MT
MEASURES FOR A HIGH COMMON LEVEL OF CYBERSECURITY ACROSS THE EUROPEAN UNION (MALTA) ORDER (malta)
Table of Provisions (47)
Statutory Text (47 Articles)
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
SUBSIDIARY LEGISLATION 460.41
MEASURES FOR A HIGH COMMON LEVEL OF
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA) ORDER
23rd January, 2026
LEGAL NOTICE 71 of 2025, as amended by Legal Notice 89 of
2026. PART I - PRELIMINARY
(1)
The title of this order is Measures for a High
Common Level of Cybersecurity across the European Union (Malta)
Order.
(2)
The scope of this order is to transpose Directive (EU)
2022/2555 of the European Parliament and of the Council of 14
December 2022 on measures for a high common level of cybersecurity
across the Union, amending Regulation (EU) No 910/2014 and
Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148
(NIS 2 Directive).
Substituted
by:
Sectors, Subsectors,
L.N. 89 of
Types of Entities of High Criticality and Competent
2026. Authorities
(in accordance with article 4)
Sector
Subsectors
Type of entity/entities
Competent authority/
authorities
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
1. Energy
(a) Electricity
(i) Electricity undertakings as defined in Article 2, point (57), of
Directive (EU) 2019/944 of the European Parliament and of the
Council, which carry out the function of "supply" as defined in
Article 2, point (12), of said Directive;
(ii) Distribution system operators as defined in Article 2, point
(29), of Directive (EU) 2019/944;
(iii) Transmission system operators as defined in Article 2, point
(35), of Directive (EU) 2019/944;
CIP Department as the
national supervisory authority.
(iv) Producers as defined in Article 2, point (38), of Directive
(EU) 2019/944;
(v) Nominated electricity market operators as defined in Article 2,
point (8), of Regulation (EU) 2019/943 of the European
Parliament and of the Council;
(vi) Market participants as defined in Article 2, point (25), of
Regulation (EU) 2019/943 providing aggregation, demand
response or energy storage services as defined in Article 2, points
(18), (20) and (59), of Directive (EU) 2019/944;
(vii) Operators of a recharging point that are responsible for the
management and operation of a recharging point, which provides a
recharging service to end users, including in the name and on
behalf of a mobility service provider.
(b) District heating
(i) Operators of district heating or district cooling as defined in
CIP Department as the
and cooling
Article 2, point (19), of Directive (EU) 2018/2001 of the European
national supervisory authority.
Parliament and of the Council.
(c) Oil
(i) Operators of oil transmission pipelines;
(ii) Operators of oil production, refining and treatment facilities,
CIP Department as the
storage and transmission;
national supervisory authority.
(iii) Central stockholding entities as defined in Article 2, point (f),
of Council Directive 2009/119/EC;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(d) Gas
(i) Supply undertakings as defined in Article 2,
point (8), of Directive 2009/73/EC of the European Parliament and
of the Council;
(ii) Distribution system operators as defined in Article 2, point (6),
of Directive 2009/73/EC;
CIP Department as the
national supervisory authority.
(iii) Transmission system operators as defined in
Article 2, point (4), of Directive 2009/73/EC;
(iv) Storage system operators as defined in Article 2, point (10), of
Directive 2009/73/EC;
(v) LNG system operators as defined in Article 2, point (12), of
Directive 2009/73/EC;
(vi) Natural gas undertakings as defined in Article 2, point (1), of
Directive 2009/73/EC;
(vii) Operators of natural gas refining and treatment facilities.
(e) Hydrogen
(i) Operators of hydrogen production, storage and transmission
CIP Department as the
operators.
national supervisory authority.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
2. Transport
(a) Air
(i) Air carriers as defined in Article 3, point (4), of Regulation
(EC) No 300/2008 used for commercial purposes;
(ii) Airport managing bodies as defined in Article 2, point (2), of
CIP Department as the
Directive 2009/12/EC of the European Parliament and of the
national supervisory authority.
Council, airports as defined in Article 2, point (1), of said
Directive, including the core airports listed in Section 2 of Annex
II to Regulation (EU) No 1315/2013 of the European Parliament
and of the Council, and entities operating ancillary installations
contained within airports;
(iii) Traffic management control operators providing air traffic
control (ATC) services as defined in Article 2, point (1), of
Regulation (EC) No 549/2004 of the European Parliament and of
the Council.
(b) Rail
(i) Infrastructure managers as defined in Article 3, point (2), of
Not applicable.
Directive 2012/34/EU of the European Parliament and of the
Council;
(ii) Railway undertakings as defined in Article 3, point (1), of
Directive 2012/34/EU and operators of service facilities as defined
in Article 3, point (12), of said Directive.
(c) Water
(i) Inland, sea and coastal passenger and freight water transport
CIP Department as the
companies, as defined for maritime transport in Annex I to
national supervisory authority.
Regulation (EC) No 725/2004, not including the individual vessels
operated by those companies.
(ii) Managing bodies of ports as defined in Article 3, point (1), of
Directive 2005/65/EC, including their port facilities as defined in
Article 2, point (11), of Regulation (EC) No 725/2004, and entities
operating works and equipment contained within ports
(iii) Operators of vessel traffic services (VTS) as defined in
Article 3, point (o), of Directive 2002/59/EC of the European
Parliament and of the Council.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(d) Road
(i) Road authorities as defined in Article 2, point (12), of
CIP Department as the
Commission Delegated Regulation (EU) 2015/962 responsible for
national supervisory authority.
traffic management control, excluding public entities for whom
traffic-management or the operation of intelligent transport
systems is a non-essential part of their general activity;
(ii) Operators of Intelligent Transport Systems as defined in
Article 4, point (1), of Directive 2010/40/EU of the European
Parliament and of the Council.
(e) Public Transport
(i) Public service operators as defined in Article 2,
CIP Department as the
point (d), of Regulation (EC) No 1370/2007 of
national supervisory authority.
the European Parliament and of the Council.
3. Banking
(i) Credit institutions as defined in Article 4, point (1), of
CIP Department as the
Regulation (EU) No 575/2013.
national supervisory authority.
4. Financial Market
(i) Operators of trading venues as defined in Article 4, point (24),
CIP Department as the
Infrastructure
of Directive 2014/65/EU.
national supervisory authority.
(ii) Central counterparties (CCPs) as defined in Article 2, point
(1), of Regulation (EU) No 648/2012.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
5. Health
(i) Healthcare providers as defined in Article 3, point (g), of
Directive 2011/24/EU of the European Parliament and of the
Council;
(ii) EU reference laboratories as referred to in Article 15 of
Regulation (EU) 2022/2371 of the European Parliament and of the
Council;
CIP Department as the
national supervisory authority.
(iii) Entities carrying out research and development activities of
medicinal products as defined in Article 1, point (2), of Directive
2001/83/EC of the European Parliament and of the Council;
(iv) Entities manufacturing basic pharmaceutical products and
pharmaceutical preparations as referred to in Section C division 21
of NACE Rev. 2
(v) Entities manufacturing medical devices considered as critical
during a public health emergency, "public health emergency
critical devices list", within the meaning of Article 22 of
Regulation (EU) 2022/123 of the European Parliament and of the
Council;
(vi) Entities holding a distribution authorization as referred to in
Article 79 of Directive 2001/83/EC.
6. Drinking water
(i) Suppliers and distributors of water intended for human
CIP Department as the
consumption as defined in Article 2, point (1)(a), of Directive
national supervisory authority.
(EU) 2020/2184 of the European Parliament and of the Council,
excluding distributors for which distribution of water for human
consumption is a non-essential part of their general activity of
distributing other commodities and goods;
7. Waste water
(i) Undertakings collecting, disposing of or treating urban waste
CIP Department as the
water, domestic waste water or industrial waste water as defined in
national supervisory authority.
Article 2, points (1), (2) and (3), of Council Directive 91/271/
EEC, excluding undertakings for which collecting, disposing of or
treating urban waste water, domestic waste water or industrial
waste water is a non-essential part of their general activity.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
8. Digital
(i) Providers of internet exchange points;
infrastructure
(ii) DNS service providers as excluding operators of root name
servers;
(iii) Top-level-domain name registries;
Malta Communications
Authority (MCA).
(iv) Providers of cloud computing services;
(v) Providers of data center services;
(vi) Providers of content delivery networks;
(vii) Trust service providers;
(viii)Providers of electronic communications services;
(ix) Providers of publicly available electronic communications
services.
9. ICT services
(i) Managed service providers;
CIP Department as the
management
national supervisory authority.
(business-to-
business)
(ii) Managed security service providers.
10. Public
(i) Public administration entities of central governments and at
administration
regional level as defined by Member States in accordance with
national law;
CIP Department as the
national supervisory authority.
(ii) Public administration entities that provide broadcasting and
transmission services deliver essential and emergency services,
including public safety alerts, by offering radio broadcasts and
emergency announcements in both analogue and digital formats.
11. Space
(i) Operators of ground-based infrastructure, owned, managed and
CIP Department as the
operated by Member States or by private parties, that support the
national supervisory authority.
provision of space-based services, excluding providers of public
electronic communications networks as defined in Article 2, point
(8), of Directive (EU) 2018/1972;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(1)
In this order unless the context otherwise requires
"autonomous CSIRT" means an outsourced CSIRT
which provides a monitoring function of CSIRT services to
essential or important entities;
"background check" means a background check as
defined in Directive (EU) 2022/2557;
"Charter" means the Charter of Fundamental Rights of
the European Union;
"CIP Department" means the Critical Infrastructure
Protection Department as established by virtue of article 7;
"cloud computing service" means a digital service that
enables on-demand administration and broad remote access to a
scalable and elastic pool of shareable computing resources,
including where such resources are distributed across several
locations. For the purposes of this definition
(i)
computing
resources
shall
include
resources such as networks, servers or other
infrastructure, operating systems, software, storage,
applications and services. The service models of cloud
computing include, inter alia, Infrastructure as a Service
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(IaaS), Platform as a Service (PaaS), Software as a
Service (SaaS) and Network as a Service (NaaS). The
deployment models of cloud computing shall include
private, community, public and hybrid cloud;
(ii)
the cloud computing service and
deployment models shall have the same meaning as the
terms of service and deployment models defined under
ISO/IEC 17788:2014 standard;
(iii) the capability of the cloud computing user
to unilaterally self-provision computing capabilities, such
as server time or network storage, without any human
interaction by the cloud computing service provider may
be described as on-demand administration;
(iv) the term "broad remote access" is used to
describe that the cloud capabilities are provided over the
network and accessed through mechanisms promoting use
of heterogeneous thin or thick client platforms, including
mobile phones, tablets, laptops and workstations;
(v)
the term "scalable" refers to computing
resources that are flexibly allocated by the cloud service
provider, irrespective of the geographical location of the
resources, in order for the resources provided to handle
fluctuations in demand;
(vi) the term "elastic pool" is used to describe
computing resources that are provided and released
according to demand in order to rapidly increase and
decrease resources available depending on workload.
