Skip to main content
FromNine
Menu

Trust and compliance

Evidence for regulated organisations in Malaysia and the EU

FromNine holds ISO/IEC 27001 certification. Here we explain how we protect your systems and personal data as a supplier, how we support your duties under Malaysian law, such as the Personal Data Protection Act 2010 (Act 709), and under NIS2, DORA and the EU AI Act where they reach you, and how to obtain our evidence pack.

For regulated organisations in Malaysia, and for Malaysian groups whose EU customers or subsidiaries bring EU rules into the contract.

Request evidence packOur undertakings

Our undertakings

Five undertakings that apply to every engagement

Public authorities and regulated companies give us sensitive data and systems that support real decisions. These are the undertakings you can enforce.

  • Information security management

    Certified

    We run an information security management system with ISO/IEC 27001 certification. Its controls, its rules for our own suppliers and its incident procedure govern each engagement.

    Before work begins we agree which of your systems and data the team may access, keep that access to what the task needs and review it whenever team members change.

    ISO/IEC 27001 certified

  • Personal data under the PDPA and the GDPR

    Our practice

    Purposes, access limits and retention are settled before we build. Since 1 April 2025, a data processor is bound by the Security Principle of the PDPA, so our contract with you as data controller sets out our security duties and how we notify you and assist you after a personal data breach. For EU personal data, the same contract covers Article 28 of the EU General Data Protection Regulation (GDPR).

    We give your data protection officer (DPO) the technical facts needed to meet the 72-hour notification to the Personal Data Protection Commissioner, and to assess any transfer out of Malaysia under section 129 of the PDPA.

  • Human oversight of AI

    Our practice

    Each AI use case is placed in a risk class together with you at the discovery stage. Approval steps, logs and technical documentation are part of the system from its first release, not prepared shortly before an audit. AI agents work with limited permissions and wait for approval by an accountable officer before any step with consequences.

  • Accessibility

    Our practice

    Interfaces are designed and tested against WCAG 2.2 level AA and EN 301 549, with automated tools and manual sessions using assistive technology. You receive a conformance report that names every known issue.

  • Hosting location

    Per engagement

    The hosting region, control of encryption keys and the places from which support staff may connect are settled with you at design stage, recorded in the contract and reflected in the architecture. Sovereign hosting is an option if your organisation needs it.

This page explains our practice as a supplier and is not a statement of compliance on your behalf. Your obligations depend on your organisation and on the purpose of each system, and the legal interpretation belongs to your counsel.

NIS2

NIS2: what an EU customer’s security clauses ask of you

Under the NIS2 Directive, Directive (EU) 2022/2555, essential and important entities in the EU must manage the cyber security risks to the systems they depend on. Supply-chain security is one of the minimum measures in Article 21(2), and Article 21(3) requires them to consider how well their direct suppliers and service providers secure their own work. An EU customer passes these demands to a supplier in Malaysia through the contract.

As that supplier, we make the evidence easy to produce. Each contract fixes the security terms, the incident channel and the handling of vulnerabilities, and the controls for your engagement are written down so your vendor risk review can test them. If your organisation is also an NCII entity under the Cyber Security Act 2024 (Act 854), the same incident channel is built to support its notification within six hours. Whether NIS2 or Act 854 applies to you is your own assessment.

  • Security terms in writing

    Access, subcontracting, incident notification and support for audits are set out in the contract, never taken for granted.

  • A tested incident channel

    Named contacts and agreed time limits, so that you learn of an incident at our end early enough for the 24-hour early warning of NIS2 (Article 23(4)) or the six-hour notice under Act 854.

  • Vulnerability management

    The delivery pipeline scans dependencies, code and infrastructure, and each finding is either fixed or reported to you through the channel in the contract.

  • Evidence when you ask

    Our ISO/IEC 27001 certificate, plus a written account of the controls that cover your engagement.

DORA and RMiT

DORA: ICT third-party risk for EU financial entities

Since 17 January 2025, Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA), has bound EU banks, insurers, investment firms, payment institutions and similar financial entities. Each of them must govern the risk of relying on outside ICT providers as part of its ICT risk framework, list every ICT services contract in a register of information (Article 28) and write key terms into those contracts (Article 30). Those terms reach ICT providers in Malaysia too.

When we supply ICT services to such an entity, we accept what Article 30 requires: a full account of the services, where they are delivered and where data is processed, support during an ICT incident, cooperation with the supervisors that oversee you and rights to end the contract. Services behind critical or important functions also bring exit strategies and our role in your resilience tests into the contract.

For banks, insurers and takaful operators at home, we design for Bank Negara Malaysia’s revised Risk Management in Technology (RMiT) policy document, in effect since 28 November 2025, and for capital market intermediaries for the Securities Commission Malaysia (SC) Guidelines on Technology Risk Management, revised with effect from 19 August 2024. We supply the details your DORA register needs and document exit plans from the outset, so switching stays a real option.

  • Financial servicesAI, resilient platforms and operations for financial institutions under RMiT and DORA.

