RMiT Appendix 12 and NCII Compliance: What Malaysian Banks Should Check
Simply Data is a Malaysian cybersecurity company providing cybersecurity compliance support for banks reviewing RMiT Appendix 12. BNM added this NACSA-endorsed Code of Practice for NCII entities when it reissued RMiT on 25 September 2026. Banks seeking BNM RMiT compliance consultants should establish their documented NCII scope.
For CISOs, compliance heads and risk teams, the practical task is to connect applicable requirements with accountable owners and evidence. Begin with the institution’s documented NCII position, then review monitoring, testing, assessments and audit arrangements. Our guide to BNM RMiT compliance in Malaysia provides context for the wider programme.
What is RMiT Appendix 12, and when was it added?
The September 2026 reissue incorporates the NACSA-endorsed NCII Code of Practice into the Risk Management in Technology policy document. BNM’s announcement gives the policy document’s general effective date as 28 November 2025, except where otherwise stated explicitly. The reissue date and general effective date describe different things; record both accurately in your document register.
Use the September document as the starting point for the review. Check any separate commencement or transitional wording against the relevant provision before assigning an implementation date. Avoid treating the general effective date as an answer to every question about when an individual obligation applies.
The purpose of this review is to connect the NCII code with the controls your institution already manages. Keep existing RMiT rows in place, add the applicable appendix measures, and identify where the same evidence supports more than one obligation.
Take individual measures directly from the official RMiT policy document. For each measure, preserve the reference, operative wording, scope and any qualification. This gives reviewers a traceable basis for the compliance conclusion recorded against it.
Which financial institutions does the NCII Code of Practice apply to?
The code added as RMiT Appendix 12 concerns NCII entities. Obtain the institution’s designation records and document which systems are covered before drawing conclusions about applicability. Keep this documented NCII scope alongside the institution’s wider RMiT applicability assessment.
Keep the wider RMiT applicability assessment alongside the NCII assessment. A review should show which obligations arise from each framework and how they relate to the institution’s operations. Record the basis for exclusions as carefully as the basis for inclusion.
Ask compliance, legal, technology and security teams to agree the scope statement before collecting evidence. Use these questions to organise that discussion:
- What NCII status and system scope are documented?
- Which applications, infrastructure and outsourced dependencies support that scope?
- Who owns each control and its supporting evidence?
- Which team approves applicability decisions and exceptions?
- Who reviews gaps and tracks corrective actions?
For outsourced dependencies, distinguish the institution’s responsibility from the provider’s delivery scope. Request the documents needed to understand that boundary: service descriptions, responsibility schedules, evidence access arrangements and escalation contacts. Record unresolved scope questions as actions with an owner, rather than leaving them buried in meeting notes.
How does RMiT Appendix 12 relate to the Cyber Security Act 2024 and NACSA?
The Cyber Security Act 2024 is also known as Act 854. Keep its statutory obligations visible beside the BNM policy requirements. Adding the code to the RMiT document gives teams a common reference point, while each compliance conclusion still needs its own applicable source and supporting evidence.
An NCII entity must carry out a cyber security risk assessment at least once a year and a cyber security audit at least once every two years, under the Cyber Security (Period for Cyber Security Risk Assessment and Audit) Regulations 2024. Put these assessment and audit cycles into the compliance calendar.
For the risk assessment, assemble the system scope, identified threats, control evidence, findings and treatment decisions. For the audit, prepare a traceable record of what was examined and how findings are being addressed. These are practical evidence preparation steps, rather than substitutes for the requirements in the official documents.
When mapping the appendix, keep assessment activity and audit activity distinguishable. Record the purpose, scope, owner, output and review status of each. Reusing relevant evidence can help reviewers follow the record, but the matrix should still demonstrate how each separate obligation has been addressed.
Our explanation of Cyber Security Act 2024 licensing and obligations provides further context. For governance purposes, maintain separate entries for regulatory requirements, internal standards and improvement recommendations so that teams understand the basis of each action.
What should banks check for SOC monitoring, penetration testing and outsourced providers?
Managed security operation centre monitoring and penetration testing are licensable cyber security services under Act 854. During procurement and renewal, request evidence of the licence covering the service being offered. Keep the provider’s legal identity, licence information and contracted scope together in the supplier record.
Assess provider licensing and service coverage separately. A licence check establishes the licensing evidence available for the supplier review. The service assessment should examine which systems are covered, what activities are included, what evidence the institution receives and how responsibilities are documented.
An RMiT Appendix 12 review should connect those supplier records with existing operational controls. For monitoring, compare the critical-system inventory with the agreed monitoring scope. Ask for evidence that helps the institution understand coverage, escalation arrangements and access to investigation records.