(vii) the term "shareable" is used to describe
computing resources that are provided to multiple users
who share a common access to the service, but where the
processing is carried out separately for each user,
although the service is provided from the same electronic
equipment;
(viii) the term "distributed" is used to describe
computing resources that are located on different
networked computers or devices and which communicate
and coordinate among themselves by message passing;
"Commission Recommendation 2003/361/EC" means the
Commission Recommendation of 6 May 2003 concerning the
definition of micro, small and medium-sized enterprises;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
"Committee" means the
Enforcement
Committee
established by virtue of article 5;
"competent authority" means the Critical Infrastructure
Protection Department or any authority as may from time to
time be designated by the Prime Minister under article 7;
"consumer" means a consumer as defined in article 2 of
the Consumer Affairs Act;
"content delivery network" means a network of
geographically distributed servers for the purpose of ensuring
high availability, accessibility or fast delivery of digital content
and services to internet users on behalf of content and service
providers;
"Cooperation Group" means the Cooperation Group
established in accordance with Article 14 of Directive (EU)
2022/2555 of the European Parliament and of the Council of
14 December 2022 on measures for a high common level of
cybersecurity across the Union, amending Regulation (EU)
No 910/2014 and Directive (EU) 2018/1972, and repealing
Directive (EU) 2016/1148 (NIS 2 Directive);
"coordinated vulnerability disclosure" means a structured
process through which potential vulnerabilities pertaining to
ICT products, ICT processes or ICT services could be identified
and reported to the entity. Coordinated vulnerability disclosure
also includes coordination between the reporting natural or
legal person and the entity of the potentially vulnerable ICT
products, ICT processes or ICT services;
"critical information infrastructure" or "CII" means an
information and communication technology assets, systems,
networks or part thereof which are essential for the maintenance
of vital societal functions, health, safety, security, economic or
social well-being of people, and the disruption or destruction of
which would have a significant impact in Malta as a result of
the failure to maintain those functions;
"critical infrastructure" or "CI" has the same meaning
assigned to it in Directive (EU) 2022/2557;
"CSIRT" means a computer security incident response
team;
"CSIRTs network" means the network of national
CSIRTs established in accordance with Article 15 of the
Directive (EU) 2022/2555;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
"cyber threat" means a cyber threat as defined in Article
2(8) of Regulation (EU) 2019/881 of the European Parliament
and of the Council of 17 April 2019 on ENISA (the European
Union Agency for Cybersecurity) and on information and
communications technology cybersecurity certification and
repealing Regulation (EU) No 526/2013 (Cybersecurity Act);
"cybersecurity" means cybersecurity as defined in Article
2(1) of Regulation (EU) 2019/881 of the European Parliament
and of the Council of 17 April 2019 on ENISA (the European
Union Agency for Cybersecurity) and on information and
communications technology cybersecurity certification and
repealing Regulation (EU) No 526/2013 (Cybersecurity Act);
"data centre service" means a service that encompasses
structures, or groups of structures, dedicated to the centralised
accommodation, interconnection and operation of IT and
network equipment providing data storage, processing and
transport services together with all the facilities and
infrastructures for power distribution and environmental control,
and shall not apply to in-house corporate data centres owned and
operated by the entity concerned for its own purpose;
"Director General" means the Director General within the
Ministry for Home Affairs responsible for the CIP Department;
"DNS service provider" means an entity that provides
(a)
publicly available recursive domain name
resolution services for internet end-users; or
(b)
authoritative domain name resolution
services for third-party use, with the exception of root
name servers;
"Directive (EU) 2022/2555" means Directive (EU) 2022/
2555 of the European Parliament and of the Council of 14
December 2022 on measures for a high common level of
cybersecurity across the Union, amending Regulation (EU) No
910/2014 and Directive (EU) 2018/1972, and repealing
Directive (EU) 2016/1148 (NIS 2 Directive);
"Directive (EU) 2022/2557 means Directive (EU) 2022/
2557 of the European Parliament and of the Council of 14
December 2022 on the resilience of critical entities and
repealing Council Directive 2008/114/EC;
"domain name system" or "DNS" means a hierarchical
distributed naming system which enables the identification of
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
internet services and resources, allowing end-user devices to
use internet routing and connectivity services to reach those
services and resources;
"electronic communications service" means an electronic
communications service as defined in article 2 of the Electronic
Communications (Regulation) Act;
"ENISA" means the European Union Agency for
Cybersecurity established in accordance with Regulation (EU)
2019/881 of the European Parliament and of the Council of 17
April 2019 on ENISA (the European Union Agency for
Cybersecurity) and on information and communications
technology cybersecurity certification and repealing Regulation
(EU) No 526/2013 (Cybersecurity Act);
"entity" means a person created and recognised as such
under the national law of its place of establishment, which may,
acting under its own name, exercise rights and be subject to
obligations;
"entity providing domain name registration services"
means a registrar or an agent acting on behalf of registrars, such
as a privacy or proxy registration service provider or reseller;
"ICT process" means an ICT process as defined in
Article 2(14) of Regulation (EU) 2019/881 of the European
Parliament and of the Council of 17 April 2019 on ENISA (the
European Union Agency for Cybersecurity) and on information
and communications technology cybersecurity certification and
repealing Regulation (EU) No 526/2013 (Cybersecurity Act);
"ICT product" means an ICT product as defined in
Article 2(12) of Regulation (EU) 2019/881 of the European
Parliament and of the Council of 17 April 2019 on ENISA (the
European Union Agency for Cybersecurity) and on information
and communications technology cybersecurity certification and
repealing Regulation (EU) No 526/2013 (Cybersecurity Act);
"ICT service" means an ICT service as defined in Article
2(13) of Regulation (EU) 2019/881 of the European Parliament
and of the Council of 17 April 2019 on ENISA (the European
Union Agency for Cybersecurity) and on information and
communications technology cybersecurity certification and
repealing Regulation (EU) No 526/2013 (Cybersecurity Act);
"incident" means an event compromising the availability,
authenticity, integrity or confidentiality of stored, transmitted or
processed data or of the services offered by, or accessible via,
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
network and information systems;
"incident handling" means any actions and procedures
aimed at preventing, detecting, analysing, and containing or
responding to and recovering from it;
"Information and Data Protection Commissioner" means
the Information and Data Protection Commissioner as appointed
in accordance with article 11 of the Data Protection Act;
"internal CSIRT" means an internal CSIRT that operates
within the structure of an entity to which it provides CSIRT
monitoring services;
"internet exchange point" means a network facility which
enables the interconnection of more than two (2) independent
networks or autonomous systems, primarily for the purpose of
facilitating the exchange of internet traffic, which provides
interconnection only for autonomous systems and which neither
requires the internet traffic passing between any pair of
participating autonomous systems to pass through any third
autonomous system nor alters or otherwise interferes with such
traffic;
"large-scale cybersecurity incident" means an incident
which causes a level of disruption that exceeds a Member State’s
capacity to respond to it or which has a significant impact on at
least two (2) Member States;
"legitimate access seekers" means any person making a
lawful and duly substantiated request for access to domain name
registration services in accordance with national and Union law.
They can include the CIP Department or where designated the
competent authority in accordance with this order and those that
are competent under national law or Union law for the
prevention, investigation, detection or prosecution of criminal
offences, and CERTs or CSIRTs;
"managed security service provider" means a managed
service provider that carries out or provides assistance for
activities relating to cybersecurity risk management;
"managed service provider" means an entity that provides
services related to the installation, management, operation or
maintenance of ICT products, networks, infrastructure and
applications or any other network and information systems, via
assistance or active administration carried out either on
customers’ premises or remotely;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
"management body" shall include the head of the
essential and important entity and any other officers appointed
by the head for the purpose of carrying out article 18(1);
"Minister" means the Minister responsible for critical
infrastructure protection;
"National Cyber Security Steering Committee" means
the Committee as established in accordance with article 15;
"national CSIRT" means the national computer security
incident response team designated or established in accordance
with article 8;
"national cybersecurity strategy" means a coherent
framework providing strategic objectives and priorities in the
area of cybersecurity and the governance to achieve them at
national level;
"near miss" means an event that may have compromised
the availability, authenticity, integrity or confidentiality of
stored, transmitted or processed data or of the services offered
by, or accessible via network and information systems, but that
was successfully prevented from materialising or that did not
materialise;
"network and information system" means
(a)
an electronic communications network as
defined in article 2 of the Electronic Communications
(Regulation) Act;
(b)
any device or group of interconnected or
related devices, one (1) or more of which, pursuant to a
programme, carry out automatic processing of digital
data; or
(c)
digital data stored, processed, retrieved or
transmitted by elements covered under paragraphs (a)
and (b) for the purposes of their operation, use,
protection and maintenance;
"online marketplace" means an online marketplace as
defined in article 51A of the Consumer Affairs Act;
"online search engine" means an online search engine as
defined in Article 2(5) of Regulation (EU) 2019/1150 of the
European Parliament and of the Council of 20 June 2019 on
promoting fairness and transparency for business users of
online intermediation services;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
"operator security plan” means the overall procedure
identifying the assets, systems, networks or part thereof within
critical information infrastructures, essential and important
entities, identifying the security solutions and technical
measures that exist or are being implemented for their protection
and the identification, selection and prioritisation;
"peer review" means the exercise organised in accordance
with Article 19 of the Directive;
"person" means a person as defined in article 4 of the
Interpretation Act;
"protocol on the sharing of information (Traffic Light
Protocol)" means a protocol on the sharing of information
(Traffic Light Protocol) which is a means of providing
information on any limitations regarding the further
dissemination of the same information;
"public administration entity" means an entity recognised
as such in accordance with national law, not including the
judiciary, the Parliament of Malta or the Central Bank of Malta,
which complies with the following criteria
(a)
it is established for the specific purpose of
meeting needs in the general interest and does not have an
industrial or commercial character;
(b)
it has legal personality or is entitled by law
to act on behalf of another entity with legal personality;
(c)
it is financed, for the most part, by the State,
or by other bodies governed by public law, and is
subject to management supervision by those authorities or
bodies, or has an administrative, managerial or
supervisory board, more than half of whose members are
appointed by the State, or by other bodies governed by
public law; and
(d)
it has the power to address administrative or
regulatory decisions to natural or juridical persons which
affect their rights in the cross-border movement of
persons, goods, services or capital;
"public electronic communications network" means a
public electronic communications network as defined in article 2
of the Electronic Communications (Regulation) Act;
"qualified auditor" means a person who satisfies the
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
requirements in accordance with article 14;
"qualified trust service" means a qualified trust service as
defined in Article 3(17) of Regulation (EU) No 910/2014 of the
European Parliament and of the Council of 23 July 2014 on
electronic identification and trust services for electronic
transactions in the internal market and repealing Directive
1999/93/EC;
"qualified trust service provider" means a qualified trust
service provider as defined in Article 3(20) of Regulation (EU)
No 910/2014 of the European Parliament and of the Council of
23 July 2014 on electronic identification and trust services for
electronic transactions in the internal market and repealing
Directive 1999/93/EC;
"Regional Committees" shall have the same meaning
assigned to it in accordance with the Regional Committees
Regulations;
"representative" means a natural or juridical person
established in the Union explicitly designated to act on behalf
of a DNS service provider, a TLD name registry, an entity
providing domain name registration services, a cloud
computing service provider, a data centre service provider, a
content delivery network provider, a managed service provider,
a managed security service provider, or a provider of an online
marketplace, of an online search engine or of a social
networking services platform that is not established in the
Union, which may be addressed by the CIP Department or
where designated the competent authority or CSIRT in the place
of the entity itself with regard to the obligations of such entity
in accordance with this order;
"research organisation" means an entity which has as its
primary goal to conduct applied research or experimental
development with a view to exploiting the results of such
research for commercial purposes, but which does not include
educational institutions;
"risk" means the potential for loss or disruption caused
by an incident and is to be expressed as a combination of the
magnitude of such loss or disruption and the likelihood of
occurrence of the incident;
"risk assessment" means the overall process of risk
identification, risk analysis and risk evaluation, incorporating
the identification of risk sources, events, their causes and their
potential consequences, comprehending the nature of risk and
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
determining the level of risk, with the ultimate objective of
comparing the results of the risk analysis with the risk criteria in
order to determine whether the risk and, or its magnitude is
acceptable or tolerable;
"security of network and information systems" means the
ability of network and information systems to resist, at a given
level of confidence, any event that may compromise the
availability, authenticity, integrity or confidentiality of stored,
transmitted or processed data or of the services offered by, or
accessible by means of those network and information systems;
"service" means a service as defined in regulation 2 of the
Notification Procedure Regulations;
"single point of contact" means the CIP Department
established by virtue of article 7;
"significant cyber threat" means a cyber threat which,
based on its technical characteristics, may be assumed to have
the potential to have a severe impact on the network and
information systems of an entity or the users of the entity’s
services by causing considerable material or non-material
damage;
"significant incident" means an incident which
(a)
has caused or is capable of causing severe
operational disruption of the service or financial loss for
the entity concerned; or
(b)
has affected or is capable of affecting other
natural or juridical persons by causing considerable
material or non-material damage;
"social networking services platform" means a platform
that enables end-users to connect, share, discover and
communicate with each other across multiple devices, in
particular by means of chats, posts, videos and
recommendations;
"standard" means a standard as defined in Article 2(1) of
Regulation (EU) No 1025/2012 of the European Parliament and
of the Council of 25 October 2012 on European standardisation,
amending Council Directives 89/686/EEC and 93/15/EEC and
Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC,
2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the
European Parliament and of the Council and repealing Council
Decision 87/95/EEC and Decision No 1673/2006/EC of the
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
European Parliament and of the Council;
"technical specification" means a technical specification
as defined in Article 2(4) of Regulation (EU) No 1025/2012 of
the European Parliament and of the Council of 25 October 2012
on European standardisation, amending Council Directives 89/
686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC,
95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC,
2009/23/EC and 2009/105/EC of the European Parliament and
of the Council and repealing Council Decision 87/95/EEC and
Decision No 1673/2006/EC of the European Parliament and of
the Council;
"top-level domain name registry" or "TLD name
registry" means an entity which has been delegated a specific
TLD and is responsible for administering the TLD including the
registration of domain names under the TLD and the technical
operation of the TLD, including the operation of its name
servers, the maintenance of its databases and the distribution of
TLD zone files across name servers, irrespective of whether
any of those operations are carried out by the entity itself or are
outsourced, but excluding situations where TLD names are used
by a registry only for its own use;
"trader" means any natural or juridical person, who is
acting, including through any person acting in his name or on
his behalf, for purposes relating to his trade, business, craft or
profession;
"Tribunal" means the Administrative Review Tribunal
established by article 5(1) under the Administrative Justice Act;
"trust service" means a trust service as defined in Article
3(16) of the Regulation (EU) 2024/1183 of the European
Parliament and of the Council of 11 April 2024 amending
Regulation (EU) No 910/2014 as regards establishing the
European Digital Identity Framework;
"trust service provider" means a trust service provider as
defined in Article 3(19) of Regulation (EU) No 910/2014 of the
European Parliament and of the Council of 23 July 2014 on
electronic identification and trust services for electronic
transactions in the internal market and repealing Directive
1999/93/EC, as regards establishing the European Digital
Identity Framework;
"vulnerability" means a weakness, susceptibility or flaw
of ICT products or ICT services that may be exploited by a
cyber threat;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
"Union" means the European Union.
