the latest annual reports of 514 Bursa Malaysia listed companies. They show the share of reports with at least one sentence on each theme. Read the full findings.
Cyber Security Act 2024
Entities designated as national critical information infrastructure face cybersecurity obligations, including risk assessments, audits and incident reporting.
Sector rules
Financial institutions also follow technology risk requirements such as Bank Negara Malaysia RMiT and Securities Commission technology risk guidelines.
AI and data exposure
Copilot and other AI tools surface whatever users can access, so oversharing and weak labelling become visible risks.
Ransomware and email threats
Phishing, business email compromise and ransomware remain the most common incidents for Malaysian organisations.
Investor and board scrutiny
Boards need clear reporting on cyber risk, controls and incident readiness for governance and sustainability disclosures.
Microsoft security stack
Microsoft security solutions for listed companies
Most listed companies already run Microsoft 365. Extending to Microsoft security licences consolidates tools, strengthens controls and prepares data for AI.
Microsoft 365 E5 and E5 Security
Advanced threat protection, identity protection and compliance capabilities in one licence path.
Microsoft 365 E3 and E5Microsoft Defender
Protection for endpoints, email, identities and cloud workloads with coordinated detection and response.
Defender for CloudMicrosoft Entra ID
Multi-factor authentication, conditional access and privileged identity controls.
Microsoft Entra IDMicrosoft Purview
Sensitivity labels, data loss prevention, insider risk and eDiscovery for PDPA and AI readiness.
Microsoft PurviewMicrosoft Sentinel
Cloud SIEM and SOAR for centralised monitoring, investigation and automated response.
Microsoft SentinelMicrosoft Security Copilot
Generative AI that helps security teams investigate incidents and summarise threats faster.
Security CopilotHow Crest helps
From assessment to board reporting
1. Security and data exposure review
Review Microsoft Secure Score, identity controls, external sharing and oversharing in SharePoint and Teams, with a prioritised remediation list.
2. Licence and control mapping
Map current licences to required controls for PDPA, Cyber Security Act and sector obligations, and identify consolidation savings.
3. Copilot and AI readiness
Apply sensitivity labels and DLP before AI rollout so Copilot only surfaces appropriate content.
4. Backup and recovery
Protect Microsoft 365 and servers with immutable backup for ransomware resilience.
5. Managed security and reporting
Introduce managed security partners for 24x7 monitoring and give directors clear, regular reporting on cyber risk.
FAQ
Cybersecurity for listed companies - common questions
What do the PDPA amendments mean for listed companies?
The Personal Data Protection (Amendment) Act 2024 introduces mandatory data breach notification, data protection officer appointments and data portability. Companies need stronger controls to detect, contain and report personal data breaches.
Does the Cyber Security Act 2024 apply to our company?
The Act applies to entities designated as national critical information infrastructure in specified sectors. Even if not designated, many listed companies use it as a benchmark for good practice.
Why use Microsoft security instead of separate tools?
If you already use Microsoft 365, Defender, Entra ID, Purview and Sentinel integrate natively, reduce tool sprawl and often lower total cost while improving visibility.
Do we need to fix security before deploying Copilot?
Copilot respects existing permissions, so oversharing becomes visible. A data exposure review, sensitivity labels and DLP are recommended before broad Copilot rollout.
Does Crest provide a 24x7 security operations centre?
Crest focuses on Microsoft security licensing, assessments and readiness, and introduces managed security partners when you need 24x7 monitoring and response.
Give your board clear evidence on cyber risk
Book a security discussion. Crest reviews your Microsoft 365 posture, maps controls to your obligations and recommends a licensing and remediation plan.