Cybersecurity Certification Regulations, 2024

Suppliment tal-Gazzetta tal-Gvern ta’ Malta Nru. 21,266, 14 ta’ Ġunju, 2024

L.N. 133 of 2024

MALTA DIGITAL INNOVATION AUTHORITY ACT

(CAP. 591)

Cybersecurity Certification Regulations, 2024

IN EXERCISE of the powers conferred by article 58 of the Malta

Digital Innovation Authority Act, the Minister responsible for digital

economy, acting on the advice of the Malta Digital Innovation

Authority, has made the following regulations:-

(1) The title of these regulations is the Cybersecurity Citation and

scope.

Certification Regulations, 2024.

(2)

These regulations implement the requisites of the

provisions of Regulation (EU) 2019/881 of the European Parliament

and of the Council of 17 April 2019 on ENISA (the European Union

Agency for Cybersecurity) and on information and communications

technology cybersecurity certification and repealing Regulation (EU)

No 526/2013 (Cybersecurity Act).

(1)

In these regulations, unless the context otherwise Interpretation.

"Act" means the Malta Digital Innovation Authority Act;

"Authority" means the Malta Digital Innovation Authority

as established by article 5 of the Act;

"ECCG" means the European Cybersecurity Certification

Group;

"ENISA" means the European Union Agency for

Cybersecurity;

"national liaison officer" means the point of contact at

national level who facilitates cooperation between ENISA and

national experts in the context of the implementation of ENISA’s

annual work programme;

"Regulation (EU) 2019/881" means Regulation (EU) 2019/

881 of the European Parliament and of the Council of 17 April

2019 on ENISA (the European Union Agency for Cybersecurity)

and on information and communications technology

cybersecurity certification and repealing Regulation (EU) No

526/2013 (Cybersecurity Act).

(2) Unless the context otherwise requires, words and phrases

used in these regulations and in Regulation (EU) 2019/881 which are

not herein defined shall have the same meaning as that assigned to

them in the Act.

The Authority shall appoint a member and, or an alternate

to sit on the Management Board of ENISA on the basis of his

knowledge in the field of cybersecurity, taking into account his

relevant managerial, administrative and budgetary skills and in

accordance with the provisions of Regulation (EU) 2019/881.

The Authority shall appoint one (1) representative and, or

its alternate to the National Liaison Officers Network set up in

accordance with Article 23 of Regulation (EU) 2019/881.

ICT products, ICT services, ICT processes and managed

security services that have been certified under a European

cybersecurity certification scheme adopted pursuant to Article 49 of

Regulation (EU) 2019/881 shall in terms of Article 56 of Regulation

(EU) 2019/881 be presumed to comply with the requirements of such

scheme and the certificate shall have the effect intended by Regulation

(EU) 2019/881 in Malta.

(1) For the purposes of Article 58 of Regulation (EU)

2019/881, the Authority shall be designated as the national

cybersecurity certification authority responsible for the supervisory

tasks in Malta and shall have all the functions prescribed in Regulation

2019/881, including the function of

(a) supervising and enforcing rules included in European

cybersecurity certification schemes in accordance with Article

54(1)(j) of Regulation (EU) 2019/881, for the monitoring of

compliance of ICT products, ICT services, ICT processes and

managed security services with the requirements of the European

cybersecurity certificates that have been issued in Malta, in

cooperation with other relevant market surveillance authorities;

(b) monitoring compliance with and enforcing the

obligations of manufacturers or providers of ICT products, ICT

services, ICT processes or managed security services that are

established in Malta and that carry out conformity self-

assessment, and shall, in particular, monitor compliance with and

enforce the obligations of such manufacturers or providers

specified in Article 53(2) and (3) of Regulation (EU) 2019/881

and the corresponding European cybersecurity certification

scheme;

(c) without prejudice to Article 60(3) of Regulation (EU)

2019/881, actively assisting and supporting the national

accreditation bodies in the monitoring and supervision of the

activities of conformity assessment bodies, for the purposes of

Regulation (EU) 2019/881;

(d) monitoring and supervising the activities of the

public bodies accredited as conformity assessment bodies in

accordance with Article 56(5) Regulation (EU) 2019/881;

(e) where applicable, authorising conformity assessment

bodies in accordance with Article 60(3) of the Regulation (EU)

2019/881 and restrict, suspend or withdraw existing

authorisation where conformity assessment bodies infringe the

requirements of Regulation (EU) 2019/881 and these

regulations;

(f) handling complaints by natural or legal persons in

relation to European cybersecurity certificates issued by national

cybersecurity certification authorities or to European

cybersecurity certificates issued by conformity assessment

bodies in accordance with Article 56(6) of Regulation (EU)