(2)
Unless the context otherwise requires, words and phrases
used in this order which are not defined herein, shall have the same
meaning as assigned to them in the Directive.
Substituted
by:
Other Sectors, Subsectors,
L.N. 89 of
Types of Entities of High Criticality and Competent
2026. Authorities (in accordance with article 4)
Sector
Subsector
Type of entity/entities
Competent authority/
authorities
1. Postal and courier
(i) Postal service providers as
Malta Communications
services
defined in Article 2, point (1a), of
Authority (MCA).
Directive 97/67/EC, including
providers of courier services.
2. Waste
(i) Undertakings carrying out waste
CIP Department as the national
management
management as defined in Article 3,
supervisory authority.
point (9), of Directive 2008/98/EC
of the European Parliament and of
the Council, excluding undertakings
for whom waste management is not
their principal economic activity.
3. Manufacture,
(i) Undertakings carrying out the
CIP Department as the national
production and
manufacture of substances and the
supervisory authority.
distribution of
distribution of substances or
chemicals
mixtures, as referred to in Article 3,
points (9) and (14), of Regulation
(EC) No 1907/2006 of the European
Parliament and of the Council and
undertakings carrying out the
production of articles, as defined in
Article 3, point (3), of said
Regulation, from substances or
mixtures.
4. Production,
(i) Food businesses as defined in
CIP Department as the national
processing and
Article 3, point (2), of Regulation
supervisory authority.
distribution of food
(EC) No 178/2002 of the European
Parliament and of the Council which
are
engaged
in
wholesale
distribution
and
industrial
production and processing.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
5. Manufacturing
(a) Manufacture of
(i) Entities manufacturing medical
medical devices and
devices as defined in Article 2, point
in vitro diagnostic
(1), of Regulation (EU) 2017/745 of
medical devices
the European Parliament and of the
( 4 ),
Council
and
entities
manufacturing in vitro diagnostic
medical devices as defined in Article
2, point (2), of Regulation (EU)
2017/746
of
the
European
Parliament and of the Council ( 5 )
with the exception of entities
manufacturing medical devices
referred to in item 5(v) of the First
Schedule.
(b) Manufacture of
(i) Undertakings carrying out any of
computer, electronic
the economic activities referred to in
and optical products
section C division 26 of NACE Rev.
2. (c) Manufacture of
(i) Undertakings carrying out any of
electrical equipment
the economic activities referred to in
CIP Department as the national
section C division 27 of NACE Rev.
supervisory authority.
2. (d) Manufacture of
(i) Undertakings carrying out any of
machinery and
the economic activities referred to in
equipment n.e.c.
section C division 28 of NACE Rev.
2. (e) Manufacture of
(i) Undertakings carrying out any of
motor vehicles,
the economic activities referred to in
trailers and semi-
section C division 29 of NACE Rev.
trailers
2. (f) Manufacture of
(i) Undertakings carrying out any of
other transport
the economic activities referred to in
equipment
section C division 30 of NACE Rev.
2.
6. Digital providers
Malta Communications
(i) Providers of online marketplaces;
(ii) Providers of online search
Authority (MCA).
engines;
(iii) Providers of social networking
services platforms.
7. Research
(i) Research organizations.
CIP Department as the national
supervisory authority.
(1)
This order applies to public or private entities of a
type listed in the First or Second Schedule which qualify as medium-
sized enterprises under Article 2 of the Annex of Commission
Recommendation 2003/361/EC or exceed the ceilings for medium-
sized enterprises provided for in that article, and which provide their
services or carry out their activities within the Union.
(2)
Article 3(4) of the Annex to Commission
Recommendation 2003/361/EC shall not apply for the purposes of this
order.
(3)
Regardless of their size, this order also applies to entities
of a type listed in the First or Second Schedule, where
(a)
services are provided by
(i)
providers
of
public
electronic
communications networks or of publicly available
electronic communications services;
(ii)
trust service providers;
(iii) top-level domain name registries and
domain name system service providers;
(b)
the entity is the sole provider in Malta of a service
which is essential for the maintenance of critical societal or
economic activities;
(c)
disruption of the service provided by the entity
may have a significant impact on public safety, public security
or public health;
(d)
disruption of the service provided by the entity
may induce a significant systemic risk, in particular for sectors
where such disruption may have a cross-border impact;
(e)
the entity is critical because of its specific
importance at national level for the particular sector or type of
service, or for other interdependent sectors in Malta;
(f)
the entity is a public administration entity
(i)
if it is a government entity established in
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
accordance with national law; or
(ii)
if it is a local government authority
established in accordance with national law and which
following a risk assessment, provides services the
disruption of which may have a significant impact on
critical or societal or economic activities.
(4)
Regardless of their size, this order applies to entities
identified as critical entities in accordance with Directive (EU) 2022/
2557;
(5)
Regardless of their size, this order also applies to entities
providing domain name registration services.
(6)
This order is without prejudice to Malta’s responsibility
for safeguarding its national security and its power to safeguard other
essential State functions, including ensuring the territorial integrity of
the State and maintaining law and order.
(7)
This order shall not apply to public administration
entities that carry out their activities in the areas of national security,
public security, defence or law enforcement, including the prevention,
investigation, detection and prosecution of criminal offences.
(8)
Entities which carry out activities in the areas of national
security, public security, defence or law enforcement, including the
prevention, investigation, detection and prosecution of criminal
offences, or which provide services exclusively to the public
administration entities referred to in sub-article (7) are exempt from
the obligations laid down in articles 19 or 20 with regard to those
activities or services. The supervisory and enforcement measures in
Part VII shall not apply in relation to those specific activities or
services
Provided that where the entities carry out activities or
provide services exclusively of the type in this sub-article, those
entities shall also be exempt from the obligations established in article
(1)
Għall-finijiet ta’ dan l-ordni, l-entitajiet segwenti
għandhom jitqiesu li huma entitajiet essenzjali
(a)
entitajiet tat-tip indikati fl-Ewwel Skeda li jeċċedu
l-limiti massimi għall-intrapriżi ta’ daqs medju pprovduti fl-
Artikolu
2(1)
tal-Anness
tar-Rakkomandazzjoni
tal-
Kummissjoni 2003/361/KE;
(b)
fornituri ta’ servizzi fiduċjarji kwalifikati u reġistri
ta’ ismijiet ta’ dominju tal-ogħla livell kif ukoll fornituri ta’
servizzi tad-DNS, irrispettivament mid-daqs tagħhom;
(ċ)
fornituri
ta’
networks
pubbliċi
tal-
komunikazzjonijiet
elettroniċi
jew
tas-servizzi
tal-
komunikazzjonijiet elettroniċi disponibbli għall-pubbliku li
jikkwalifikaw bħala intrapriżi ta’ daqs medju skont l-Artikolu 2
tal-Anness tar-Rakkomandazzjoni tal-Kummissjoni 2003/361/
KE;
(d)
l-entitajiet
tal-amministrazzjoni
pubblika
msemmija fl-artikolu 3(3)(f)(i);
(e)
kwalunkwe entità oħra tat-tip imsemmija fl-Ewwel
jew fit-Tieni Skeda li tkun identifikata mid-Dipartiment tas-CIP
u fejn maħtura mill-awtorità kompetenti bħala entità essenzjali
skont l-artikolu 3(3)(b) sa (e);
(f)
entitajiet identifikati bħala entitajiet kritiċi skont
id-Direttiva (UE) 2022/2557;
(g)
entitajiet illi d-Dipartiment tas-CIP u fejn maħtura
l-awtorità kompetenti jkunu identifikaw qabel is-16 ta’ Jannar
2023 bħala operaturi ta’ servizzi essenzjali f’konformità
(i)
mad-Direttiva
(UE)
2022/2555
tal-
Parlament Ewropew u tal-Kunsill tal-14 ta’ Diċembru
2022 dwar miżuri għal livell għoli komuni ta’ ċibersigurtà
madwar l-Unjoni kollha, li temenda r-Regolament (UE)
Nru 910/2014 u d-Direttiva (UE) 2018/1972, u li tħassar
id-Direttiva (UE) 2016/1148 (Direttiva NIS 2); jew
(ii)
mal-liġi nazzjonali.
(2)
Għall-finijiet ta’ dan l-ordni, l-entitajiet tat-tip imsemmi
fl-Ewwel jew fit-Tieni Skeda li ma jikkwalifikawx bħala entitajiet
essenzjali skont is-subartikolu (1) għandhom jitqiesu bħala entitajiet
importanti. Dan jinkludi entitajiet identifikati mid-Dipartiment tas-CIP
u fejn maħtura l-awtorità komptenti bħala entitajiet importanti skont l-
artikolu 3(3)(b) sa (e).
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
TAQSIMA II – KUMITAT TAL-INFURZAR, DIPARTIMENT
GĦALL-ĦARSIEN TAL-INFRASTRUTTURA KRITIKA U
CSIRTs
(1)
Għandu jkun hemm kumitat magħruf bħala l-
Kumitat tal-Infurzar, magħmul minn tali membri li għandhom jinħatru
mill-Ministru minn fost uffiċjali pubbliċi li jokkupaw pożizzjoni
għolja u li jwettqu dmirijiet fil-ministeri responsabbli għal kwisjonijiet
relatati maċ-ċibersigurtà ta’ entitajiet essenzjali u importanti, kif ukoll
minn fost impjegati li jokkupaw pożizzjoni għolja fl-
organizzazzjonijiet l-oħra li għandhom interess ewlieni fil-ġestjoni, it-
tmexxija u l-kontroll taċ-ċibersigurtà f’entitajiet essenzjali jew
importanti f’Malta
Iżda l-Ministru jista’ jaħtar bħala membri tal-Kumitat
persuni oħra li jqis li għandhom l-esperjenza u li wrew kapaċità fi
kwistjonijiet relatati maċ-ċiberreżiljenza ta’ entitajiet essenzjali u
importanti
Iżda wkoll l-awtoritajiet kompetenti elenkati fl-Ewwel u
fit-Tieni Skeda, minbarra d-Dipartiment tas-CIP, jistgħu jaħtru persuna
waħda (1) bħala r-rappreżentant tagħhom fil-Kumitat.
(2)
Id-Direttur Ġenerali responsabbli għad-Dipartiment tas-
CIP għandu jkun iċ-chairperson tal-Kumitat, id-Direttur ta’ dan id-
Dipartiment għandu jkun il-viċi chairperson, u rappreżentant ieħor
minn dan id-Dipartiment għandu jaġixxi bħala s-segretarju tal-
Kumitat. Iċ-chairperson, il-viċi chairperson u s-segretarju ma għandux
ikollhom drittijiet tal-vot. Il-viċi chairperson għandu jaġixxi minflok
iċ-chairperson kull meta ċ-chairperson ikun assenti minn laqgħa tal-
Kumitat jew għal xi raġuni ma jkunx jista’ jaġixxi bħala chairperson .
(3)
Il-membri maħtura għandhom iżommu l-kariga għal dak
it-terminu, li ma għandux ikun ta’ aktar minn tliet (3) snin, kif jista’
jiġi speċifikat fl-ittra tal-ħatra tagħhom.
(4)
Jekk jinħoloq xi post battal fil-Kumitat matul il-perjodu
tal-ħatra, minħabba mewt, riżenja jew għal kwalunkwe raġuni oħra, il-
Ministru għandu, malajr kemm jista’ jkun, jaħtar persuna oħra sabiex
timla l-post battal
Iżda l-Kumitat u l-membri tiegħu jistgħu jaġixxu
minkejja kwalunkwe tali post battal.
