VAPT Services in Maldives

VAPT for the Maldives' Cyber Security Act 2023

The Cyber Security Act (Act 17/2023) came into effect on 14 November 2023, establishing the Maldives' first national cybersecurity framework. The Act designates Critical Information Infrastructure (CII) operators — explicitly including telecom, banking, energy, and transport — as subject to formal cybersecurity obligations, enforced by the National Cyber Security Agency (NCSA), established under a Presidential Directive on 18 March 2024. NCSA also runs a National Cyber Security Strategy 2024–2029 and a National Baseline Cybersecurity Framework built on the "Essential Eight" model — a well-known best-practice framework whose mitigation strategies include patching, application control, and regular security testing. We scope our VAPT engagements to produce evidence directly usable against this baseline.

On banking specifically: the Cyber Security Act 2023 designates banking as CII requiring formal cybersecurity measures under NCSA oversight. Our research did not turn up a published Maldives Monetary Authority (MMA)-specific IT security or penetration-testing mandate for banks or NBFIs — this appears to be a genuine gap rather than something we've overlooked. Rather than claim a specific named MMA requirement we couldn't verify, we align engagements to the Act's CII obligations and NCSA's Essential Eight-based baseline framework.

On data protection: the Maldives does not yet have a comprehensive data protection law in force. Only a constitutional right to privacy applies today — Article 24 of the Constitution of the Maldives (2008) guarantees "respect for private and family life, home and private communications." A Privacy and Personal Data Protection Bill was released for public consultation in May 2023 and has since been submitted to Parliament, but it remains pending — not yet enacted law. We won't scope an engagement against a statute that doesn't exist; our reports are structured so the technical evidence they contain will still hold up once the Bill is passed.

• Cyber Security Act-aligned reporting — Findings and remediation evidence structured to support CII cybersecurity obligations under the Act.
• Essential Eight baseline coverage — Testing scope maps to NCSA's Essential Eight-based National Baseline Cybersecurity Framework, including its regular security-testing mitigation strategy.
• CII-sector awareness — Methodology accounts for CII obligations across banking, telecom, energy, and transport.
• Full VAPT scope — Network infrastructure, web applications, mobile apps, and APIs, following the same methodology detailed on our penetration testing services page.
• Remote delivery, on-site coordination available — Engagements delivered by our India-based technical bench, with on-site coordination available for CII-sector organisations that need it.

Why Maldives organisations choose eNeoteric

• India-based technical bench — A dedicated delivery team with financial-services and CII-sector engagement experience, coordinating remotely with on-site availability when required.
• Certified engineers — OSCP, CEH, and OSWE certified testers.
• Honest regulatory framing — We describe the Cyber Security Act 2023, NCSA's Essential Eight baseline, and the Maldives' current data protection gap accurately — no invented mandates, and no claiming a data protection law that hasn't been enacted.
• Clean, structured reports — CVSS-scored findings, proof-of-concept evidence, and remediation guidance suitable for NCSA-facing and board-level documentation.
• Re-test included — A complimentary re-test verifies every finding has been remediated.

Frequently asked questions

Does the Maldives have a data protection law?

Not yet. The Maldives does not currently have a comprehensive data protection law in force. Only a constitutional right to privacy applies — Article 24 of the Constitution of the Maldives (2008) — which covers "respect for private and family life, home and private communications." A Privacy and Personal Data Protection Bill was released for public consultation in May 2023 and has been submitted to Parliament, but it remains pending and has not been enacted. We flag this honestly rather than scoping an engagement against a law that doesn't yet exist.

Is penetration testing required for banks in the Maldives?

The Cyber Security Act 2023 designates banking as Critical Information Infrastructure (CII), requiring formal cybersecurity measures under National Cyber Security Agency (NCSA) oversight. During our research we did not find a separate, published Maldives Monetary Authority (MMA)-specific penetration-testing mandate for banks or NBFIs — so rather than claim a specific named requirement we can't verify, we align engagements to the Act's CII obligations and NCSA's Essential Eight-based baseline framework, which explicitly includes regular security testing as a mitigation strategy.

What is the Essential Eight framework, and how does it apply to VAPT?

The Essential Eight is a well-known cybersecurity best-practice framework covering mitigation strategies such as patching, application control, restricting administrative privileges, and regular security testing. NCSA's National Baseline Cybersecurity Framework is built on this model. We scope our VAPT engagements to generate evidence directly against the Essential Eight's testing-related expectations, so results map cleanly to what NCSA and CII-sector auditors look for.

Do you have an office in the Maldives?

No — eNeoteric does not have a physical office in the Maldives. Engagements are delivered remotely by our India-based technical team, with on-site coordination available for CII-sector clients (banking, telecom, energy, transport) that need it for kickoff, scoping, or sensitive on-premise testing.

How long does a typical VAPT engagement take in the Maldives?

Most single-application or network engagements run 7-12 business days from kickoff to draft report, depending on scope. Contact us with your requirements for an exact timeline.