On 9 November 2026, NACSA chief executive Ir. Dr. Megat Zuhairy Megat Tajuddin said Malaysia is exploring a Cyber Security Labelling Scheme for IoT products, so buyers can judge a device's security before purchase. He was discussing XCPE, malware that The Star reports is hardcoded into Android TV box firmware at manufacture. It reinstalls itself from protected system partitions, so a factory reset does not remove it. Infected boxes can be conscripted into botnets and used as residential proxies.
The strongest case for a label
Consumers cannot inspect firmware. A buyer comparing two TV boxes at a shop sees price and specifications, not whether the image was tampered with before shipping. That information gap is a classic market failure. A well-designed label is one of the lightest ways to close it, because it informs buyers without banning any product. NACSA frames the scheme this way, calling it an additional reference for buyers.
The case is stronger for XCPE-style threats because the victim can do nothing about them. Users cannot patch their way out of malware that survives a reset. The only real defences are not buying a compromised device in the first place and holding the supply chain accountable. A label is a plausible tool for the first of these.
What we know, and what we don't
The announcement is thin. According to RTM's report, Singapore's scheme will be the reference basis, NACSA's Cyber Security and Cryptology Development Centre (CSCDC) will work with certification bodies, and ASEAN discussions on a regional certification scheme will start with IoT products. The report gives no launch date, tier structure, legal basis, or word on whether participation would be mandatory.
The legal basis is a real question. NACSA's own page on the Cyber Security Act 2024 (Act 854) says the Act was gazetted on 26 June 2024 and came into operation on 26 August 2024. The scope it lists covers a National Cyber Security Committee, the Chief Executive's powers, National Critical Information Infrastructure (NCII) entities and sector leads, incident management for NCII, and licensing of cyber security service providers. Consumer-product labelling is not on that list. A voluntary label could run without new legislation. A mandatory one would likely need it.
What Singapore's model actually teaches
Singapore's scheme is useful as a template, but its record is mixed, and Malaysia should read the data rather than the headline. CSA's consumer guidance describes four levels:
- Level 1: basic requirements such as unique default passwords and software updates.
- Level 2: all mandatory requirements of international standards.
- Level 3: security-by-design plus third-party assessment of software binaries.
- Level 4: structured penetration tests by approved third-party labs.
CSA's public product register lists 888 registered products, 499 of them active. Of the 888, 668 sit at Level 1, about 75%, and only 8 reach Level 3. Level 1 shows a device meets baseline hygiene. It does not show the firmware image is clean, and a Level 1 label would not have flagged XCPE. The scheme's own manufacturer guidance bases its first tier on ETSI EN 303 645 baseline requirements. Those requirements concern how a product is designed and maintained. They are not a forensic check of what is on the chip.
That is the central design risk. If shoppers read a star on a box as "safe", a low tier could give false assurance for exactly the cheap devices where pre-installed malware is most likely. Consumers need to see what each tier means.
A proportionate design for Malaysia
Three choices would keep this scheme useful without becoming a barrier to market entry.
- Keep it voluntary at first, and make it testable. Mandating a label before the testing capacity exists would push small importers and retailers towards unlabelled grey-market channels. Those channels are where infected boxes thrive. Adoption by large retailers and telcos, who can require labels from suppliers, will do more than a statute.
- Put a firmware-integrity check in a higher tier, and say so on the label. If the stated concern is pre-installed malware, the tiers should test for it. Binary analysis, as in Singapore's Level 3, is the relevant control. Tier descriptions should be plain enough that a shopper knows what a given star level does and does not promise.
- Go after the actors, not just the product category. XCPE is a supply-chain crime. Enforcement against sellers who knowingly distribute infected devices, and prompt public advisories naming affected models, would reach the problem faster than a label can. A label should complement this, not replace it.
Regional recognition is also worth pursuing. CSA's own page lists recognition agreements with Finland, Germany, South Korea, the United Kingdom, and the Connectivity Standards Alliance. If ASEAN converges on a common IoT scheme, manufacturers could test once and sell across the region. That would be a real gain over ten diverging national labels. It only works if Malaysia avoids adding national-specific requirements to the common baseline.
Bottom line
A transparent, tiered, mostly voluntary label is a sound response to a real information problem, and borrowing Singapore's structure saves years of design work. The weaknesses are what the announcement leaves out: no timeline, no stated legal basis, and no word on how the label would detect tampered firmware. If NACSA fills those gaps with testable tiers and targeted enforcement, it will have built something useful. If it publishes a Level 1-style checklist and calls it protection against XCPE, it will have given consumers a reassuring sticker and little else.