Kota Kinabalu: Small businesses with limited budgets should consider listing critical assets, securing accounts and running regular recovery drills, said OC Global Technology Chief Innovation Officer Mohamad Fazuan Mohd Wafat.
“For small companies, they need to start with the things that can stop their business,” he said at the 10th Malaysia Digital Economy Forum 2026.
He shared three priority actions he believes are most useful for small and medium enterprises with limited budget and no internal cybersecurity team.
“Firstly, they need to list out anything related to their system, data and accounts, and assign one responsible person for each.
“Secondly, they need to protect their bank, cloud and system accounts, using two-factor authentication and periodically updating their systems.
“Third is to do a regular drill of their backup plan or standard operating procedures,” said Fazuan, who was among the invited panellists at the forum’s Pillar 3 discussion on Cybersecurity and Digital Resilience.
The event is organised by the Malaysia Digital Chamber of Commerce Sabah Chapter.
He said businesses could hand technical work to external providers but, in his opinion, decision-making authority should remain with owners and senior management.
“Even though we can assign people with technical skills, the senior management is the one who decides for the business.
“Every technical matter we can give to skilled providers, but the owners still have to decide the direction of their business,” he said.
Asked about the broader action he felt Malaysia should prioritise within the next 12 months, he repeated his view that identifying critical assets, testing recovery plans and strengthening standard operating procedures mattered most.
“I would emphasise three things, first list all your critical things, second do a simple recovery drill regularly, and third improvise your plan and your standard operating procedures.
“So, when anything happens, you have a backup plan,” he said.
He believes that having a tested backup is valuable in the event of a ransomware attack.
“Whenever ransomware happens, if we have a backup, the authority has the option to pay or not pay the ransom,” he said.
