CRITICAL INFRASTRUCTURES AND EUROPEAN CRITICAL INFRASTRUCTURES (IDENTIFICATION, DESIGNATION AND

(IDENTIFICATION, DESIGNATION AND PROTECTION)

SUBSIDIARY LEGISLATION 460.24

CRITICAL INFRASTRUCTURES AND

EUROPEAN CRITICAL INFRASTRUCTURES

(IDENTIFICATION, DESIGNATION AND

PROTECTION) ORDER *

8th November, 2011

LEGAL NOTICE 434 of 2011, and as amended by Legal Notices 411 of

2017 and 306 of 2024.

(1) The title of this order is the Critical Infrastructures and

European Critical Infrastructures (Identification, Designation and

Protection) Order.

(2) The purpose of this Order is the transposition of Council

Directive 2008/114/EC of 8 December 2008 on the identification

and designation of European critical infrastructures and the

assessment of the need to improve their protection.

[Article 4]

Procedure for the identification of critical infrastructures

which may be designated as an ECI.

In identifying critical infrastructures which may be designated as an ECI pursuant

to article 4, the Department shall apply the following consecutive steps

(1) In Step 1, the sectoral criteria referred to in article 4(7) shall be applied in

order to make a first selection of critical infrastructures within each sector.

(2) In Step 2, the definition of the term "critical infrastructure" in article 2 shall

be applied to the potential ECI identified under Step 1.

The significance of the impact shall be determined by using national methods for

identifying critical infrastructures or with reference to the cross-cutting criteria set

out in article 4(2). For infrastructure providing an essential service, the availability

of alternatives and the duration of disruption or recovery or both shall be taken into

account.

(3) In Step 3, the trans-boundary element of the definition of "ECI" in article 2

shall be applied to the potential ECI that has passed the first two steps of this

procedure. A potential ECI which does satisfy the definition shall follow the next

step of the procedure. For infrastructure providing an essential service, the

availability of alternatives and the duration of disruption or recovery or both shall be

taken into account.

(4) In Step 4, the cross-cutting criteria set out in article 4(2) shall be applied to

the remaining potential ECIs. Such cross-cutting criteria shall take into account -

(a) the severity of impact;

(b) for infrastructure providing an essential service, the availability of

alternatives; and

(c) the duration of disruption or recovery or both.

A potential ECI which does not satisfy the cross-cutting criteria shall not be

considered to be an ECI.

In this Order

"critical infrastructure" or "CI" means an asset, system or part

thereof located in Malta which is essential for the maintenance of

vital societal functions, health, safety, security, economic or social

well-being of people, and the disruption or destruction of which

would have a significant impact in a Member State as a result of the

failure to maintain those functions;

"Department" means the Critical Infrastructure Protection

Department established by article 3;

"the Directive" means Council Directive 2008/114/EC of 8

December 2008 on the identification and designation of European

critical infrastructures and the assessment of the need to improve

their protection, as may be amended from time to time;

"European critical infrastructure" or "ECI" means critical

infrastructure located in Malta the disruption or destruction of

which would have a significant impact on at least two Member

States. The significance of the impact shall be assessed in terms of

cross-cutting criteria which shall include effects resulting from

cross-sector dependencies on other types of infrastructure;

"Member State" means a Member State of the European Union;

"owners or operators of CIs" means those entities responsible for

investments in, and, or day-to-day operation of, a particular asset,

system or part thereof designated as a CI or an ECI under this

Order;

"protection" means all activities aimed at ensuring the

functionality, continuity and integrity of critical infrastructures in

order to deter, mitigate and neutralise a threat, risk or vulnerability;

*These regulations have been repealed by Legal Notice 5 of 2026.

(IDENTIFICATION, DESIGNATION AND PROTECTION)

"risk analysis" means consideration of relevant threat scenarios

in order to assess the vulnerability and the potential impact of

disruption or destruction of critical infrastructure;

"sensitive critical infrastructure protection related information"

means facts about a critical infrastructure, which if disclosed could

be used to plan and act with a view to causing disruption or

destruction of critical infrastructure installations;

(1) There shall be a Government department to be known as

the Critical Infrastructure Protection Department which shall have

such functions as are assigned to it by law, including those set out in

this order.

(2) The Department shall be entrusted with the powers and

duties provided for in this Order.

