PAYNET Cyber Resilience Independent Assessment
Not Just Compliance—Build a Resilient Payment Ecosystem
Financial transactions never stop. Neither do cyber threats. As a PayNet Participant, ensuring cyber resilience isn’t just about compliance—it’s about guaranteeing the security, availability, and continuity of your payment services. A single cyber incident can disrupt operations, compromise customer data, and shake confidence in your institution.
That’s why AKATI Sekurity’s Cyber Resilience Independent Assessment goes beyond the standard audit. We stress-test your cybersecurity framework, assess your ability to detect and respond to cyber threats, and identify gaps before they become crises.
PAYNET Guidelines on Cyber Resilience – Key Requirements
The Guidelines on Cyber Resilience for Participants of PayNet Services (Version 2.1) establish essential cybersecurity and resilience expectations for all Participants in PayNet’s financial ecosystem. These guidelines help organizations enhance their ability to prevent, detect, respond to, and recover from cyber threats while ensuring the stability and security of Malaysia’s digital payment infrastructure.
1. Cyber Resilience Maturity Assessment (CRMA)
Self-Assessment for Cybersecurity Readiness
PayNet requires Participants to evaluate their cyber resilience maturity using BNM’s Cyber Resilience Maturity Assessment (CRMA). The assessment provides a structured framework to measure cyber risk maturity and security capabilities.
Mandatory CRMA Submission
Participants engaged by Bank Negara Malaysia (BNM) must submit:
✔ A completed CRMA Self-Assessment Test (SAT) & Self-Assessment Questionnaire (SAQ) in Excel format to PayNet by December 31 each year.
✔ The official BNM CRMA Report, once available.
Participants must comply with CRMA requirements at all times and provide supporting documents if requested by PayNet.
2. Independent Cyber Resilience Assessment & Review
Annual Independent Review for Non-CRMA Participants
Participants not subjected to BNM’s CRMA must conduct an independent assessment of their cyber resilience using PayNet’s approved assessment template.
Who Conducts the Review?
The assessment must be carried out by:
✔ Internal Audit, IT Risk Management, or Compliance Teams within the Participant’s organization.
✔ A qualified outsourced cybersecurity firm with expertise in cyber resilience.
Submission Deadline
The completed independent assessment report must be submitted to PayNet by December 31 each year.
3. Incident Response (IR) & Mandatory Reporting
Immediate Cyber Incident Reporting to PayNet
Participants must report any cyber incidents affecting PayNet systems or services, including successful attacks and near misses. If a cyberattack on a non-PayNet system could pose a risk to PayNet’s ecosystem, PayNet reserves the right to request further details.
Incident Reporting Timeline
TimeframeAction Required1 to 3 hours after confirming an incidentNotify PayNet via its official communication platform and submit an initial incident report.Every 12 hours during recoveryProvide updates on incident containment, eradication, and resolution.Within 72 hours after recoverySubmit a full incident report to PayNet.
Reporting Format
Incidents must be reported using the Cyber Security Incident Report Template (Appendix A) and submitted to CRWG@paynet.my.
4. Enforcement & Penalty Charges
Non-Compliance Consequences
Failure to comply with the cyber resilience guidelines may result in:
✔ Monetary penalties of up to RM5,000 per non-compliance issue annually.
✔ Suspension of PayNet services if the non-compliance poses significant risks or is repeated.
PayNet’s Discretion on Penalties
The actual penalty depends on the severity of the violation and PayNet’s risk assessment.
From Compliance to Cyber Resilience – A True Test of Strength
Why Work With AKATI Sekurity?
More Than Compliance – We Build Resilience
Compliance keeps regulators happy. Resilience keeps your business running. We focus on real-world security, not just checkboxes.
Independent, Uncompromising, Unbiased
We don’t sell security products. We don’t take shortcuts. We exist to find what others miss.
Actionable, Not Theoretical
No vague recommendations. Just real, tested solutions to keep your payment ecosystem protected.
Seamless, Zero-Disruption Assessment
Your business doesn’t stop. Neither do we. Our methodology ensures deep insights without interrupting daily operations.
Is Your Cyber Resilience Ready for the Real World?
Threats are getting smarter. Your security should be, too.
AKATI Sekurity’s Cyber Resilience Independent Assessment isn’t just another compliance check—it’s your ultimate test against cyber threats.