Cybersecurity Act 2018 · 2020 Revised Edition · Part 5 · Cybersecurity Service Providers
24. No person to provide licensable cybersecurity service without licence
Feedback & supportExcept under and in accordance with a cybersecurity service provider’s licence granted or renewed under section 26, no person —
cybersecurity service provider
“cybersecurity service provider” means a person who provides a cybersecurity service;
may engage in the business of providing any licensable cybersecurity service to other persons; or
being a person who is in the business of providing a licensable cybersecurity service, may advertise, or in any way hold out, that the person provides, or is willing to provide, the licensable cybersecurity service.
Any person who contravenes subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 2 years or to both.
Subsection (1) does not apply to the provision of a cybersecurity service by a company to its related company.
cybersecurity service
“cybersecurity service” means a service provided by a person for reward that is intended primarily for or aimed at ensuring or safeguarding the cybersecurity of a computer or computer system belonging to another person (A), and includes the following:(a)assessing, testing or evaluating the cybersecurity of A’s computer or computer system by searching for vulnerabilities in, and compromising, the cybersecurity defences of the computer or computer system;(b)conducting a forensic examination of A’s computer or computer system;(c)investigating and responding to a cybersecurity incident that has affected A’s computer or computer system by conducting a thorough scan and examination of the computer or computer system to identify and remove elements relating to, and identify the root cause of, the cybersecurity incident, and which involves circumventing the controls implemented in the computer or computer system;(d)conducting a thorough examination of A’s computer or computer system to detect any cybersecurity threat or incident that may have already penetrated the cybersecurity defences of the computer or computer system, and that may have evaded detection by conventional cybersecurity solutions;(e)designing, selling, importing, exporting, installing, maintaining, repairing or servicing of one or more cybersecurity solutions;(f)monitoring of the cybersecurity of A’s computer or computer system by acquiring, identifying and scanning information that is stored in, processed by, or transmitted through the computer or computer system for the purpose of identifying cybersecurity threats to the computer or computer system;(g)maintaining control of the cybersecurity of A’s computer or computer system by effecting management, operational and technical controls for the purpose of protecting the computer or computer system against any unauthorised effort to adversely affect its cybersecurity;(h)assessing or monitoring the compliance of an organisation with the organisation’s cybersecurity policy;(i)providing advice in relation to cybersecurity solutions, including —(i)providing advice on a cybersecurity program; or(ii)identifying and analysing cybersecurity threats and providing advice on solutions or management strategies to minimise the risk posed by cybersecurity threats;(j)providing advice in relation to any practices that can enhance cybersecurity;(k)providing training or instruction in relation to any cybersecurity service, including the assessment of the training, instruction or competencies of another person in relation to any such activity;
In this section, “related company” has the meaning given by section 6 of the Companies Act 1967.