434 tal-2011

B B 5480

L.N.

L.N. 434

434 of of 2011

L.N.

2011 434 of 2011

EUROPEAN

UNION

UNION CT

EUROPEAN

EUROPEAN

CT UNION CT

(CAP.

(CAP. 460)

460) (CAP. 460)

Critical

Critical Infrastructures

and

and European

Critical

Infrastructures

Infrastructures

Critical Infrastructures

European

and

Critical

European

Infrastructures

Critical Infrastructures

(Identification,

Designation

and

and Protection)

and Order,

Order, 2011

(Identification,

(Identification,

Designation Designation

Protection)

Protection)

2011 Order, 2011

BY

BY VIRTUE

of of VIRTUE

the

the powers

of conferred

powers by by

article

article 4(2)

by of

of the

VIRTUE

BY

powers

the

conferred

conferred

4(2)

article

the 4(2) of the

European

European Union

Act,

Act, the

the Prime

Act, Minister

has

made

made the

has following

Union

European

Union

Prime

Minister

the Prime

has

Minister

the

following

made the following

Order:-

Order:-

Order:-

1.

1. (1) (1) The

The title

(1) of of this

this order

is is this

the

the Critical

is Infrastructures

title

The

title

order

of

order

Critical

the

Infrastructures

Critical Infrastructures

Citation

and and

Citation

Citation and

scope.

scope.

scope.

and

and European

European

and

Critical

Critical

European

Infrastructures

Infrastructures

Critical Infrastructures

(Identification,

(Identification,

(Identification,

Designation

Designation and

Designation

and

and

Protection)

Protection) Order,

Order, 2011.

Protection)

2011. Order, 2011.

(2) (2) The

The purpose

of of this

this Order

of is is

the

transposition

of of Council

purpose

(2) The

purpose

Order

this

the Order

transposition

is the transposition

Council of Council

Directive

Directive 2008/114/EC

2008/114/EC

Directive 2008/114/EC

of of 8 8 December

December

of 2008

8 2008

December

on on the

the identification

identification

on the identification

and

and

and

designation

designation of designation

of European

European critical

infrastructures

and

and the

the assessment

and the of assessment

of critical

European

infrastructures

critical infrastructures

assessment

of

of

the

the need

need to to improve

need their

protection.

the

improve

to

their

improve

protection.

their protection.

[Article 4]

Procedure for the identification of critical infrastructures

which may be designated as an ECI.

In identifying critical infrastructures which may be designated

as an ECI pursuant to article 4, the Unit shall apply the following

consecutive steps

(1) In Step 1, the sectoral criteria referred to in article 4(7)

shall be applied in order to make a first selection of critical

infrastructures within each sector.

(2) In Step 2, the definition of the term "critical infrastructure"

in article 2 shall be applied to the potential ECI identified under Step

1. The significance of the impact shall be determined by using

national methods for identifying critical infrastructures or with

reference to the cross-cutting criteria set out in article 4(2). For

infrastructure providing an essential service, the availability of

alternatives and the duration of disruption or recovery or both shall be

taken into account.

(3) In Step 3, the trans-boundary element of the definition of

"ECI" in article 2 shall be applied to the potential ECI that has passed

the first two steps of this procedure. A potential ECI which does

satisfy the definition shall follow the next step of the procedure. For

infrastructure providing an essential service, the availability of

alternatives and the duration of disruption or recovery or both shall be

taken into account.

(4) In Step 4, the cross-cutting criteria set out in article 4(2)

shall be applied to the remaining potential ECIs. Such cross-cutting

criteria shall take into account -

(a)

the severity of impact;

(b)

for infrastructure providing an essential service, the

availability of alternatives; and

(c)

the duration of disruption or recovery or both.

A potential ECI which does not satisfy the cross-cutting criteria

shall not be considered to be an ECI.

€0.90

2.

2. Order

In In this

this Order

In this Order

Interpretation.

Interpretation. Interpretation.