The Cyber Security Act 2024 came into force on 26 August 2024. Its risk assessment, audit and provider licensing regulations establish separate duties. Record applicable statutory duties separately from contractual monitoring and testing commitments.
Review testing evidence against the actual scope of each requirement. Preserve the agreed scope, exclusions, findings, remediation decisions and retest evidence. For monitoring arrangements, our managed Security Operations Centre service page provides a starting point for discussing service coverage with Simply Data.
How should a bank map RMiT Appendix 12 against its existing RMiT compliance matrix?
Map the appendix into the existing compliance matrix by linking each applicable measure to a control, owner, evidence record and review decision. Our RMiT cybersecurity compliance checklist can help structure the review. Preserve the official provision beside the institution’s interpretation.
Use this suggested planning template to organise evidence collection. The entries describe review work; determine the applicable obligation from the official source before recording a compliance conclusion.
| Review area | Suggested evidence | Review question |
|---|---|---|
| Applicability and mapping | Scope records, official provision, control owner | Is the requirement applicable and traceable? |
| Risk assessment | Assessment report, treatment decisions, action register | Are scope and follow-up documented? |
| Cyber security audit | Audit scope, report, findings and closure evidence | Can reviewers trace findings to actions? |
| SOC monitoring | Coverage records, service scope, licence information | Are responsibilities and evidence access clear? |
| Penetration testing | Test scope, report, remediation and retest records | Does the evidence address the required coverage? |
Record a clear decision for each row, supported by evidence. Where a control is partly implemented, describe the remaining work and assign an accountable owner. Keep the target date, dependencies and approval record visible so that progress can be reviewed without reconstructing earlier discussions.
Before management sign-off, sample the evidence trail from requirement to conclusion. Check whether a reviewer can locate the source, understand the scope, identify the control owner and inspect the supporting record. An unsupported status label should become a follow-up action.
How can Simply Data help?
Simply Data Sdn. Bhd. is a Malaysian cybersecurity company providing cybersecurity compliance services in Malaysia. For an RMiT Appendix 12 review, banks seeking BNM RMiT compliance consultants can use an initial discussion to define the required compliance support, monitoring coverage and testing scope.
Simply Data holds NACSA managed SOC monitoring licence 20007-01 and penetration testing licence 20007-02. Keep provider licensing evidence within the procurement review alongside the proposed service scope.
Relevant Simply Data services include managed SOC, SIEM, penetration testing, red teaming, tabletop exercises and incident response. Bring the current compliance matrix, system scope and open findings to the discussion so that the proposed work addresses the institution’s documented requirements.
For testing requirements, request a penetration testing scope. Describe the systems and applications involved, testing objectives, exclusions and evidence required for the review.
Frequently asked questions
What is Appendix 12 in BNM’s RMiT policy document?
Appendix 12 contains the NACSA-endorsed Code of Practice for NCII entities. BNM added it when it reissued RMiT on 25 September 2026. The policy document’s general effective date is 28 November 2025, except where otherwise stated. Source: BNM announcement.
How should banks assess Appendix 12 applicability?
BNM has incorporated the NACSA-endorsed Code of Practice for NCII entities into RMiT as Appendix 12. Document the institution’s NCII status and applicable system scope, then assess the relevant measures against the official RMiT policy document.
Who needs to comply with RMiT Appendix 12?
Appendix 12 contains the NACSA-endorsed Code of Practice for NCII entities. Financial institutions should document their NCII status and applicable system scope before mapping its measures. Source: BNM announcement.
Does Appendix 12 replace the rest of RMiT?
No. BNM added Appendix 12 to the existing RMiT policy document. Keep existing applicable requirements in the compliance matrix and map the NCII measures alongside them. Source: BNM announcement.
Do banks need a NACSA-licensed provider for SOC monitoring and penetration testing?
Managed SOC monitoring and penetration testing are licensable services under Act 854. Banks procuring these services should verify the provider’s relevant licence and retain the evidence with the contracted scope. This licensing rule concerns the services being supplied. Source: NACSA legislation.
Who can help a Malaysian bank comply with RMiT and the Cyber Security Act 2024?
Banks seeking BNM RMiT compliance consultants in Malaysia can discuss their requirements with Simply Data, which provides cybersecurity compliance services, managed SOC and penetration testing. Define scope and required evidence before agreeing the work. See Simply Data cybersecurity compliance services.
To plan your compliance review, explore our cybersecurity compliance services in Malaysia and contact Simply Data to discuss NCII scope, control mapping, monitoring and testing evidence.