(5)
Minkejja kwalunkwe dispożizzjoni oħra ta’ dan l-
artikolu, il-Ministru jista’ f’kull waqt itemm il-ħatra ta’ membru
maħtur jekk, fl-opinjoni tiegħu, dak il-membru maħtur ma jkunx
adattat sabiex ikompli fil-kariga jew ikun sar inkapaċi li jwettaq il-
funzjonijiet tiegħu kif jixraq.
(6)
Il-Kumitat għandu jiltaqa’ kemm-il darba jkun meħtieġ u
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
għandu jirregola l-proċeduri tiegħu stess.
Għandu jkun id-dmir tal-Kumitat li joħroġ deċiżjonijiet
fir-rigward tal-impożizzjoni ta’ penali amministrattivi skont l-artikoli
32, 33, 34 u 38.
(1)
Id-Dipartiment tas-CIP għandu jkun l-awtorità
superviżorja
nazzjonali
responsabbli
għall-monitoraġġ
tal-
implimentazzjoni ta’ dan l-ordni fil-livell nazzjonali u jiżgura l-
konformità miegħu, jimplimenta d-dispożizzjonijiet rilevanti ta’ dan l-
ordni u li jkopri s-setturi, sottosetturi u tipi ta’ entitajiet elenkati fit-
tabelli tal-Ewwel u t-Tieni Skeda
Iżda bħala l-awtorità superviżorja nazzjonali,
id-
Dipartiment tas-CIP għandu jkun responsabbli sabiex
(a)
jistabbilixxi l-kriterji għall-identifikazzjoni u l-
ħatra ta’ entitajiet essenzjali u importanti;
(b)
bla ħsara għall-artikolu 26, jibni sħubija mal-
operaturi ta’ infrastrutturi ta’ informazzjoni kritika għall-
kondivizjoni ta’ informazzjoni;
(ċ)
jistabbilixxi
mekkaniżmu
nazzjonali
ta’
awtoreġistrazzjoni għal entitajiet essenzjali u importanti li
jipprovdu servizzi f’Malta, għas-CSIRTs li jipprovdu servizzi
ta’ monitoraġġ fi ħdan tali entitajiet kif ukoll entitajiet li
jipprovdu servizzi ta’ reġistrazzjoni ta’ ismijiet ta’ dominju
f’Malta, li għandhom jipprovdu informazzjoni skont l-artikolu
24(1);
(d)
jistabbilixxi reġistru abbażi tal-paragrafu (h) u
jirrevedi u, fejn xieraq, jaġġorna tali reġistru fuq bażi regolari u
mill-inqas kull sentejn (2);
(e)
jadotta strateġija dwar is-sigurtà tan-networks u s-
sistemi tal-informazzjoni, kif dettaljat fl-Istrateġija Nazzjonali
taċ-Ċibersigurtà skont l-artikolu 15;
(f)
jissorvelja u jinforza miżuri fuq is-CSIRTs kollha
skont l-artikoli 29 u 30;
(g)
jiġġestixxi ċentru intern tal-operati taċ-ċibersigurtà
u CSIRT intern;
(h)
jaġixxi bħala koordinatur għall-finijiet tad-
divulgazzjoni kkoordinata tal-vulnerabbiltà skont l-artikolu
13(1); u
(i)
jiżgura kooperazzjoni effettiva, effiċjenti u sigura
fil-Grupp ta’ Kooperazzjoni.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(2)
L-Ewwel u t-Tieni Skedi jaħtru l-awtoritajiet kompetenti
għal kull settur jew sottosettur u jistabbilixxu b’mod ċar il-kompiti ta’
kull awtorità kompetenti kkonċernata. L-awtoritajiet kompetenti
maħtura għandhom jikkooperaw b’mod effettiv, taħt is-superviżjoni
tad-Dipartiment tas-CIP bħala l-awtorità superviżorja nazzjonali,
sabiex iwettqu l-kompiti tagħhom skont dan l-ordni. L-awtoritajiet
kompetenti maħtura għandhom iqiegħdu għad-dispożizzjoni tad-
Dipartiment tas-CIP l-informazzjoni u d-dokumenti kollha meħtieġa
sabiex id-Dipartiment jiżgura l-konformità ma’ dan l-ordni.
(3)
Sakemm ma jkunx espressament provdut xort’oħra f’dan
l-ordni jew fi kwalunkwe liġi oħra, u sakemm ma jkunx hemm
awtorità kompetenti oħra maħtura responsabbli għas-settur, sottosettur
jew tip ta’ entità fl-Ewwel jew fit-Tieni Skeda, id-Dipartiment tas-CIP
għandu jkun responsabbli
(a)
għall-identifikazzjoni u l-ħatra ta’ entitajiet
essenzjali u importanti;
(b)
għall-identifikazzjoni tas-servizzi pprovduti minn
entitajiet essenzjali u importanti;
(ċ)
għall-iżgurar li l-valutazzjonijiet
tar-riskju
jitwettqu minn entitajiet essenzjali u importanti;
(d)
għall-iżgurar li l-pjanijiet tas-sigurtà tal-operaturi
u l-pjanijiet ta’ kontinwità tan-negozju jitfasslu u jinżammu
minn entitajiet essenzjali u importanti;
(e)
għall-istigazzjoni ta’ simulazzjonijiet ta’ pjanijiet
ta’ sigurtà tal-operaturi u pjanijiet ta’ kontinwità tan-negozju
minn entitajiet essenzjali u importanti;
(f)
għall-monitoraġġ tal-miżuri tal-ġestjoni tar-riskju
taċ-ċibersigurtà mwettqa minn entitajiet essenzjali u importanti
skont l-artikolu 19;
(g)
għall-monitoraġġ tal-obbligi ta’ rappurtar meħuda
minn entitajiet essenzjali u importanti skont l-artikolu 20; u
(h)
għas-superviżjoni u l-infurzar ta’ miżuri fuq
entitajiet essenzjali u importanti, u fuq is-CSIRTs kollha skont
l-artikoli 29 u 30
Iżda d-Dipartiment tas-CIP għandu jitqies bħala
debitament awtorizzat fit-twettiq ta’ kwalunkwe waħda mill-miżuri
msemmija hawn fuq skont l-artikolu 337Ċ(2) tal-Kodiċi Kriminali
Iżda wkoll skont l-Artikolu 47(1) tar-Regolament (UE)
2022/2554 tal-Parlament Ewropew u tal-Kunsill tal-14 ta’ Diċembru
2022 dwar ir-reżiljenza operazzjonali diġitali għas-settur finanzjarju u
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
li jemenda r-Regolamenti (KE) Nru 1060/2009, (UE) Nru 648/2012,
(UE) Nru 600/2014, (UE) Nru 909/2014 u (UE) 2016/1011, l-Awtorità
għas-Servizzi Finanzjarji ta’ Malta tista’ tipparteċipa fl-attivitajiet tal-
Grupp ta’ Kooperazzjoni għal kwistjonijiet li jikkonċernaw l-attivitajiet
superviżorji tagħha fir-rigward ta’ entitajiet finanzjarji
Iżda wkoll l-Awtorità għas-Servizzi Finanzjarji ta’ Malta
tista’ titlob lid-Dipartiment tas-CIP sabiex jipparteċipa fl-attivitajiet
tal-Grupp ta’ Kooperazzjoni għal kwistjonijiet li għandhom x’jaqsmu
ma’ entitajiet essenzjali jew importanti, bil-kundizzjoni li dawn l-
entitajiet ikunu nħatru skont dan l-ordni bħala fornituri ta’ servizzi
kritiċi tal-ICT minn partijiet terzi skont l-Artikolu 31 tar-Regolament
(UE) 2022/2554 tal-Parlament Ewropew u tal-Kunsill tal-14 ta’
Diċembru 2022 dwar ir-reżiljenza operazzjonali diġitali għas-settur
finanzjarju u li jemenda r-Regolamenti (KE) Nru 1060/2009, (UE) Nru
648/2012, (UE) Nru 600/2014, (UE) Nru 909/2014 u (UE) 2016/1011
Iżda wkoll id-Dipartiment tas-CIP għandu jeżerċita
funzjoni ta’ kollegament bħala punt uniku ta’ kuntatt skont dan l-ordni,
sabiex jiżgura l-kooperazzjoni transkonfinali tal-awtoritajiet Maltin
mal-awtoritajiet rilevanti ta’ Stati Membri oħra u, fejn xieraq, mal-
Kummissjoni Ewropea u l-ENISA, kif ukoll sabiex jiżgura
kooperazzjoni transsettorjali ma’ awtoritajiet kompetenti oħra f’Malta
Iżda wkoll is-CSIRT nazzjonali għandu jkollu aċċess
għar-reġistru kif imfisser fl-artikolu 7(1)(d), kif miżmum u aġġornat
mid-Dipartiment tas-CIP.
(4)
Entitajiet essenzjali u importanti li jipprovdu servizzi
f’Malta kif ukoll entitajiet li jipprovdu servizzi ta’ reġistrazzjoni ta’
ismijiet ta’ dominju f’Malta għandhom jirreġistraw fuq il-mekkaniżmu
nazzjonali ta’ awtoreġistrazzjoni stabbilit mid-Dipartiment tas-CIP
skont is-subartikolu (3)(h), u għandhom jipprovdu tal-inqas l-
informazzjoni li ġejja
(a)
l-isem tal-entità;
(b)
l-isem tas-CSIRT li jipprovdi servizzi ta’
monitoraġġ lill-entità u jekk huwiex CSIRT intern jew
awtonomu;
(ċ)
l-indirizz u d-dettalji ta’ kuntatt aġġornati, inklużi
l-indirizzi tal-posta elettronika, il-firxiet tal-IP u n-numri tat-
telefon;
(d)
fejn applikabbli, is-settur u s-sottosettur rilevanti
elenkati fl-Ewwel jew fit-Tieni Skeda; u
(e)
fejn applikabbli, lista tal-Istati Membri fejn jiġu
pprovduti servizzi li jaqgħu fl-ambitu ta’ dan l-ordni.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(5)
L-entitajiet essenzjali jew importanti għandhom javżaw
lid-Dipartiment tas-CIP bi kwalunkwe bidla fid-dettalji sottomessi
skont is-subartikolu (4) mingħajr dewmien u, fi kwalunkwe każ, fi
żmien ġimagħtejn (2) mid-data tal-bidla.
(6)
Id-Dipartiment tas-CIP għandu jwettaq ukoll tali
dmirijiet relatati u konsegwenzjali li l-Ministru jista’ jiddelega minn
żmien għal żmien.
(7)
Id-Direttur Ġenerali jew id-delegat tiegħu għandu
jirrappreżenta lid-Dipartiment tas-CIP fi kwalunkwe proċeduri
ġudizzjarji.
(1)
Għandu jiġi mwaqqaf CSIRT nazzjonali fi ħdan l-
Aġenzija Maltija għat-Teknoloġija tal-Informazzjoni li għandu
jikkonforma mar-rekwiżiti stabbiliti fl-artikolu 9(1). Dan għandu jkun
responsabbli għat-trattament tal-inċidenti skont proċess stabbilit
b’mod ċar u għandu jkopri tal-anqas is-setturi, is-sottosetturi u t-tipi
ta’ entitatijiet elenkati fl-Ewwel u fit-Tieni Skeda.
(2)
Is-CSIRT nazzjonali għandu
(a)
jikkoopera u fejn xieraq, jiskambja informazzjoni
rilevanti f’konformità mal-artikolu 26, ma’ komunitajiet
settorjali jew transsettorjali ta’ entitajiet essenzjali u importanti;
(b)
jipparteċipa fl-evalwazzjonijiet
bejn
il-pari
organizzati skont l-artikolu 17; u
(ċ)
jaġixxi bħala r-rappreżentant nazzjonali għan-
network tas-CSIRTs.
(3)
Is-CSIRT nazzjonali jista’ jistabbilixxi relazzjonijiet ta’
kooperazzjoni mas-CSIRTs nazzjonali ta’ pajjiżi terzi, kif soġġett għal
ftehim ta’ kooperazzjoni. Il-ftehim ta’ kooperazzjoni għandu jiffaċilita
l-iskambju ta’ informazzjoni effettiv, effiċjenti u sigur mas-CSIRTs
nazzjonali ta’ dawk il-pajjiżi terzi, bl-użu ta’ protokolli rilevanti għall-
kondiviżjoni tal-informazzjoni, inkluż il-protokoll dwar il-
kondiviżjoni tal-informazzjoni (Traffic Light Protocol).
