Meet the cast
- Aiman, IT manager of a state digital agency. Good at his job. Bad at sleeping.
- Kak Linda, senior system administrator. Has seen everything. Fears nothing, except printers.
- Hafiz, junior engineer. Six months into the job. Still believes deadlines are suggestions.
- Puan Glee (GLPI), the agency's record-keeper. Knows every asset by name, birthday and warranty date.
- Pak Nagi (Nagios XI), the night guard who never blinks. Notices every cough, wheeze and slowdown.
- Inspektor Waz (Wazuh), the detective. Reads every log, checks every fingerprint, trusts nobody.
All characters and organisations in this story are fictional. Any resemblance to your own IT department on a Monday morning is purely coincidental.
Part 1: The Email Nobody Wanted
It was a Monday. Of course it was a Monday.
Aiman had just sat down with his nasi lemak when the email arrived. The subject line was polite. The content was not.
Compliance review of National Critical Information Infrastructure systems. Scheduled: Friday, 9:00am. Please prepare the documents listed in the attached checklist.
Aiman's agency runs the state's online services portal: licence renewals, payment of assessment fees, public complaints. Under Malaysia's Cyber Security Act 2024 (Act 854), that makes it part of the country's National Critical Information Infrastructure (NCII). In plain words: if these systems go down or get hacked, a lot of people have a very bad day. So the law expects the agency to prove it is protecting them properly.
Aiman opened the checklist. The nasi lemak went cold.
Item one: Provide a complete and current inventory of all critical information assets.
Simple, right? Every IT department knows what it owns.
Aiman turned to Kak Linda. "How many servers do we have?"
"About forty," said Kak Linda.
He turned to Hafiz. "How many servers do we have?"
"Fifty-two," said Hafiz, confidently.
He asked the network vendor on the phone. "Depends what you count as a server, boss."
Three people. Three answers. Four days.
Aiman did what every great leader does in a crisis. He ordered more teh tarik.
Part 2: The Spreadsheet Graveyard
By Tuesday morning, the team had gathered every document they could find. It was less of an archive and more of an archaeological dig.
There was Server_List_FINAL.xlsx. There was Server_List_FINAL_v2.xlsx. And there was the dreaded Server_List_FINAL_v2_REAL_USE_THIS_ONE.xlsx, last edited in 2023 by someone who no longer worked there (does this seem familiar?).
The spreadsheets disagreed with each other on almost everything. One listed a database server that had been scrapped in 2021. It was still marked "Critical. Do not shut down." Somewhere, a recycling centre was hosting a very important ghost.
Then Hafiz found it. A row in the oldest spreadsheet that simply said:
DO_NOT_TOUCH_ASK_RAZAK
Nobody knew what it was. Nobody knew where it was. And Razak had retired last year to grow durian in Raub.
It got worse. The checklist also asked for:
- Proof that critical systems were monitored continuously
- Records of security incidents and how each one was handled
- Evidence of regular vulnerability checks
- Proof that changes to systems were approved and recorded
The team's evidence so far: a few screenshots, a printed uptime report from 2024 that someone had been using as a coaster, and Hafiz's sincere promise that "everything was fine, I checked."
Auditors, it turns out, do not accept sincere promises as evidence.
Kak Linda leaned back in her chair. "Aiman," she said slowly, "didn't we install a few tools last year? The ones Astiostech set up?"
Aiman blinked. They had. They had just never looked at them all together.
Part 3: Puan Glee Opens the Ledger
Aiman logged in to GLPI, the open-source IT asset and service management system the agency had been running quietly in the background for over a year.
This is where Puan Glee enters our story. Think of her as the auntie at the office who has a labelled folder for everything, including a folder for her folders.
While everyone else was busy, GLPI's automatic inventory had been doing its job every single day. Small agents on each machine had been reporting back what they were, where they lived, what software they ran, and what had changed.
Aiman clicked Assets. A clean list appeared.
Forty-seven servers. Not forty. Not fifty-two. Forty-seven, each one with:
- Its name, location and owner
- Operating system and installed software versions
- Warranty and support contract dates
- Which business service it supports (portal, payments, complaints)
- A full history of changes, linked to the tickets that approved them
Kak Linda read the list twice. "So I was wrong by seven."
"I was wrong by five," said Hafiz, proudly. "I win."
Then came the moment of truth. Aiman searched for the mysterious server. DO_NOT_TOUCH_ASK_RAZAK.
GLPI had it. Location: second floor, behind the pantry. Type: network printer. Status: active. Last ticket: "Paper jam again. Please help."
The most feared machine in the agency's history was a printer. Kak Linda, who fears only printers, felt deeply validated.
Puan Glee did not say "I told you so." But if a database could raise its eyebrows, hers would have reached the ceiling.
Item one on the checklist: done. In eleven minutes.
Part 4: The Three-Way Handshake
Wednesday was when the magic happened. Because an asset list alone doesn't pass an audit. The auditor would ask the next obvious questions: Are these systems healthy? Are they safe? And when something went wrong, what did you do about it?
That's when Aiman realised the real trick. His three tools were not three separate stories. They were one story told from three angles.
Pak Nagi brings the health records
Aiman opened Nagios XI, the infrastructure monitoring system. Pak Nagi had been on night shift every night for the past year, checking every server, network link and application on Puan Glee's list.
With a few clicks, Aiman pulled:
- Availability reports for each critical service, month by month
- Alert history showing every time a system slowed down, filled up or went offline
- Response times, showing how quickly each issue was noticed
The portal had been available 99.8% of the time over the year. The one big outage, in March, had been caught within two minutes. Pak Nagi had receipts for everything.
Inspektor Waz brings the case files
Next, Wazuh, the security monitoring platform. Inspektor Waz had been reading every log on every machine, looking for anything suspicious.