2019/881 or in relation to EU statements of conformity issued

under Article 53 of Regulation (EU) 2019/881, and shall

investigate the subject matter of such complaints to the extent

appropriate, and shall inform the complainant of the progress and

the outcome of the investigation within a reasonable period;

(g) providing an annual summary report on the activities

conducted under paragraphs (b), (c) and (d) or under sub-

regulation (2) to ENISA and the ECCG;

(h) cooperating with other national cybersecurity

certification authorities or other public authorities, including by

sharing information on the possible non-compliance of ICT

products, ICT services, ICT processes and managed security

services with the requirements of these regulations and

Regulation (EU) 2019/881 or with the requirements of specific

European cybersecurity certification schemes;

(i) monitoring relevant developments in the field of

cybersecurity certification;

(j) participating in the ECCG in an active, effective,

efficient and secure manner for the effective implementation of

Regulation (EU) 2019/881;

(k) cooperating with other national cybersecurity

certification authorities and with the European Commission, in

particular, by exchanging information, experience and good

practices as regards cybersecurity certification and technical

issues concerning the cybersecurity of ICT products, ICT

services, ICT processes and managed security services; and

(l) participating in peer reviews with other national

cybersecurity certification authorities within the European Union

in accordance with Regulation (EU) 2019/881.

(2) Without prejudice to the Authority’s powers under the Act,

for the purpose of the implementation of Regulation (EU) 2019/881,

the Authority shall be empowered to

(a) request conformity assessment bodies, European

cybersecurity certificates’ holders and issuers of EU statements

of conformity to provide any information it requires for the

performance of its tasks;

(b) carry out investigations, in the form of audits of

conformity assessment bodies, European cybersecurity

certificates’ holders and issuers of EU statements of conformity,

for the purpose of verifying their compliance with Title III of

Regulation (EU) 2019/881;

(c) take appropriate measures, in accordance with the

laws of Malta, to ensure that conformity assessment bodies,

European cybersecurity certificates’ holders and issuers of EU

statements of conformity comply with Regulation (EU) 2019/

881 or with a European cybersecurity certification scheme;

(d) obtain access to the premises of any conformity

assessment bodies or holders of European cybersecurity

certificates, for the purpose of carrying out investigations in

accordance with Union or Maltese procedural law;

(e) withdraw, in accordance with the laws of Malta,

European cybersecurity certificates issued by the national

cybersecurity certification authorities or European cybersecurity

certificates issued by conformity assessment bodies in

accordance with Article 56(6) of Regulation (EU) 2019/881,

where such certificates do not comply with Regulation (EU)

2019/881 or with a European cybersecurity certification

scheme; and

(f)

impose penalties in accordance with the laws of

Malta, as provided for in Article 65 of Regulation (EU) 2019/

881, and to require the immediate cessation of infringements of

the obligations set out in Regulation (EU) 2019/881.

(3) Without prejudice to point (a) of Article 56(5) and Article

56(6) of Regulation (EU) 2019/881, the Authority shall be

independent of the entities it supervises in its organisation, funding

decisions, legal structure and decision-making.

(4) In terms of Article 58(4) of Regulation (EU) 2019/881, the

activities of the Authority that relate to the issuance of European

cybersecurity certificates referred to in point (a) of Article 56(5) and

Article 56(6) of Regulation (EU) 2019/881 shall be strictly separated

from its supervisory activities set out in Article 58 of the Regulation

(EU) 2019/881 and these activities shall be carried out independently

from each other.

(5) In accordance with the Act and subject to the provisions of

any other law in force in Malta relating to public procurement, the

Authority shall be empowered as stipulated in Article 58(5) of

Regulation (EU) 2019/881 to employ and engage any services and

procure the resources necessary to exercise its powers and functions

under these regulations and Regulation (EU) 2019/881 effectively and

efficiently.

(1)

The provisions of Part IX of the Act shall apply to

Right to an

effective

judicial remedy.

(a) decisions taken by the Authority pursuant to these

regulations, including with regard to the improper issuing,

failure to issue or recognition of a European cybersecurity

certificate held by natural and legal persons; and

(b) a failure of the Authority to act on a complaint filed

with the said Authority.

(2) Proceedings for a judicial remedy shall be brought before

the Civil Court (First Hall)

(a) from decisions taken by the conformity assessment

body located in Malta pursuant to these regulations, including

with regard to the improper issuing, failure to issue or

recognition of a European cybersecurity certificate held by

natural and legal persons; or

(b) due to the failure of the conformity assessment body

located in Malta to act on a complaint filed with the said

conformity assessment body.

Article 42 of the Act shall apply to infringements of these

Infringements.

regulations, infringements of the provisions of Title II of Regulation

(EU) 2019/881 and to infringements of European cybersecurity

certification schemes.

€0.27