(3)

The Department shall, inter alia, be responsible for -

(a) establishing the criteria for the identification and

designation of CIs;

(b) identifying critical assets and maintaining a national

inventory for CIs;

(c) ensuring that a risk assessment is carried out by all

owners or operators of CIs;

(d) ensuring that each owner or operator of a CI draws up

and maintains an Operator Security Plan;

(e) collating a national critical infrastructure plan;

(f)

instigating simulated runs of sectoral emergency

plans;

(g) collaborating with the European

Union

and

international partners on CIP; and

(h) building partnerships with operators of CIs for

information-sharing.

(4) The Department shall furthermore act as the European

critical infrastructure protection contact point ("ECIP contact

point") in Malta, and shall coordinate European critical

infrastructure protection issues within Malta, with other Member

States, and with the European Commission

Provided that the provisions of this sub-article shall not

p re c lu de o th e r na t i on a l a u th o ri ti e s f ro m b e i ng i n vo lv e d i n

European critical infrastructure protection issues.

(5) The Department shall also perform such related and

consequential duties as the Minister responsible for Home Affairs

may delegate from time to time.

(1) The Department shall, in accordance with the

procedure set out in the Schedule, identify potential European

Critical Infrastructures in Malta which -

(a) satisfy the cross-cutting and sectoral criteria set out in

this article; and

(IDENTIFICATION, DESIGNATION AND PROTECTION)

(b) meet the definitions of the terms "critical

infrastructure" and "European critical infrastructure"

in article 2.

(2) The cross-cutting criteria referred to in sub-article (1) shall

comprise the following

(a) casualties criterion, assessed in terms of the potential

number of fatalities or injuries;

(b) economic effects criterion, assessed in terms of the

significance of economic loss and, or degradation of

products

or

services,

including

potential

environmental effects;

(c) public effects criterion, assessed in terms of the impact

on public confidence, physical suffering and

disruption of daily life, including the loss of essential

services.

(3) The thresholds applicable to the cross-cutting criteria shall

be determined on a case-by-case basis by the Department, and shall

be based on the severi ty of the impact of the disrupt ion or

destruction of a particular critical infrastructure.

(4) The Department shall inform the European Commission on

an annual basis of the number of infrastructures per sector for

which discussions were held concerning the cross-cutting criteria

thresholds.

(5)

The sectoral criteria referred to in sub-article (1) shall -

(a) take into account the characteristics of individual ECI

sectors; and

(b) be classified.

(6) In applying the cross-cutting and sectoral criteria with a

view to identifying ECIs, the Department may use such guidelines

and thresholds as are developed by the European Commission

together with the Member States pursuant to Article 3 of the

Directive.

(7) The following sectors and subsectors shall be subject to this

Order

(a) the energy sector which is divided into the following

subsectors

(i)

electricity, comprising infrastructures and

facilities for generation and transmission of

electricity in respect of supply of electricity,

(ii) oil, comprising oil production, refining,

treatment, storage and transmission by pipelines,

(iii) gas, comprising gas production, refining,

treatment, storage and transmission by pipelines,

and LNG terminals; and

(b) the transport sector which is divided into the following

subsectors

(IDENTIFICATION, DESIGNATION AND PROTECTION)

(i)

road transport,

(ii)

air transport,

(iii)

ocean and short-sea shipping, and

(iv)

ports.

(1) The Department shall inform the relevant authorities in

other Member States which may be significantly affected by a

potential ECI about its identity and the reasons for its designation

as a potential ECI.

(2) A potential ECI located in Malta, which has passed through

the procedure set out in the Schedule shall only be communicated

to the Member States which may be significantly affected by that

potential ECI.

(3) Where a potential ECI is located in Malta, the Department

shall -

(a) engage in discussions with the relevant authorities in

other Member States which may be significantly

affected by the potential ECI; and

(b) designate it as an ECI following an agreement between

the Government of Malta and the Member States

which may be significantly affected.

(4) Where a designated ECI is located in Malta, the Department

shall inform the European Commission on an annual basis of the

number of designated ECIs per sector and of the number of

Member States dependent on each designated ECI, and only the

Member States which may be significantly affected by an ECI shall

know its identity.

(5) Where an ECI is located in Malta, the Department shall

inform the owner or operator of the infrastructure concerning its

designation as an ECI and such information shall be classified at an

appropriate level.