(4)
Bħala parti minn tali relazzjonijiet ta’ kooperazzjoni, is-
CSIRT nazzjonali jista’
(a)
jiskambja informazzjoni rilevanti mas-CSIRTs ta’
pajjiżi terzi, inkluża data personali skont ir-Regolament (UE)
2016/679 tal-Parlament Ewropew u tal-Kunsill tas-27 ta’ April
2016 dwar il-protezzjoni tal-persuni fiżiċi fir-rigward tal-
ipproċessar ta’ data personali u dwar il-moviment liberu ta’ tali
data, u li jħassar id-Direttiva 95/46/KE (Regolament Ġenerali
dwar il-Protezzjoni tad-Data);
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(b)
jikkoopera mas-CSIRTs nazzjonali ta’ pajjiżi terzi
jew korpi ekwivalenti ta’ pajjiżi terzi, b’mod partikolari sabiex
jipprovdulhom assistenza fil-qasam taċ-ċibersigurtà.
(1)
Is-CSIRTs kollha għandhom jikkonformaw mar-
rekwiżiti li ġejjin
(a)
is-CSIRTs għandhom jiżguraw livell għoli ta’
disponibbiltà tal-mezzi tagħhom ta’ komunikazzjoni billi
jevitaw punti uniċi ta’ falliment, u għandu jkollhom diversi
mezzi sabiex jiġu kkuntattjati u sabiex jikkuntattjaw lil oħrajn fi
kwalunkwe waqt, u għal dan il-għan huma għandhom
jispeċifikaw b’mod ċar il-mezzi tagħhom ta’ komunikazzjoni u
jgħarrfuhom lill-kostitwenza u lill-imsieħba kooperattivi;
(b)
l-uffiċċji tas-CSIRTs u s-sistemi tal-informazzjoni
ta’ appoġġ għandhom ikunu f’siti siguri;
(ċ)
is-CSIRTs għandhom ikunu mgħammrin b’sistema
adegwata għall-ġestjoni u t-trażmissjoni tat-talbiet, b’mod
partikolari li tiffaċilita trasferimenti effettivi u effiċjenti;
(d)
is-CSIRTs għandhom jiżguraw il-kunfidenzjalità u
l-affidabbiltà tal-operati tagħhom;
(e)
is-CSIRTs għandu jkollhom persunal adegwat
sabiex jiżguraw id-disponibbiltà tas-servizzi tagħhom f’kull ħin
u għandhom jiżguraw li l-persunal tagħhom ikun imħarreġ kif
xieraq; u
(f)
is-CSIRTs għandhom ikunu mgħammra b’sistemi
addizzjonali u bi spazju ta’ ħidma ta’ riżerva sabiex tiġi żgurata
l-kontinwità tas-servizzi tagħhom.
(2)
Is-CSIRTs jistgħu
jipparteċipaw
f’networks
ta’
kooperazzjoni internazzjonali.
(1)
Is-CSIRT nazzjonali għandu jkollu l-kompiti li
ġejjin
(a)
il-monitoraġġ u l-analiżi tat-theddid, tal-
vulnerabbiltajiet u tal-inċidenti ċibernetiċi u, fuq talba, l-għoti
ta’ assistenza lill-entitajiet essenzjali u importanti kkonċernati
fir-rigward tal-monitoraġġ tan-network u s-sistemi ta’
informazzjoni tagħhom f’ħin reali jew qrib il-ħin reali;
(b)
l-għoti ta’ twissijiet bikrija, allerti u avviżi u d-
disseminazzjoni ta’ informazzjoni lill-entitajiet essenzjali u
importanti kkonċernati kif ukoll lill-awtoritajiet kompetenti u
partijiet interessati rilevanti oħra dwar theddid, vulnerabbiltajiet
u inċidenti ċibernetiċi, jekk possibbli qrib il-ħin reali;
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(ċ)
ir-rispons għall-inċidenti u l-għoti ta’ assistenza
lill-entitajiet essenzjali u importanti kkonċernati, fejn
applikabbli;
(d)
il-ġbir u l-analiżi ta’ data forensika u l-forniment
ta’ analiżi dinamika tar-riskji u tal-inċidenti u għarfien tas-
sitwazzjoni fir-rigward taċ-ċibersigurtà;
(e)
il-forniment, fuq talba ta’ entità essenzjali jew
importanti, ta’ skennjar proattiv tan-network u s-sistemi ta’
informazzjoni tal-entità kkonċernata sabiex jiġu identifikati
vulnerabbiltajiet b’impatt sinifikanti potenzjali;
(f)
il-parteċipazzjoni,
bħala
r-rappreżentant
nazzjonali ewlieni, fin-network tas-CSIRTs u l-għoti ta’
assistenza reċiproka skont il-kapaċitajiet u l-kompetenzi
tagħhom lil membri oħra tan-network tas-CSIRTs fuq talba
tagħhom, iżda d-Dipartiment tas-CIP jista’ jipparteċipa fin-
network tas-CSIRTs;
(g)
il-kontribut għall-implimentazzjoni ta’ għodod
siguri għall-kondiviżjoni tal-informazzjoni.
(2)
Is-CSIRT nazzjonali jista’ jwettaq skennjar proattiv
mhux intrużiv ta’ networks u sistemi ta’ informazzjoni aċċessibbli
għall-pubbliku ta’ entitajiet essenzjali u importanti. Tali skennjar
għandu jitwettaq sabiex jiġu identifikati networks u sistemi ta’
informazzjoni vulnerabbli jew b’konfigurazzjoni mhux sigura u jiġu
infurmati l-entitajiet ikkonċernati u ma għandu jkun hemm l-ebda
impatt negattiv fuq il-funzjonament tas-servizzi tal-entitajiet
Iżda l-entitajiet essenzjali u importanti għandhom jiġu
nnotifikati bil-miktub dwar l-iskennjar proattiv mhux intrużiv tan-
networks u s-sistemi tal-informazzjoni aċċessibbli għall-pubbliku
tagħhom, u wara tali skennjar, għandhom jiġu nnotifikati bil-miktub
dwar kwalunkwe network u sistemi ta’ informazzjoni vulnerabbli jew
b’konfigurazzjoni mhux sigura
Iżda wkoll is-CSIRT nazzjonali għandu jitqies bħala
debitament awtorizzat fit-twettiq ta’ din il-miżura skont l-artikolu
337Ċ(2) tal-Kodiċi Kriminali
Iżda wkoll is-CSIRT nazzjonali għandu jinnotifika lid-
Dipartiment tas-CIP u fejn maħtura, lill-awtoritajiet kompetenti l-oħra,
dwar l-assistenza, l-informazzjoni, l-iskennjar, ir-rispons għall-
inċidenza jew servizzi oħra li għandhom jiġu pprovduti lill-entitajiet
essenzjali u importanti skont kwalunkwe mid-dispożizzjonijiet ta’ dan
l-artikolu.
(3)
Meta jwettaq il-kompiti msemmija fis-subartikolu (1), is-
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
CSIRT nazzjonali jista’ jipprijoritizza kompiti partikolari abbażi ta’
approċċ imsejjes fuq ir-riskju.
(4)
Is-CSIRT nazzjonali għandu jistabbilixxi relazzjonijiet ta’
kooperazzjoni mal-partijiet interessati rilevanti fis-settur privat, bil-
ħsieb li jintlaħqu l-objettivi ta’ dan l-ordni.
(5)
Sabiex tiġi ffaċilitata l-kooperazzjoni msemmija fis-
subartikolu (4), is-CSIRT nazzjonali għandu jippromwovi l-adozzjoni u
l-użu ta’ prattiki komuni jew standardizzati, skemi ta’ klassifikazzjoni
u tassonomiji fir-rigward ta’ proċeduri tat-trattament tal-inċidenti.
(6)
Is-CSIRTs interni u awtonomi għandu jkollhom mill-
inqas il-kompiti li ġejjin
(a)
il-monitoraġġ u l-analiżi tat-theddid, tal-
vulnerabbiltajiet u tal-inċidenti ċibernetiċi tal-entitajiet
essenzjali u importanti u l-għoti ta’ monitoraġġ f’ħin reali jew
qrib il-ħin reali tan-networks u s-sistemi tal-informazzjoni
tagħhom;
(b)
l-għoti ta’ twissijiet bikrija, allerti, avviżi u d-
disseminazzjoni
ta’
informazzjoni
dwar
theddid,
vulnerabbiltajiet u inċidenti ċibernetiċi, jekk possibbli qrib il-
ħin reali lill-entitajiet essenzjali u importanti;
(ċ)
ir-rispons għall-inċidenti u l-għoti ta’ assistenza
lill-entitajiet essenzjali u importanti;
(d)
il-ġbir u l-analiżi ta’ data forensika u l-forniment
ta’ analiżi dinamika tar-riskji u tal-inċidenti u għarfien tas-
sitwazzjoni fir-rigward taċ-ċibersigurtà tal-entitajiet essenzjali u
importanti;
(e)
il-forniment, skennjar proattiv tan-network u s-
sistemi ta’ informazzjoni tal-entitajiet essenzjali u importanti
sabiex jiġu identifikati vulnerabbiltajiet b’impatt sinifikanti
potenzjali
Iżda l-kompiti msemmija f’dan is-subartikolu għandhom
jitwettqu minn CSIRTs interni u awtonomi li jipprovdu servizzi ta’
monitoraġġ tas-CSIRT lil entitajiet essenzjali u importanti skont l-
artikolu 19(1)(d).
Għandhom jiġu pprovduti riżorsi umani, finanzjarji u
tekniċi adegwati lid-Dipartiment tas-CIP, u lis-CSIRT nazzjonali u lill-
awtoritajiet kompetenti maħtura sabiex iwettqu, b’mod effettiv u
effiċjenti, il-kompiti assenjati lilhom u b’hekk jilħqu l-objettivi ta’ dan
l-ordni, b’mod partikolari
(a)
li jkollhom l-kapaċitajiet tekniċi meħtieġa sabiex
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
iwettqu l-kompiti msemmija fl-artikolu 10(1);
(b)
li jiġu allokati biżżejjed riżorsi inklużi livelli
adegwati ta’ persunal u taħriġ xieraq bl-għan li jkunu jistgħu
jiżviluppaw il-kapaċitajiet tekniċi tagħhom; u
(ċ)
li
jkollhom
għad-dispożizzjoni
tagħhom
infrastruttura ta’ komunikazzjoni u informazzjoni xierqa, sigura
u reżiljenti li permezz tagħha tiskambja informazzjoni ma’
entitajiet essenzjali u importanti u ma’ partijiet interessati
rilevanti oħra.
(1)
Id-Dipartiment tas-CIP, is-CSIRT, nazzjonali jew
fejn maħtura l-awtoritajiet kompetenti għandhom jikkooperaw ma’
xulxin fir-rigward tat-twettiq tal-obbligi stabbiliti f’dan l-ordni.
(2)
Is-CSIRT nazzjonali għandu jirċievi notifiki ta’ inċidenti
sinifikanti skont l-artikolu 20 u inċidenti, theddid ċibernetiku u kważi
inċidenti skont l-artikolu 27.
(3)
Is-CSIRT nazzjonali għandu jinforma bil-miktub lid-
Dipartiment tas-CIP, u l-awtoritajiet kompetenti rilevanti dwar in-
notifiki tal-inċidenti, it-theddid ċibernetiku u l-kważi inċidenti
ppreżentati skont l-artikolu 20(1).
(4)
Id-Dipartiment tas-CIP, u fejn maħtura, l-awtorità
kompetenti, u s-CSIRT nazzjonali għandhom jikkooperaw mal-
Pulizija Eżekuttiva, l-Uffiċċju tal-Kummissarju għall-Informazzjoni u
l-Protezzjoni tad-Data skont l-Att dwar il-Protezzjoni u l-Privatezza
tad-Data, id-Dipartiment tas-Sigurtà fl-Avjazzjoni skont l-Att dwar
Sigurtà fl-Ajruportijiet u fl-Avjazzjoni Ċivili, id-Direttorat għall-
Avjazzjoni Ċivili skont l-Att dwar in-Navigazzjoni fl-Ajru, l-Awtorità
ta’ Malta dwar il-Komunikazzjoni skont l-Att dwar il-
Komunikazzjonijiet u Transazzjonijiet Elettroniċi, l-Att biex jirregola
Komunikazzjonijiet Elettroniċi u r-Regolamenti dwar Radio
Equipment, l-Awtorità għas-Servizzi Finanzjarji ta’ Malta skont ir-
Regolament (UE) 2022/2554 tal-Parlament Ewropew u tal-Kunsill tal-
14 ta’ Diċembru 2022 dwar ir-reżiljenza operazzjonali diġitali għas-
settur finanzjarju u li jemenda r-Regolamenti (KE) Nru 1060/2009,
(UE) Nru 648/2012, (UE) Nru 600/2014, (UE) Nru 909/2014 u (UE)
Nru 2016/1011, id-Dipartiment tas-CIP skont id-Direttiva (UE) 2022/
2557 kif ukoll l-awtoritajiet kompetenti taħt atti legali oħra tal-Unjoni
speċifiċi għas-settur, f’Malta.
