Section 107
Supply infrastructure information security
of Electricity Supply Enactment 2024
Any licensee as directed by the Commission providing supply of electricity to consumers shall be responsible for the preservation of confidentiality, integrity and availability of its information, information systems and supporting network infrastructure pertaining to its duties and other matters as provided under this Enactment.
(2)
The licensee shall —
85
(a)
take the necessary measures, establish and implement standards and employ the relevant information security controls to prevent, avoid, remedy, recover or restore its information, document, instrument or records stored in its computers and for its operational system by its computers from any risk of —
(i)
threat or unauthorized access; and
(ii)
intrusion or removal;
(b)
take necessary measures to ensure the resiliency of its supporting network infrastructure to minimize business impact against various threats to its activities under the licence; and
(c)
ensure that the reliability, continuity and quality of electricity supply, its performance of duties and conformity to the provisions of this Enactment and any regulations made under this Enactment shall not be jeopardized thereby, and shall report to the Commission within the time specified by the
Commission, and in the event of any incident which interferes or affects the performance of the activities under the licence, report such incident immediately to the Commission and other relevant authorities.
(3)
Any licensee who fails, neglects to comply with or contravenes any provision of this section commits an offence and shall, on conviction, be liable to a fine not exceeding three hundred thousand ringgit or to imprisonment for a term not exceeding three years or to both.
(4)
For the purposes of this section —
“information security controls” refers to means of managing risk, including policies, procedures, guidelines, practices or organizational structures, which can be administrative, technical, management or legal in nature;
“resiliency” means an ability of an organization to resist being affected by an incident; and
86
“supporting network infrastructure” refers to relevant connection, network devices, hardware and software that provides network services in supporting business functions.