No person may provide a cybersecurity service unless licensed by the Authority. The First Schedule defines a cybersecurity service as one provided for reward to safeguard another person's computer or system, including vulnerability assessment and penetration testing, forensic examination, incident investigation and response, threat hunting, designing, selling, importing, exporting, installing, maintaining or servicing cybersecurity solutions, security monitoring, managed security controls, compliance assessment against the client's cybersecurity policy, advice on cybersecurity programmes and threats, and cybersecurity training. The application is in writing on the prescribed form with supporting documents and the fee; the Authority acknowledges it within fourteen days. The Authority's regime started on 1 March 2023 and unlicensed operation has been barred since 1 January 2024; an application is not a licence (the Authority fined an unlicensed provider 10,000 penalty units in August 2026). The Second Schedule penalty is the cost of damage caused and the value of the financial gain made.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.