For procurement, vendor management and compliance · Malaysia
You have to clear us before anyone can buy us.
Sastrum is built to pass a Malaysian regulated firm's outsourcing assessment: deployment your way, a security pack on request, and a contract written for regulated firms.
Your situation
A cloud vendor is an outsourcing decision, and the regulator will ask to see it.
Problems
- BNM's outsourcing and RMiT policies make cloud a notified decision, with a risk assessment and a contract the supervisor may read.
- Most vendors answer the security questionnaire slowly, partially, or with marketing.
- Data residency, access and exit terms get settled late, after the business has already chosen.
Needs
- Clear hosting options and regions, stated once and not changed in the sales cycle.
- A security pack that answers the questionnaire: data handling, access, continuity, testing, what is certified and what is not.
- A price model with no surprises, and a contract that fits the outsourcing policy.
Desires
- Clear a vendor in weeks, not months, with the documents already in hand.
- One contact who answers the same day.
What you would love
- A vendor who sends the due-diligence answers before you ask for them.
- An exit plan written into the contract from the start.
Three things that are different
Built to be assessed, not just bought.
- 01
Deployment your way.
SaaS, private cloud in your own account, or on-premise, the same product in each case. Hosting in or near Malaysia is stated in the contract, and the on-premise option keeps everything, including the AI models, in your data centre.
- 02
A security pack on request.
Data handling, hosting, access control, business continuity, a penetration test summary, and the certifications SecurEyes holds. Nothing is claimed that the pack cannot show.
- 03
A vendor you can assess.
SecurEyes, the company that built Sastrum, is a cyber security consultancy of twenty years that stands behind the product and the contract, and answers your due-diligence questionnaire itself.
Coverage for Malaysia
The standards your assessment will check against.
The frameworks your own firm answers to are mapped in the product, which is also what your assessment of us will measure.
Your regulators
Frameworks for you
- BNM RMiT
- BNM Shariah governance
- PayNet
- PDPA
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Islamic banks, DFIs, takaful operators, capital market intermediaries
BNM RMiT, Shariah governance, PayNet, PDPA
Why this matters now
The obligations are dated and the penalties are public.
Malaysian figures, each linked to its source.
RM1m
maximum fine for breaching the PDPA's data protection principles, from April 2025
72 hours
to notify the Personal Data Protection Commissioner of a significant data breach
6 hours
for an NCII entity to report incident details to NACSA
US$4.12m
average cost of a data breach in ASEAN, 2026
Start the assessment with the pack in hand.
Tell us which questionnaire you use and we will answer it, with the hosting options and a draft contract.