EU AI Act

EU AI Act: oversight and documentation in the design

Regulation (EU) 2024/1689, the EU AI Act, comes into effect step by step. The bans on certain practices and the AI literacy duty took effect in February 2025, and the Article 50 transparency rules in August 2026. After its 2026 amendment by Regulation (EU) 2026/1744, the Act applies its Annex III high-risk rules from 2 December 2027. It can reach a provider in Malaysia in two ways: when the provider places an AI system on the EU market, or when the output of its system is used in the EU (Article 2(1)(a) and (c)).

A high-risk system needs technical documentation (Article 11), automatic event logs (Article 12) and a design that lets people oversee it in practice (Article 14), and the deployer must hand that oversight to staff who are competent and empowered to step in (Article 26). Our systems meet this from the first release: approval and override sit at each point where a decision affects a person, and documentation grows with the code.

Your role, provider or deployer, follows from the way the system is put into use. That is a legal question for your counsel; we provide the technical facts it requires. In Malaysia, the National Guidelines on AI Governance and Ethics (AIGE) are voluntary guidance, and we can map a design to them on request.

  • EU AI Act guideWhat applies now, what changes in December 2027 and how a provider can prepare.
  • AI Agents & AutomationAI agents with limited permissions, approval steps and complete logs.

In delivery

Security at each stage of delivery

Compliance evidence is a product of the daily work, not of a report written at the end.

  • Access on a least-privilege basis

    Team members reach only the environments and data a task needs; access is settled before work begins and reviewed whenever the team changes.

  • Changes reviewed and scanned

    A second engineer reviews each change before release. Scans of dependencies, code and infrastructure run automatically, and each release has a security test plan.

  • Incidents under an agreed procedure

    Incident classes, who is told and how evidence is kept are fixed at the outset and aligned with the PDPA breach notification, Act 854, NIS2 or DORA where these apply to you.

  • Handover and exit on record

    Runbooks, the record of architecture decisions and the data models go with the system at handover, and exit plans show the return of data and the cost of switching from day one.

Supplier due diligence

Request our evidence pack

Procurement, risk and legal staff want evidence before they sign. The pack can hold our ISO/IEC 27001 certificate with its scope, our replies to your vendor security questionnaire and the data processing terms that would govern your engagement.

Use the contact page and name the framework your supplier review follows, for example RMiT, the SC guidelines, the PDPA, NIS2 or DORA. A colleague with the right background will reply.

  • Contact usMention the evidence pack in your message.
  • Legal noticeCompany and registration data for your vendor file.

Malaysia

Malaysian rules at home, EU rules by contract

Since 1 June 2025 the PDPA requires a data controller to appoint a data protection officer where processing reaches the thresholds the Commissioner has set, and to notify a personal data breach to the Personal Data Protection Commissioner, within 72 hours under the Commissioner’s guidance. Affected data subjects are told within seven days of that notice where significant harm is likely. Section 129 now allows transfers out of Malaysia to a place with substantially similar law or adequate protection, or under one of its exceptions.

The Cyber Security Act 2024 (Act 854), in operation since 26 August 2024, gives NCII entities duties for risk assessment, audit and incident notification within six hours, with full details within fourteen days. We design for those timelines and claim no licence under the Act. Financial institutions add RMiT and the SC guidelines.

EU rules reach a Malaysian organisation mostly through customers and subsidiaries: NIS2 supplier clauses, DORA contract terms, the GDPR for data about people in the EU and the EU AI Act for systems whose output is used there. We build a single control set and link each incident channel to the authority that each party must inform.

Questions from procurement, risk and security teams

Does FromNine hold ISO/IEC 27001 certification?

Yes. The certification covers our information security management system. We share the certificate and its scope on request for your supplier assessment.

How do you help us meet NIS2 or Act 854 duties as a supplier?

The contract sets out security terms, the incident channel and the handling of vulnerabilities. We write down the controls that cover your engagement and hand you the evidence your vendor risk review asks for. Whether NIS2 or the Cyber Security Act 2024 applies to your organisation is a matter for you and your counsel.

Will you accept the contract terms DORA requires?

Yes. We accept the terms of Article 30 DORA, report incidents through the channel in the contract, keep exit plans current, take part in resilience tests and provide what your register of information requires. For a financial institution in Malaysia, the same documents can feed its own assessment under RMiT.

Who carries responsibility for AI Act compliance?

That follows from your role, provider or deployer, and from how much risk the use case carries. At discovery we place each use case in a risk class with you, then build oversight, logs and documentation into the system, and give your counsel the technical facts for the legal assessment.

Where is our data hosted, and can it leave Malaysia?

Where you and we agree and the contract records: your own cloud tenancy, a public cloud region you choose, or your own data centre for sensitive workloads. If personal data would leave Malaysia, we give you the facts for your transfer assessment under section 129 of the PDPA, and we document the choice together with its exit options.

How do we obtain your evidence pack?

Use the contact page. Tell us the documents you are looking for and the framework your supplier review follows, and a colleague with the right background will reply.

Ask us for the evidence

Name the framework your supplier review follows and the documents you are looking for. We will reply with what we can share and in what form.

Request evidence packAbout FromNine