"critical

"critical infrastructure"

or or "CI"

"CI" means

or an

an asset,

system

or or part

infrastructure"

"critical infrastructure"

means

"CI"

asset,

means

system

an asset,

part

system or part

thereof

thereof located

in in Malta

which

is is essential

which for

the

the maintenance

of of

located

thereof

Malta

located

which

in Malta

essential

is for essential

maintenance

for the maintenance

of

vital

vital societal

functions,

societal health,

safety,

security,

economic

or or

social

societal

vital

functions,

health,

functions,

safety,

health,

security,

safety,

economic

security,

economic

social or social

well-being

well-being of well-being

of people,

people, and

the

the disruption

and the or disruption

or destruction

or of

of which

of

and people,

disruption

destruction

destruction

which of which

would

would have

have a would

a significant

have a impact

in in a a Member

State

as as a a result

of of

the

significant

impact

significant

impact

Member

in

State

a Member

result

State

as

the

a result of the

failure

failure to to maintain

failure those

functions;

maintain

to

those

maintain

functions;

those functions;

"the

"the Directive"

"the means

means Council

Directive

Council 2008/114/EC

of of 8 8

Directive"

Directive"

Council

means

Directive

2008/114/EC

Directive 2008/114/EC

of 8

December

December 2008

on on the

identification

and

and designation

and of

of European

December

the

identification

on the identification

designation

designation

European

of European

critical

critical infrastructures

and

and the

the assessment

and the of assessment

of the

the need

need to of

to improve

need their

infrastructures

critical infrastructures

assessment

the

improve

to

their

improve their

protection,

protection, as protection,

as may

may be be amended

as may from

time

time to to time;

amended

be from

amended

from

time;

time to time;

"European

"European critical

critical infrastructure"

or or "ECI"

"ECI" means

critical

"European

infrastructure"

critical infrastructure"

or

means

"ECI"

critical

means critical

infrastructure

located

located in in Malta

the

the disruption

or or

destruction

or of destruction

of which

infrastructure

infrastructure

Malta

located

in disruption

Malta the

disruption

destruction

which of which

would

would have

have a would

a significant

have a impact

on on at at

least

least two

on Member

States.

The

significant

impact

significant

impact

two

at Member

least two

States.

Member

The States. The

significance

significance of

of the

the impact

of shall

the be

be assessed

shall in be

in terms

terms of of cross-cutting

significance

impact

shall

impact

assessed

assessed

in

cross-cutting

terms of cross-cutting

criteria

criteria which

shall

include

effects

resulting

effects from

cross-sector

which

criteria

shall which

include

shall

effects

include

resulting

from

resulting

cross-sector

from cross-sector

dependencies

on on other

other types

on of other

of infrastructure;

dependencies

dependencies

types

infrastructure;

types of infrastructure;

"Member

"Member State"

means

a Member

State

of of the

the European

Union;

State"

"Member

means

State"

a Member

means

State

a Member

State

European

of the

Union;

European Union;

"owners or operators of CIs" means those entities responsible

for investments in, and, or day-to-day operation of, a particular asset,

system or part thereof designated as a CI or an ECI under this Order;

"protection" means all activities aimed at ensuring the

functionality, continuity and integrity of critical infrastructures in

order to deter, mitigate and neutralise a threat, risk or vulnerability;

"risk analysis" means consideration of relevant threat scenarios

in order to assess the vulnerability and the potential impact of

disruption or destruction of critical infrastructure;

"sensitive critical infrastructure protection related information"

means facts about a critical infrastructure, which if disclosed could be

used to plan and act with a view to causing disruption or destruction

of critical infrastructure installations;

"the Unit" means the Malta Critical Infrastructure Protection

(CIP) Unit established under article 3.

[Article 4]

Procedure for the identification of critical infrastructures

which may be designated as an ECI.

In identifying critical infrastructures which may be designated

as an ECI pursuant to article 4, the Unit shall apply the following

consecutive steps

(1) In Step 1, the sectoral criteria referred to in article 4(7)

shall be applied in order to make a first selection of critical

infrastructures within each sector.

(2) In Step 2, the definition of the term "critical infrastructure"

in article 2 shall be applied to the potential ECI identified under Step

1. The significance of the impact shall be determined by using

national methods for identifying critical infrastructures or with

reference to the cross-cutting criteria set out in article 4(2). For

infrastructure providing an essential service, the availability of

alternatives and the duration of disruption or recovery or both shall be

taken into account.

(3) In Step 3, the trans-boundary element of the definition of

"ECI" in article 2 shall be applied to the potential ECI that has passed

the first two steps of this procedure. A potential ECI which does

satisfy the definition shall follow the next step of the procedure. For

infrastructure providing an essential service, the availability of

alternatives and the duration of disruption or recovery or both shall be

taken into account.