(5)
Id-Dipartiment tas-CIP u s-CSIRT nazzjonali għandhom
jiskambjaw informazzjoni rilevanti fuq bażi regolari, inkluż fir-
rigward ta’ inċidenti u theddid ċibernetiku rilevanti ma’ awtoritajiet
kompetenti taħt dan l-ordni.
(6)
Id-Dipartiment tas-CIP, jew fejn maħtura l-awtorità
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
kompetenti taħt dan l-ordni u l-awtorità kompetenti skont id-Direttiva
(UE) 2022/2557, għandhom jikkooperaw u jiskambjaw informazzjoni
fuq bażi regolari fir-rigward tal-identifikazzjoni ta’ entitajiet kritiċi,
dwar riskji, theddid u inċidenti ċibernetiċi kif ukoll dwar riskji, theddid
u inċidenti mhux ċibernetiċi li jaffettwaw lil entitajiet essenzjali
identifikati bħala entitajiet kritiċi taħt l-imsemmi ordni, u l-miżuri
meħuda b’rispons għal tali riskji, theddid u inċidenti.
(7)
Ir-rappurtar għandu jiġi simplifikat bl-użu ta’ mezzi
tekniċi għan-notifiki msemmija fl-artikoli 20 u 27.
(8)
Imħassar bl-Avviż Legali 89 tal-2026.
(1)
Id-Dipartiment tas-CIP għandu jinħatar bħala
koordinatur għall-finijiet tad- divulgazzjoni kkoordinata tal-
vulnerabbiltajiet skont dan l-ordni
Iżda d-Dipartiment tas-CIP għandu jinnotifika minnufih
bil-miktub lis-CSIRT nazzjonali dwar kwalunkwe vulnerabbiltà
rrappurtata lilu. Id-Dipartiment tas-CIP għandu jinnotifika minnufih
bil-miktub lil kwalunkwe awtorità jew awtoritajiet kompetenti oħra
maħtura, skont il-każ, bi kwalunkwe vulnerabbiltà rrappurtata lilu li
jkollha impatt sinifikanti fuq il-forniment tas-servizzi pprovduti minn
entità essenzjali jew importanti li tali awtorità tirregola.
(2)
Id-Dipartiment
tas-CIP
għandu
jaġixxi
bħala
intermedjarju ta’ fiduċja u jiffaċilita, fejn meħtieġ, l-interazzjoni bejn
il-persuna fiżika jew ġuridika li tirrapporta u l-entità li tagħmel użu
mill-prodotti tal-ICT, il-proċessi tal-ICT jew is-servizzi tal-ICT li
jkunu potenzjalment vulnerabbli, fuq talba ta’ waħda mill-partijiet.
(3)
Il-kompiti tad-Dipartiment tas-CIP maħtur bħala
koordinatur tad-divulgazzjoni kkoordinata tal-vulnerabbiltajiet
għandhom jinkludu
(a)
l-adozzjoni ta’ prattiki, skemi ta’ klassifikazzjoni u
tassonomiji komuni jew standardizzati;
(b)
l-identifikazzjoni tal-entitajiet ikkonċernati u l-
kuntatt magħhom;
(ċ)
l-għoti ta’ assistenza lill-persuni fiżiċi jew ġuridiċi
li jirrappurtaw vulnerabbiltà;
(d)
in-negozjar
tal-iskedi
ta’
żmien
għad-
divulgazzjoni, u l-ġestjoni tal-vulnerabbiltajiet li jaffettwaw
diversi entitajiet; u
(e)
l-istabbiliment u ż-żamma ta’ reġistru ta’ politiki
għad-divulgazzjoni kkoordinata tal-vulnerabbiltajiet.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(4)
Kwalunkwe persuna għandha tkun tista’ tirrapporta,
b’mod anonimu, vulnerabbiltà lid-Dipartiment tas-CIP. Id-Dipartiment
tas-CIP għandu jiżgura l-anonimità u l-kunfidenzjalità tal-persuni
matul l-iżvelar tal-vulnerabbiltà.
(5)
Id-Dipartiment tas-CIP għandu jiżgura li titwettaq
azzjoni ta’ segwitu diliġenti fir-rigward tal-vulnerabbiltà rrappurtata.
(6)
Fejn il-vulnerabbiltà rrappurtata jista’ jkollha impatt
sinifikanti fuq entitajiet f’aktar minn Stat Membru wieħed, is-CSIRT
nazzjonali għandu, fejn xieraq, jikkoopera ma’ CSIRTs oħra maħtura
bħala koordinaturi fin-network tas-CSIRTs.
(7)
Għall-finijiet ta’ divulgazzjoni koordinata tal-
vulnerabbilitajiet, il-persuna fiżika jew ġuridika li tirrapporta għandha
titqies li tkun aġixxiet b’awtorizzazzjoni skont l-artikolu 337Ċ tal-
Kodiċi Kriminali, sakemm il-persuna fiżika jew ġuridika li tirrapporta
tikkonforma mal-politika ta’ divulgazzjoni kkoordinata tal-
vulnerabbiltajiet ta’ tali entità.
(8)
Id-Dipartiment tas-CIP għandu jwettaq l-operati tekniċi
strettament meħtieġa għall-karatterizzazzjoni tar-riskju jew it-theddida
msemmija f’dan l-artikolu
Iżda wkoll id-Dipartiment tas-CIP għandu jitqies bħala
debitament awtorizzat fit-twettiq ta’ din il-miżura skont l-artikolu
337Ċ(2) tal-Kodiċi Kriminali.
(1)
Entità essenzjali jew importanti għandha taħtar
awditur kwalifikat li għandu jivverifika jekk l-entità tkunx
implimentat il-miżuri ta’ ġestjoni tar-riskji taċ-ċibersigurtà skont l-
artikolu 19
Iżda l-awditur kwalifikat għandu jissodisfa r-rekwiżiti
elenkati fis-subartikolu (4) qabel ma jinħatar
Iżda wkoll jekk l-awditur kwalifikat jissodisfa r-rekwiżiti
elenkati fis-subartikolu (4), il-ħatra għandha tiġi approvata mid-
Dipartiment tas-CIP, jew fejn maħtura l-awtorità kompetenti.
(2)
Jekk l-awditur kwalifikat ma jkunx jista’ jivverifika jekk
l-entità essenzjali jew importanti tkunx implimentat il-miżuri ta’
ġestjoni tar-riskji taċ-ċibersigurtà skont l-artikolu 19 huwa għandu
jinnotifika b’dan bil-miktub lill-entità essenzjali jew importanti u lid-
Dipartiment tas-CIP, jew fejn maħtura l-awtorità kompetenti.
(3)
Id-Dipartiment tas-CIP, jew fejn maħtura l-awtorità
kompetenti, għandhom jiżguraw li l-entità essenzjali jew importanti
tieħu, mingħajr dewmien żejjed, il-miżuri korrettivi kollha meħtieġa,
xierqa u proporzjonati.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(4)
Id-Dipartiment tas-CIP, jew fejn maħtura, l-awtorità
kompetenti, għandhom japprovaw ħatra skont is-subartikolu (1), jekk l-
awditur kwalifikat jissottometti talba motivata b’dokumentazzjoni ta’
akkumpanjament lid-Dipartiment tas-CIP, jew fejn maħtura, l-awtorità
kompetenti, li turi li huwa
(a)
indipendenti mill-entità essenzjali jew importanti li
tkun qiegħda tiġi vverifikata, inkluż is-sottomissjoni ta’
Dikjarazzjoni ta’ Indipendenza kif determinat mid-Dipartiment
tas-CIP;
(b)
fil-pussess ta’ dokumentazzjoni li tafferma verifika
tal-isfond fuq l-imsemmi awditur maħruġa mill-awtorità
kompetenti skont id-Direttiva (UE) 2022/2557;
(ċ)
fil-pussess ta’ ċertifikazzjoni taċ-ċibersigurtà
Ewropea u, jew internazzjonali valida jew standard taċ-
ċibersigurtà kif determinat mid-Dipartiment tas-CIP; u
(d)
għandu esperjenza u sett ta’ ħiliet kif determinat
mid-Dipartiment tas-CIP.
(5)
Id-Dipartiment tas-CIP għandu jżomm lista ta’ awdituri
kwalifikati u jagħmel din il-lista disponibbli għall-entitajiet essenzjali u
importanti.
(6)
Id-Dipartiment tas-CIP għandu jistabbilixxi l-proċedura
għall-approvazzjoni tal-awditur skont is-subartikolu (1).
TAQSIMA III - STRATEĠIJA NAZZJONALI TAĊ-
ĊIBERSIGURTÀ
(1)
Il-Kumitat ta’ Tmexxija Nazzjonali għaċ-
Ċibersigurtà għandu jissorvelja l-istrateġija nazzjonali taċ-ċibersigurtà
li tistabbilixxi l-objettivi strateġiċi, ir-riżorsi meħtieġa sabiex jintlaħqu
dawk l-objettivi u l-miżuri regolatorji u politiċi xierqa biex jinkiseb u
jinżamm livell għoli ta’ ċibersigurtà f’Malta.
(1a) Il-Kumitat ta’ Tmexxija Nazzjonali għaċ-Ċibersigurtà
għandu wkoll
(a)
jaġixxi bħala l-punt ta’ referenza nazzjonali dwar
iċ-ċibersigurtà fis-settur pubbliku, fis-settur privat u fil-pubbliku
flimkien mal-entitajiet settorjali u implimentattivi rispettivi;
(b)
jipprovdi rispons koordinat għal inċidenti taċ-
ċibersigurtà fuq talba taċ-Chairperson; u
(ċ)
jipprovdi gwida dwar il-politika taċ-ċibersigurtà u
kwistjonijiet tekniċi fuq talba tal-Ministeri u l-entitajiet.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(2)
L-istrateġija
nazzjonali
taċ-ċibersigurtà
għandha
tinkludi
(a)
l-objettivi u l-prijoritajiet tal-istrateġija dwar is-
sigurtà tan-networks u tas-sistemi tal-informazzjoni li jkopru
b’mod partikolari s-setturi, is-sottosetturi u t-tipi ta’ entitajiet
elenkati fl-Ewwel u t-Tieni Skeda;
(b)
qafas ta’ governanza sabiex jintlaħqu l-objettivi u
l-prijoritajiet imsemmija fis-subartikolu (2)(a), inklużi l-politiki
msemmija fis-subartikolu (3);
(ċ)
qafas ta’ governanza li jiddefinixxi l-irwoli u r-
responsabbiltajiet tal-partijiet interessati rilevanti fil-livell
nazzjonali, li jagħmlu enfasi fuq il-kooperazzjoni u l-
koordinazzjoni fil-livell nazzjonali bejn l-awtoritajiet
kompetenti, il-punt uniku ta’ kuntatt u s-CSIRTs skont dan l-
ordni, kif ukoll il-koordinazzjoni u l-kooperazzjoni bejn dawk
il-korpi u l-awtoritajiet kompetenti skont atti legali tal-Unjoni
speċifiċi għas-settur;
(d)
mekkaniżmu sabiex jiġu identifikati
l-assi
rilevanti u l-valutazzjoni tar-riskji f’Malta;
(e)
identifikazzjoni tal-miżuri li jiżguraw it-tħejjija,
ir-rispons u l-irkupru fir-rigward tal-inċidenti, inkluża l-
kooperazzjoni bejn is-setturi pubbliċi u privati;
(f)
lista tad-diversi awtoritajiet u partijiet interessati
involuti fl-implimentazzjoni tal-istrateġija nazzjonali taċ-
ċibersigurtà;
(g)
qafas ta’ politika għal koordinazzjoni msaħħa bejn
l-awtoritajiet kompetenti skont dan l-ordni u l-awtoritajiet
kompetenti skont id-Direttiva (UE) 2022/2557 għall-fini tal-
kondiviżjoni tal-informazzjoni dwar ir-riskji, it-theddid u l-
inċidenti ċibernetiċi, kif ukoll dwar ir-riskji, it-theddid u l-
inċidenti mhux ċibernetiċi u l-eżerċizzju tal-kompiti
superviżorji, kif xieraq; u
(h)
pjan, inklużi l-miżuri meħtieġa, sabiex jissaħħaħ
il-livell ġenerali tal-għarfien dwar iċ-ċibersigurtà fost iċ-
ċittadini.