The evidence poured out:
- Login records, including failed attempts and unusual access times
- File integrity monitoring, showing any unexpected change to important system files
- Vulnerability scans, listing known weaknesses and when each was patched
- Compliance dashboards, mapping security controls to recognised frameworks
Hafiz scrolled through the dashboard. "Wait. Someone tried to log in to the payment server from overseas in July?"
"Four hundred times," said Kak Linda. "In ten minutes. Waz blocked them on attempt six."
"Why didn't I know about this?"
"You were on leave. At a durian farm in Raub, if I remember."
Hafiz decided not to ask any more questions.
Puan Glee ties the knot
Here's the part that impressed the team most. Every alert from Pak Nagi and every security event from Inspektor Waz had automatically created a ticket in GLPI. And each ticket showed the full story:
- Detected: when the alert was raised
- Assigned: who picked it up
- Action: what was done, in plain notes
- Closed: when it was resolved, and who confirmed it
The July login attack? Ticket number 2147. Detected by Wazuh at 2:13am. Assigned to Kak Linda at 2:15am. Attacker blocked, password policy reviewed, closed by 9:40am with a note: "Bad guys sent home. Coffee consumed."
Aiman sat back. For the first time since Monday, he smiled.
"We don't need to prepare evidence," he said. "We've been collecting it all year. We just never put it on one table."
Part 5: Friday, 9:00am
The auditor arrived exactly on time. Encik Kamal was calm, polite, and carried a checklist thicker than a Penang telephone directory.
"Let's start with your asset inventory," he said.
Aiman opened GLPI. Forty-seven servers. Every one with an owner, a location and a change history. Encik Kamal ticked a box.
"How do you know these systems are monitored continuously?"
Aiman opened Nagios XI. Twelve months of availability reports for every critical service. Another tick.
"What about security? Unauthorised access, file tampering, vulnerabilities?"
Aiman opened Wazuh. Login records, integrity checks, scan results and patch history. Tick, tick, tick.
Then came the question every IT manager dreads.
"I see a security alert in July. What happened next?"
In the past, this question would have triggered twenty minutes of searching through emails, WhatsApp groups and someone's notebook. Today, Aiman clicked once. Ticket 2147 opened. Detected, assigned, fixed, closed, all with timestamps.
Encik Kamal read it. He paused. He read the note about the coffee. A small smile appeared.
He wrote "Satisfactory" on his form.
Then he underlined it. Twice.
By 11:30am, the review was finished. The team had expected to spend Friday night rewriting documents. Instead, Aiman went home on time for the first time that week.
On Monday, the team held a small, respectful farewell ceremony for the three spreadsheets. Hafiz gave a short speech. The coaster was finally retired with honours.
What this story teaches us
Compliance under the Cyber Security Act 2024 isn't really about paperwork. It's about being able to answer three questions, at any moment, with proof:
Question the auditor asksTool that answers itEvidence it producesWhat do you have?GLPILive asset inventory, owners, locations, change historyIs it healthy?Nagios XIUptime reports, alert history, response timesIs it safe?WazuhLogin records, file integrity, vulnerability scans, compliance dashboardsWhat did you do about problems?GLPI + Wazuh + Nagios XITicket trail from detection to resolution
Any one of these tools is useful on its own. But auditors don't ask one question. They ask all of them, and they follow the thread from one answer to the next. When your tools are connected, the thread never breaks.
Key takeaways:
- Start with the asset list. You can't protect, monitor or report on what you don't know exists. GLPI fixes that first.
- Monitoring is evidence. Nagios XI's history proves your systems are watched continuously, not just on audit week.
- Security needs a paper trail. Wazuh finds the threats, and GLPI tickets prove you acted on them.
- Collect daily, not weekly. The best audit preparation is the work your tools already do every day.
- Fear printers. Kak Linda was right all along.
Frequently asked questions
What is the Cyber Security Act 2024 in Malaysia?
The Cyber Security Act 2024 (Act 854) is Malaysian law that sets cyber security requirements for organisations running National Critical Information Infrastructure (NCII), such as government services, banking, energy, healthcare and telecommunications. It is overseen by the National Cyber Security Agency (NACSA) and expects NCII entities to manage cyber risks, conduct assessments and audits, and report incidents.
What evidence do auditors usually ask for in an NCII compliance review?
Auditors typically want an up-to-date inventory of critical assets, proof of continuous monitoring, records of security incidents and how they were handled, results of vulnerability checks, and records showing that system changes were approved. The exact list depends on the sector and the assessor.
How does GLPI help with Cyber Security Act 2024 compliance?
GLPI is an open-source IT asset and service management system. It automatically keeps an inventory of hardware and software, records changes, and manages tickets for incidents and requests. This gives auditors a clear asset list and a full history of how every issue was handled.
What is the difference between Nagios XI and Wazuh?
Nagios XI monitors the health and performance of systems: whether servers, networks and applications are up, fast and working properly. Wazuh monitors security: logins, file changes, vulnerabilities and suspicious activity. Nagios XI tells you something is wrong. Wazuh tells you whether someone is causing it.
Do I need all three tools, or can I use just one?
Each tool is useful on its own, but together they cover the full audit trail: what you have (GLPI), whether it's healthy (Nagios XI), whether it's secure (Wazuh), and how problems were resolved (tickets linking all three). Using them together means no gaps when the auditor follows up with the next question.
Is your Friday covered?
If an auditor emailed you this Monday, how many of the questions above could you answer in eleven minutes?
Astiostech helps Malaysian organisations deploy and connect GLPI, Nagios XI and Wazuh into one evidence trail, so compliance becomes something your systems do every day, not something your team panics about every year.
Talk to Astiostech about getting audit-ready before the email arrives.