(4) In Step 4, the cross-cutting criteria set out in article 4(2)

shall be applied to the remaining potential ECIs. Such cross-cutting

criteria shall take into account -

(a)

the severity of impact;

(b)

for infrastructure providing an essential service, the

availability of alternatives; and

(c)

the duration of disruption or recovery or both.

A potential ECI which does not satisfy the cross-cutting criteria

shall not be considered to be an ECI.

€0.90

(1)

There shall be a body to be known as the Malta Critical

Critical Infrastructure Protection (CIP) Unit within Cabinet Office, Infrastructure

Protection Unit.

Office of the Prime Minister.

(2) The Unit shall be entrusted with the powers and duties

provided for in this Order.

(3) The Unit shall, inter alia, be responsible for -

(a)

establishing the criteria for the identification and

designation of CIs;

(b)

identifying critical assets and maintaining a

national inventory for CIs;

(c)

ensuring that a risk assessment is carried out by all

owners or operators of CIs;

(d)

ensuring that each owner or operator of a CI draws

up and maintains an Operator Security Plan;

(e)

collating a national critical infrastructure plan;

(f)

instigating simulated runs of sectoral emergency

plans;

(g)

collaborating with the European Union and

international partners on CIP; and

(h)

building partnerships with operators of CIs for

information-sharing.

(4) The Unit shall furthermore act as the European critical

infrastructure protection contact point ("ECIP contact point") in

Malta, and shall coordinate European critical infrastructure protection

issues within Malta, with other Member States, and with the

European Commission

Provided that the provisions of this sub-article shall not

preclude other national authorities from being involved in European

critical infrastructure protection issues.

(5) The Unit shall also perform such related and consequential

duties as the Prime Minister may delegate from time to time.

(1)

The Unit shall, in accordance with the procedure

set out in the Schedule, identify potential European Critical

Infrastructures in Malta which -

(a)

satisfy the cross-cutting and sectoral criteria set out

in this article; and

(b)

meet the definitions of the terms "critical

infrastructure" and "European critical infrastructure" in article

2. (2) The cross-cutting criteria referred to in sub-article (1) shall

comprise the following

(a)

casualties criterion, assessed in terms of the

potential number of fatalities or injuries;

(b)

economic effects criterion, assessed in terms of the

significance of economic loss and, or degradation of products or

services, including potential environmental effects;

(c)

public effects criterion, assessed in terms of the

impact on public confidence, physical suffering and disruption

of daily life, including the loss of essential services.

(3) The thresholds applicable to the cross-cutting criteria shall

be determined on a case-by-case basis by the Unit, and shall be based

on the severity of the impact of the disruption or destruction of a

particular critical infrastructure.

(4) The Unit shall inform the European Commission on an

annual basis of the number of infrastructures per sector for which

discussions were held concerning the cross-cutting criteria thresholds.

(5) The sectoral criteria referred to in sub-article (1) shall -

(a)

take into account the characteristics of individual

ECI sectors; and

(b)

be classified.

(6) In applying the cross-cutting and sectoral criteria with a

view to identifying ECIs, the Unit may use such guidelines and

thresholds as are developed by the European Commission together

with the Member States pursuant to Article 3 of the Directive.

(7) The following sectors and subsectors shall be subject to

this Order

(a)

the energy sector which is divided into the

following subsectors

(i) electricity, comprising infrastructures and

facilities for generation and transmission of electricity in

respect of supply of electricity,

(ii) oil, comprising oil production, refining,

treatment, storage and transmission by pipelines,

(iii) gas, comprising gas production, refining,

treatment, storage and transmission by pipelines, and LNG

terminals; and

(b)

the transport sector which is divided into the

following subsectors

(i)

road transport,

(ii) air transport,

(iii) ocean and short-sea shipping, and

(iv) ports.

(1)

The Unit shall inform the relevant authorities in Designation of

other Member States which may be significantly affected by a ECIs.

potential ECI about its identity and the reasons for its designation as a

potential ECI.

(2) A potential ECI located in Malta, which has passed

through the procedure set out in the Schedule shall only be

communicated to the Member States which may be significantly

affected by that potential ECI.

(3) Where a potential ECI is located in Malta, the Unit shall -

(a)

engage in discussions with the relevant authorities

in other Member States which may be significantly affected by

the potential ECI; and

(b)

designate it as an ECI following an agreement

between the Government of Malta and the Member States which

may be significantly affected.