(3)
L-istrateġija nazzjonali taċ-ċibersigurtà għandha tinkludi
l-politiki li ġejjin
(a)
l-indirizzar
taċ-ċibersigurtà
fil-katina
tal-
provvista għall-prodotti tal-ICT u s-servizzi tal-ICT użati mill-
entitajiet għall-forniment tas-servizzi tagħhom;
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(b)
l-inklużjoni u l-ispeċifikazzjoni ta’ rekwiżiti
relatati maċ-ċibersigurtà għall-prodotti tal-ICT u s-servizzi tal-
ICT fl-akkwist pubbliku, inkluż fir-rigward ta’ ċertifikazzjoni
taċ-ċibersigurtà, il-kriptaġġ u l-użu ta’ prodotti taċ-ċibersigurtà
b’sors miftuħ;
(ċ)
il-ġestjoni tal-vulnerabbiltajiet, filwaqt li jkopru l-
promozzjoni u l-faċilitazzjoni tad-divulgazzjoni koordinata tal-
vulnerabbiltajiet skont l-artikolu 13(1);
(d)
b’rabta mas-sostenn tad-disponibbiltà, l-integrità u
l-kunfidenzjalità ġenerali tal-qalba pubblika tal-internet miftuħ,
inkluża, fejn rilevanti, iċ-ċibersigurtà tal-cables tal-
komunikazzjoni taħt il-baħar;
(e)
il-promozzjoni tal-iżvilupp u l-integrazzjoni ta’
teknoloġiji avvanzati rilevanti bil-għan li jiġu implimentati
miżuri ta’ ġestjoni tar-riskji taċ-ċibersigurtà tal-ogħla livell ta’
żvilupp tekniku;
(f)
il-promozzjoni u l-iżvilupp tal-edukazzjoni u
taħriġ dwar iċ-ċibersigurtà, ħiliet, għarfien u riċerka u inizjattivi
ta’ riċerka dwar iċ-ċibersigurtà, kif ukoll gwida dwar prattiki u
kontrolli tajbin tal-iġjene ċibernetika, immirati lejn iċ-ċittadini,
il-partijiet interessati u l-entitajiet;
(g)
l-appoġġ lill-istituzzjonijiet akkademiċi u tar-
riċerka fl-iżvilupp, it-titjib u l-promozzjoni tal-implimentazzjoni
ta’ għodod taċ-ċibersigurtà u infrastruttura għal network sigur;
(h)
l-inklużjoni ta’ proċeduri rilevanti u għodod xierqa
għall-kondiviżjoni
tal-informazzjoni
għall-appoġġ
tal-
kondiviżjoni volontarja tal-informazzjoni dwar iċ-ċibersigurtà
bejn l-entitajiet f’konformità mal-liġi tal-Unjoni;
(i)
it-tisħiħ tar-reżiljenza ċibernetika u l-linja bażi tal-
iġjene ċibernetika tal-intrapriżi żgħar u ta’ daqs medju, b’mod
partikolari dawk esklużi mill-kamp tal-applikazzjoni ta’ dan l-
ordni, billi tiġi provduta gwida u assistenza faċilment
aċċessibbli għall-ħtiġijiet speċifiċi tagħhom; u
(j)
il-promozzjoni tal-protezzjoni ċibernetika attiva.
(4)
L-istrateġija nazzjonali taċ-ċibersigurtà għanda tiġi
vvalutata fuq bażi regolari u mill-inqas kull ħames (5) snin abbażi ta’
indikaturi ewlenin tal-prestazzjoni u, fejn meħtieġ, tiġi aġġornata.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(1)
Il-Kumitat ta’ Tmexxija Nazzjonali
għaċ-
Ċibersigurtà għandu jkun magħmul mill-membri li ġejjin
(a)
is-Segretarju Permanenti Prinċipali jew id-delegat
tiegħu;
(b)
rappreżentant tal-Ministeru responsabbli għall-
affarijiet barranin;
(ċ)
rappreżentant tal-Ministeru responsabbli għall-
intern;
(d)
rappreżentant tal-Aġenzija tat-Teknoloġija tal-
Informazzjoni ta’ Malta;
(e)
rappreżentant
tal-Awtorità
għas-Servizzi
Finanzjarji ta’ Malta;
(f)
rappreżentant tal-Awtorità ta’ Malta dwar il-
Logħob;
(g)
rappreżentant tal-Awtorità ta’ Malta dwar il-
Komunikazzjoni;
(h)
rappreżentant
tal-Awtorità
tal-Innovazzjoni
Diġitali ta’ Malta;
(i)
rappreżentant tal-Awtorità tas-Sigurtà Nazzjonali;
(j)
rappreżentant tal-Korp tal-Pulizija ta’ Malta;
(k)
rappreżentant tal-Forzi Armati; u
(l)
rappreżentant tad-Dipartiment tas-CIP.
(2)
Il-Kumitat ta’ Tmexxija Nazzjonali għaċ-Ċibersigurtà
jista’, kull meta huwa jqis li jkun meħtieġ jew spedjenti, jingaġġa
persuna waħda (1) jew aktar, li huwa jqis li għandhom l-għarfien
espert u l-awtorizzazzjoni tas-sigurtà xierqa, sabiex jgħinuh iwettaq
kompiti speċifiċi li jeħtieġu tali għarfien espert.
(3)
Il-Kumitat ta’ Tmexxija Nazzjonali għaċ-Ċibersigurtà
jista’ jistabbilixxi wkoll sottokumitati li jiffukaw fuq oqsma speċifiċi u
tematiċi sabiex jassistu lill-Kumitat ta’ Tmexxija Nazzjonali għaċ-
Ċibersigurtà. Is-sottokumitati stabbiliti taħt l-awtorità tal-Kumitat ta’
Tmexxija Nazzjonali għaċ-Ċibersigurtà għandhom joperaw
internament u esklussivament fi ħdan il-mandat funzjonali tal-Kumitat
ta’ Tmexxija Nazzjonali għaċ-Ċibersigurtà u ma għandux ikollhom
setgħat awtonomi ta’ teħid ta’ deċiżjonijiet sakemm ma jkunux
delegati espressament mill-imsemmi Kumitat.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(4)
Iċ-Chairperson tal-Kumitat ta’ Tmexxija Nazzjonali
għaċ-Ċibersigurtà għandu jkun is-Segretarju Permanenti Prinċipali jew
id-delegat tiegħu.
(5)
Il-Viċi Chairperson għandu jinħatar mis-Segretarju
Permanenti Prinċipali minn fost il-membri tal-Kumitat ta’ Tmexxija
Nazzjonali għaċ-Ċibersigurtà.
(6)
Il-laqgħat tal-Kumitat ta’ Tmexxija Nazzjonali għaċ-
Ċibersigurtà għandhom ikunu ppreseduti miċ-Chairperson, jew fin-
nuqqas taċ-Chairperson, mill-Viċi Chairperson.
(7)
Il-Kumitat ta’ Tmexxija Nazzjonali għaċ-Ċibersigurtà
għandu jiltaqa’ f’tali intervalli regolari u għandu mill-anqas, jiltaqa’
darba kull xahrejn (2).
(8)
Il-membri tal-Kumitat ta’ Tmexxija Nazzjonali għaċ-
Ċibersigurtà u l-esperti maħtura skont is-subartikolu (1) għandhom
jittrattaw kwalunkwe informazzjoni miksuba fil-qadi ta’ dmirijiethom
jew fl-eżerċizzju tal-funzjonijiet bħala parti mill-Kumitat ta’ Tmexxija
Nazzjonali għaċ-Ċibersigurtà bħala kunfidenzjali.
(1)
Għandu jiġi stabbilit qafas nazzjonali għall-
ġestjoni tal-kriżijiet ċibernetiċi li għandu jistabbilixxi l-ġestjoni u l-
koordinazzjoni ta’ inċidenti u kriżijiet taċ-ċibersigurtà fuq skala kbira
f’Malta, inklużi
(a)
l-identifikazzjoni tal-kapaċitajiet, l-assi u l-
proċeduri li jistgħu jiġu implimentati fil-każ ta’ kriżi għall-
finijiet ta’ dan l-ordni; u
(b)
it-tfassil ta’ pjan nazzjonali ta’ rispons għall-
inċidenti u l-kriżijiet taċ-ċibersigurtà fuq skala kbira fejn ikunu
stabbiliti l-objettivi u l-arranġamenti ta’ ġestjoni tal-inċidenti u
l-kriżijiet taċ-ċibersigurtà fuq skala kbira.
(2)
Il-pjan għandu jistabbilixxi, b’mod partikolari
(a)
l-objettivi tal-miżuri u l-attivitajiet nazzjonali ta’
tħejjija;
(b)
l-awtoritajiet tal-ġestjoni tal-kriżijiet ċibernetiċi
inkluż il-kompiti u r-responsabbiltajiet;
(ċ)
il-proċeduri għall-ġestjoni tal-kriżijiet ċibernetiċi,
inkluża l-integrazzjoni tagħhom fil-qafas nazzjonali ġenerali
għall-ġestjoni tal-kriżijiet u l-mezzi tal-iskambju tal-
informazzjoni;
(d)
il-miżuri nazzjonali ta’ tħejjija, inklużi l-eżerċizzji
u l-attivitajiet ta’ taħriġ;
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(e)
il-partijiet interessati pubbliċi u privati rilevanti u
l-infrastruttura involuta;
(f)
il-proċeduri u l-arranġamenti nazzjonali bejn l-
awtoritajiet u l-korpi nazzjonali rilevanti sabiex tiġi żgurata l-
parteċipazzjoni effettiva ta’ Malta fil-ġestjoni kkoordinata tal-
inċidenti u l-kriżijiet taċ-ċibersigurtà fuq skala kbira fil-livell
tal-Unjoni; u
(g)
il-prattiki, l-iskemi ta’ klassifikazzjoni u t-
tassonomiji komuni jew standardizzati li għandhom jintużaw
fir-rigward tal-ġestjoni tal-kriżijiet ċibernetiċi.
(3)
L-awtoritajiet għall-ġestjoni tal-kriżijiet ċibernetiċi
għandu jkollhom riżorsi adegwati sabiex iwettqu, b’mod effettiv u
effiċjenti, il-kompiti msemmija fis-subartikolu (2).
(4)
Il-qafas għandu jkollu koerenza mal-oqfsa eżistenti
għall-ġestjoni ġenerali ta’ kriżijiet nazzjonali.
(5)
Id-Dipartiment tas-CIP għandu jkun ir-rappreżentant
nazzjonali ewlieni għall-finijiet tal-ġestjoni tal-kriżijiet ċibernetiċi
għan-network Ewropew għall-organizzazzjoni ta’ kollegament għall-
kriżijiet ċibernetiċi (EU CyCLONe) imwaqqaf skont l-Artikolu 16 tad-
Direttiva (UE) 2022/2555. Is-CSIRT nazzjonali jista’ jipparteċipa
wkoll fin-network Ewropew ta’ organizzazzjoni ta’ kollegament għall-
kriżijiet ċibernetiċi.
Qabel il-bidu ta’ evalwazzjoni bejn il-pari dwar Malta,
tista’ titwettaq awtovalutazzjoni tal-aspetti rieżaminati mid-
Dipartiment tas-CIP f’kooperazzjoni mas-CSIRT nazzjonali, l-
entitajiet kompetenti maħtura u entitajiet u partijiet interessati oħra
fejn meħtieġ u kif xieraq. Id-Dipartiment tas-CIP għandu jipprovdi dik
l-awtovalutazzjoni lill-esperti taċ-ċibersigurtà maħtura skont l-
Artikolu 19 tad-Direttiva.
TAQSIMA IV - MIŻURI TA’ ĠESTJONI TAR-RISKJI TAĊ-
ĊIBERSIGURTÀ U OBBLIGI TA’ RAPPORTAR
(1)
Id-Dipartiment tas-CIP, jew fejn maħtura l-
awtorità kompetenti għandhom jiżguraw li l-korpi maniġerjali ta’ tali
entitajiet essenzjali u importanti japprovaw il-miżuri ta’ ġestjoni tar-
riskji taċ-ċibersigurtà meħuda minn dawk l-entitajiet skont l-
artikolu 19 u jissorveljaw l-implimentazzjoni tagħhom. Il-persuni
fiżiċi li jiffurmaw il-korpi maniġerjali jistgħu jinżammu responsabbli
għall-ksur mill-entitajiet imsemmija fl-imsemmi artikolu skont l-
artikoli 31(10)(b) u 33.