(6) The process of identifying and designating ECIs under this

Order shall be reviewed on a regular basis.

(1)

The operator security plan ("OSP") procedure shall -

(a) identify the CI and ECI assets located in Malta;

(b) identify the security solutions that exist or are being

implemented for their protection; and

(c) cover, as a minimum, the information set out in article

(2) The Department shall assess whether each designated CI

and ECI located in Malta possesses an OSP or has in place

equivalent measures addressing the issues identified in article 7.

(3) If the Department finds that an OSP or equivalent measures

have not been prepared, it shall ensure, by any measures deemed

appropriate, that the OSP or equivalent measures are prepared

addressing the issues identified in article 7

(IDENTIFICATION, DESIGNATION AND PROTECTION)

Provided that, where supervisory or oversight arrangements

already exist in relation to a CI or an ECI located in Malta, such

arrangements are not affected by the provisions of this article and

the Department shall be the supervisor under those existing

arrangements

Provided further that compliance with any measure,

including a European Union measure, which in a particular sector

requires, or refers to a need to have, a plan similar or equivalent to

an OSP and oversight by the Department of such a plan, shall be

deemed to satisfy all the requirements under this article.

(4) The Department shall ensure that the OSP or equivalent

measures pursuant to this article are in place and are reviewed

regularly within one year following designation of each CI and

each ECI

Provided that the said period may be extended in

exceptional circumstances, and the Department shall notify the

European Commission of any extension granted in relation to an

ECI pursuant to this sub-article.

7. (1) The ECI OSP procedure referred to in article 6 shall

cover at least the following matters

(a) the identification of important assets;

(b) the conduct of a risk analysis based on major threat

scenarios, vulnerability of each asset, and potential

impact; and

(c) the identification, selection and prioritisation of

counter-measures and procedures with a distinction

between -

(i)

permanent security measures, which identify

indispensable security investments and means

which are relevant to be employed at all times.

These shall include the information set out in

sub-article (2); and

(ii) graduated security measures, which can be

activated according to varying risk and threat

levels.

(2) The information referred to in sub-article (1)(c)(i) is

information concerning

(a) general measures such as technical measures,

including installation of detection, access control,

protection and prevention means;

(b) organisational measures, including procedures for

alerts and crisis management;

(c) control and verification measures;

(d) communication;

(e) awareness raising and training; and

(f)

security of information systems.

(IDENTIFICATION, DESIGNATION AND PROTECTION)

(1) The Department shall assess whether each designated

ECI located in Malta possesses a Security Liaison Officer or

equivalent, who shall act as the point of contact for security related

issues between the owner or operator of the ECI and the

Department.

(2) If the Department finds that a Security Liaison Officer or

equivalent does not exist in relation to a designated ECI it shall

ensure, by any measures deemed appropriate, that such a Security

Liaison Officer or equivalent is designated

Provided that compliance with any measure, including a

European Union measure, which in a particular sector requires, or

refers to a need to have, a Security Liaison Officer or equivalent

shall be deemed to satisfy all the requirements under this article.

(3) The Department shall implement an appropriate

communication mechanism between itself and each Security

Liaison Officer or equivalent, with the objective of exchanging

relevant information concerning identified risks and threats in

relation to the ECI concerned. This communication mechanism

shall be without prejudice to the requirements concerning access to

sensitive and classified information laid down by any other law.

(1) The Department shall conduct a threat assessment in

relation to CI and ECI subsectors within one year following the

designation of critical infrastructure in Malta as a CI or an ECI

within those subsectors.

(2) Every two years the Department shall submit to the

European Commission a classified report containing generic data

on a summary basis on the types of risks, threats and vulnerabilities

encountered per ECI sector in which an ECI has been designated

under article 5.

(1) Any person handling classified information pursuant

to this Order on behalf of the Department or the Government of

Malta shall have an appropriate level of security vetting to be

determined by the Department.

(2) The Department shall ensure that sensitive critical

infrastructure protection-related information submitted to it is not

used for any purpose other than the protection of critical

infrastructures.

(3) The provisions of this article shall also apply to non-written

information exchanged during meetings at which sensitive subjects

are discussed.

(IDENTIFICATION, DESIGNATION AND PROTECTION)