(4) Where a designated ECI is located in Malta, the Unit shall

inform the European Commission on an annual basis of the number of

designated ECIs per sector and of the number of Member States

dependent on each designated ECI, and only the Member States

which may be significantly affected by an ECI shall know its identity.

(5) Where an ECI is located in Malta, the Unit shall inform the

owner or operator of the infrastructure concerning its designation as

an ECI and such information shall be classified at an appropriate

level.

(6) The process of identifying and designating ECIs under this

Order shall be reviewed on a regular basis.

(1)

The operator security plan ("OSP") procedure

shall -

(a)

identify the CI and ECI assets located in Malta;

(b)

identify the security solutions that exist or are

being implemented for their protection; and

(c)

cover, as a minimum, the information set out in

article 7.

(2) The Unit shall assess whether each designated CI and ECI

located in Malta possesses an OSP or has in place equivalent

measures addressing the issues identified in article 7.

(3) If the Unit finds that an OSP or equivalent measures have

not been prepared, it shall ensure, by any measures deemed

appropriate, that the OSP or equivalent measures are prepared

addressing the issues identified in article 7

Provided that, where supervisory or oversight arrangements

already exist in relation to a CI or an ECI located in Malta, such

arrangements are not affected by the provisions of this article and the

Unit shall be the supervisor under those existing arrangements

Provided further that compliance with any measure, including a

European Union measure, which in a particular sector requires, or

refers to a need to have, a plan similar or equivalent to an OSP and

oversight by the Unit of such a plan, shall be deemed to satisfy all the

requirements under this article.

(4) The Unit shall ensure that the OSP or equivalent measures

pursuant to this article are in place and are reviewed regularly within

one year following designation of each CI and each ECI

Provided that the said period may be extended in exceptional

circumstances, and the Unit shall notify the European Commission of

any extension granted in relation to an ECI pursuant to this sub-

article.

(1)

The ECI OSP procedure referred to in article 6 ECI OSP

Procedure.

shall cover at least the following matters

(a)

the identification of important assets;

(b)

the conduct of a risk analysis based on major threat

scenarios, vulnerability of each asset, and potential impact; and

(c)

the identification, selection and prioritisation of

counter-measures and procedures with a distinction between -

(i) permanent security measures, which identify

indispensable security investments and means which are

relevant to be employed at all times. These shall include

the information set out in sub-article (2); and

(ii) graduated security measures, which can be

activated according to varying risk and threat levels.

(2) The information referred to in sub-article (1)(c)(i) is

information concerning

(a)

general measures such as technical measures,

including installation of detection, access control, protection

and prevention means;

(b)

organisational measures, including procedures for

alerts and crisis management;

(c)

control and verification measures;

(d)

communication;

(e)

awareness raising and training; and

(f)

security of information systems.

(1)

The Unit shall assess whether each designated ECI

located in Malta possesses a Security Liaison Officer or equivalent,

who shall act as the point of contact for security related issues

between the owner or operator of the ECI and the Unit.

(2) If the Unit finds that a Security Liaison Officer or

equivalent does not exist in relation to a designated ECI it shall

ensure, by any measures deemed appropriate, that such a Security

Liaison Officer or equivalent is designated

Provided that compliance with any measure, including a

European Union measure, which in a particular sector requires, or

refers to a need to have, a Security Liaison Officer or equivalent shall

be deemed to satisfy all the requirements under this article.

(3) The Unit shall implement an appropriate communication

mechanism between itself and each Security Liaison Officer or

equivalent, with the objective of exchanging relevant information

concerning identified risks and threats in relation to the ECI

concerned. This communication mechanism shall be without

prejudice to the requirements concerning access to sensitive and

classified information laid down by any other law.

(1)

The Unit shall conduct a threat assessment in

relation to CI and ECI subsectors within one year following the

designation of critical infrastructure in Malta as a CI or an ECI within

those subsectors.

(2) Every two years the Unit shall submit to the European

Commission a classified report containing generic data on a summary

basis on the types of risks, threats and vulnerabilities encountered per

ECI sector in which an ECI has been designated under article 5.

(1)

Any person handling classified information

pursuant to this Order on behalf of the Unit or the Government of

Malta shall have an appropriate level of security vetting to be

determined by the Unit.

(2) The Unit shall ensure that sensitive critical infrastructure

protection-related information submitted to it is not used for any

purpose other than the protection of critical infrastructures.

(3) The provisions of this article shall also apply to non-

written information exchanged during meetings at which sensitive

subjects are discussed.