{
  "id": 19461178,
  "title": "Ensuring a sovereign and secure AI cloud",
  "url": "https://urgent.news/2026/11/11/ensuring-a-sovereign-and-secure-ai-cloud",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-11T06:20:05.000Z",
  "source": {
    "name": "New Straits Times",
    "slug": "new-straits-times",
    "url": "https://www.nst.com.my/opinion/letters/2026/11/1575349/ensuring-sovereign-and-secure-ai-cloud"
  },
  "original_language": "en",
  "account": "Ensuring a secure AI cloud is a crucial aspect of digital sovereignty. The Sovereign AI Cloud, announced in the 2027 Budget, aims to keep Malaysia's data and strategic information under national control. However, merely being sovereign does not guarantee security. As AI systems become more prevalent in critical sectors, industries, and public services, the risks they pose are more complex and multifaceted. The National Cyber Security Agency (Nacsa) has recognized this in its 2026 AI Systems Cyber Security Framework, which identifies threats such as data poisoning, prompt injection, model theft, unauthorized access, and attacks on the AI supply chain. These threats not only aim to breach a system but also interfere with the data, instructions, and outputs of AI systems. Therefore, the principle of Secure-by-Design is crucial for the Sovereign AI Cloud. This principle mandates that cybersecurity must be built into an AI system from its inception, rather than added as an afterthought. For the Sovereign AI Cloud, this means prioritizing data protection, access controls, third-party components, continuous monitoring, testing, and incident response right from the design stage. While Malaysia already has the Cyber Security Act 2024, Nacsa, and an AI-specific cybersecurity framework, the challenge now is to ensure these measures are consistently applied in the systems being developed. Before the Sovereign AI Cloud moves from policy to implementation, the government must clarify how Nacsa's Secure-by-Design principles will be integrated into its architecture, procurement requirements, and partnerships with technology providers. Security testing, continuous monitoring, third-party risk management, and incident response are not secondary considerations; they must be integral to the system's design. Nacsa has provided the framework, but it now needs to actively shape the systems that will be built. If the Sovereign AI Cloud's aim is to keep the rakyat's data and the nation's strategic information under Malaysian control, then its infrastructure must be secure from inception to deployment.",
  "summary": "LETTERS: Cybersecurity policy should be driven by what Malaysia is building and how well those systems are prepared for emerging threats.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}