(2)
L-applikazzjoni tas-subartikolu (1) u ta’ dan is-
subartikolu għandhom ikunu bla ħsara għal-liġi nazzjonali fir-rigward
tar-regoli tar-responsabbiltà applikabbli għall-istituzzjonijiet pubbliċi,
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
kif ukoll ir-responsabbiltà tal-impjegati pubbliċi u l-uffiċjali eletti jew
maħtura.
(3)
Membri tal-korp maniġerjali ta’ entitajiet essenzjali u
importanti huma meħtieġa jsegwu taħriġ sabiex iwettqu l-kompiti
tagħhom.
(4)
L-entitajiet essenzjali u importanti għandhom joffru
taħriġ simili lill-impjegati tagħhom b’mod regolari, sabiex jiksbu
għarfien u ħiliet suffiċjenti sabiex ikunu jistgħu jidentifikaw ir-riskji u
jivvalutaw il-prattiki tal-ġestjoni tar-riskji taċ-ċibersigurtà u l-impatt
tagħhom fuq is-servizzi pprovduti mill-entità.
(1)
Id-Dipartiment tas-CIP, jew fejn maħtura l-
awtorità kompetenti, għandhom jiżguraw li l-entitajiet essenzjali u
importanti
(a)
jieħdu l-miżuri tekniċi,
operazzjonali u
organizzattivi xierqa u proporzjonati sabiex jiġġestixxu r-riskji li
jinħolqu għas-sigurtà tan-network u s-sistemi tal-informazzjoni
li dawk l-entitajiet jużaw fl-operat tagħhom jew għall-forniment
tas-servizzi tagħhom, u sabiex jipprevjenu jew jimminimizzaw
l-impatt tal-inċidenti fuq riċevituri tas-servizzi tagħhom u fuq
servizzi oħra;
(b)
jiżguraw livell ta’ sigurtà tan-networks u tas-
sistemi tal-informazzjoni xieraq għar-riskji maħluqa, filwaqt li
jitqiesu l-istandards Ewropej u internazzjonali rilevanti tal-ogħla
livell ta’ żvilupp tekniku u, fejn applikabbli, kif ukoll l-ispiża
tal-implimentazzjoni ul-miżuri msemmija fil-paragrafu (a)
Iżda meta tkun qiegħda tiġi vvalutata l-
proporzjonalità ta’ dawk il-miżuri, għandu jitqies kif xieraq il-
grad tal-esponiment tal-entità għar-riskji, id-daqs tal-entità u l-
probabbiltà li jseħħu l-inċidenti u s-severità tagħhom, inkluż l-
impatt soċjetali u ekonomiku tagħhom;
(ċ)
jaħtru uffiċjal koordinatur tas-sigurtà li għandu
jkollu l-għarfien espert meħtieġ u li għandu
(i)
jiffaċilita l-iżvilupp, l-implimentazzjoni, il-
manutenzjoni u jirrevedi l-pjanijiet ta’ kontinwità tal-
operat u fejn meħtieġ pjanijiet ta’ terminazzjoni li
jinkludu t-tħejjija, il-proċessi u s-soluzzjonijiet tal-entità
essenzjali jew importanti;
(ii)
jiżgura li l-entità essenzjali jew importanti
twettaq u żżomm valutazzjonijiet tar-riskju adegwati;
(iii) jiżgura li l-entità essenzjali jew importanti
żżomm u teżerċita pjan ta’ sigurtà għall-operatur; u
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(iv) jaġixxi bħala l-punt ta’ kuntatt bejn l-entità
essenzjali jew importanti u d-Dipartiment tas-CIP, jew
fejn maħtura l-awtorità kompetenti, sabiex jiżgura t-
twettiq tal-obbligi stabbiliti f’dan l-ordni;
(d)
jirċievi servizzi ta’ monitoraġġ tas-CSIRTs
mingħand kwalunkwe wieħed mis-CSIRTs li ġejjin, li
għandhom jikkonformaw mar-rekwiżiti stabbiliti fl-artikolu
9(1) u jwettqu l-kompiti stabbiliti fl-artikolu 10(2)
(i)
CSIRT interna; jew
(ii)
CSIRT awtonoma.
(2)
Il-miżuri msemmija fis-subartikolu (1) għandhom ikunu
bbażati fuq approċċ għall-perikli kollha li jkollu l-għan li jipproteġi n-
network u s-sistemi tal-informazzjoni u l-ambjent fiżiku ta’ dawk is-
sistemi mill-inċidenti, u għandhom jinkludu mill-inqas dan li ġej
(a)
politiki dwar l-analiżi tar-riskji u s-sigurtà tas-
sistema tal-informazzjoni;
(b)
ittrattar tal-inċidenti;
(ċ)
kontinwità tal-operat, bħall-ġestjoni ta’ riżerva u
l-irkupru minn diżastri u ġestjoni tal-kriżijiet;
(d)
is-sigurtà tal-katina tal-provvista, inklużi aspetti
relatati mas-sigurtà li jikkonċernaw ir-relazzjonijiet bejn kull
entità u l-fornituri jew il-fornituri tas-servizzi diretti tagħha;
(e)
is-sigurtà fl-akkwist, l-iżvilupp u l-manutenzjoni
tan-network u s-sistemi tal-informazzjoni, inklużi t-trattament u
d-divulgazzjoni tal-vulnerabbiltajiet;
(f)
politiki u proċeduri sabiex tiġi vvalutata l-
effettività tal-miżuri ta’ ġestjoni tar-riskji taċ-ċibersigurtà;
(g)
prattiki bażiċi tal-iġjene ċibernetika u taħriġ dwar
iċ-ċibersigurtà;
(h)
politiki u proċeduri dwar l-użu tal-kriptografija u,
fejn xieraq, il-kriptaġġ;
(i)
is-sigurtà tar-riżorsi umani, il-politika dwar il-
ġestjoni tar-riskju minn informazzjoni privileġġata, il-politiki
dwar il-kontroll tal-aċċess u l-ġestjoni tal-assi;
(j)
l-użu tal-awtentikazzjoni b’diversi fatturi jew ta’
soluzzjonijiet ta’ awtentikazzjoni kontinwa, komunikazzjonijiet
bil-vuċi, bil-vidjo u testwali siguri u sistemi tal-komunikazzjoni
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
ta’ emerġenza siguri fi ħdan l-entità, fejn xieraq;
(k)
ir-reġistrazzjoni u t-traċċabbiltà tan-networks u
tas-sistemi tal-informazzjoni.
(3)
Id-Dipartiment tas-CIP, jew fejn maħtura l-awtorità
kompetenti, għandhom jiżguraw li, meta jikkunsidraw liema miżuri
msemmija fis-subartikolu (2)(d) huma xierqa, l-entitajiet għandhom
iqisu l-vulnerabbiltajiet speċifiċi għal kull fornitur u fornitur tas-
servizzi dirett u l-kwalità ġenerali tal-prodotti u l-prattiki taċ-
ċibersigurtà tal-fornituri u l-fornituri tas-servizzi tagħhom, inklużi l-
proċeduri siguri tal-iżvilupp tagħhom. Id-Dipartiment tas-CIP, jew fejn
maħtura l-awtorità kompetenti, għandhom jiżguraw ukoll li, meta jkunu
qegħdin jikkunsidraw liema miżuri msemmija fl-imsemmi subartikolu
huma xierqa, l-entitajiet ikunu meħtieġa jqisu r-riżultati tal-
valutazzjonijiet tar-riskju tas-sigurtà kkoordinati tal-ktajjen tal-
provvista kritiċi mwettqa skont l-Artikolu 22(1) tad-Direttiva.
(4)
Id-Dipartiment tas-CIP, jew fejn maħtura l-awtorità
kompetenti, għandhom jiżguraw li fejn entità essenzjali jew importanti
ssib li ma tikkonformax mal-miżuri previsti fis-subartikolu (2), l-entità
kkonċernata għandha tieħu, mingħajr dewmien żejjed, il-miżuri
korrettivi kollha meħtieġa, xierqa u proporzjonati imsemmija fl-
artikolu 29 għall-entitajiet essenzjali jew fl-artikolu 30 għall-entitajiet
importanti.
(1)
L-entitajiet essenzjali u importanti għandhom
jinnotifikaw minnufih lis-CSIRT nazzjonali dwar kwalunkwe inċident
li jkollu impatt sinifikanti fuq il-forniment tas-servizzi tagħhom skont
is-subartikolu (6)
Iżda s-sempliċi att tan-notifika ma għandux jissoġġetta lill-
entità notifikata għal aktar responsabbiltà
Iżda wkoll is-CSIRT nazzjonali għandu jinnotifika
minnufih bil-miktub lid-Dipartiment tas-CIP u lil kwalunkwe awtorità
kompetenti oħra maħtura, skont il-każ, bi kwalunkwe inċident li jkollu
impatt sinifikanti fuq il-forniment tas-servizzi pprovduti minn entità
essenzjali jew importanti li tali awtorità tirregola.
(2)
Fejn xieraq, l-entitajiet essenzjali u importanti għandhom
jinnotifikaw, mingħajr dewmien żejjed, lir-riċevituri tas-servizzi
tagħhom dwar l-inċidenti sinifikanti li aktarx jaffettwaw ħażin il-
forniment ta’ dawk is-servizzi. Dawk l-entitajiet għandhom
jirrapportaw kwalunkwe informazzjoni li tippermetti lis-CSIRT
nazzjonali tiddetermina kwalunkwe impatt transfruntier tal-inċident.
(3)
Fil-każ ta’ inċident sinifikanti transfruntier jew
transsettorjali, id-Dipartiment tas-CIP għandu jiġi pprovdut fi żmien
xieraq bl-informazzjoni rilevanti notifikata skont is-subartikolu (5).
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(4)
Fejn applikabbli, l-entitajiet essenzjali u importanti
għandhom jikkomunikaw, mingħajr dewmien żejjed, lir-riċevituri tas-
servizzi tagħhom potenzjalment affettwati minn theddida ċibernetika
sinifikanti kwalunkwe miżuri jew rimedji li dawk ir-riċevituri kapaċi
jieħdu bħala rispons għal dik it-theddida. Fejn xieraq, l-entitajiet
għandhom jinfurmaw ukoll lil dawk ir-riċevituri bit-theddida
ċibernetika sinifikanti nnifisha.
(5) Għall-fini tan-notifika skont is-subartikolu (1), l-
entitajiet ikkonċernati għandhom jissottomettu lis-CSIRT nazzjonali
(a)
mingħajr dewmien żejjed u fi kwalunkwe każ fi
żmien erbgħa u għoxrin (24) siegħa minn meta jkunu saru jafu
bl-inċident sinifikanti, twissija bikrija, li fejn applikabbli,
għandha tindika jekk l-inċident sinifikanti huwiex issuspettat li
ġie kkawżat minn atti illegali jew malizzjużi jew jistax ikollu
impatt transfruntier;
(b)
mingħajr dewmien żejjed u fi kwalunkwe każ fi
żmien tnejn u sebgħin (72) siegħa minn meta jsiru jafu bl-
inċident sinifikanti, notifika tal-inċident, li fejn applikabbli,
għandha taġġorna l-informazzjoni msemmija fil-paragrafu (a) u
tindika valutazzjoni inizjali tal-inċident sinifikanti, inklużi s-
severità u l-impatt tiegħu, kif ukoll fejn disponibbli, l-indikaturi
ta’ kompromess;
(ċ)
fuq talba ta’ CSIRT nazzjonali, rapport intermedju
dwar l-aġġornamenti rilevanti tal-istatus;
(d)
rapport finali mhux aktar tard minn xahar (1) wara
s-sottomissjoni tan-notifika tal-inċident skont is-subartikolu
(5)(b), li jinkludi dan li ġej
(i)
deskrizzjoni dettaljata tal-inċident, inklużi
s-severità u l-impatt tiegħu;
(ii)
it-tip ta’ theddida jew kawża ewlenija li
x’aktarx skattat l-inċident;
(iii) il-miżuri ta’ mitigazzjoni applikati u li
għadhom fis-seħħ;
(iv)
fejn applikabbli, l-impatt transkonfinali tal-
inċident;
(e)
fil-każ ta’ inċident li jkun għadu għaddej fiż-żmien
tas-sottomissjoni tar-rapport finali msemmi fil-
paragrafu (d), l-entitajiet ikkonċernati għandhom
jipprovdu lis-CSIRT nazzjonali rapport ta’ progress
f’dak il-waqt u rapport finali fi żmien xahar (1)
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
minn meta jkunu trattaw l-inċident.
(6)
B’deroga mis-subartikolu (5)(b), il-fornitur ta’ servizzi
fiduċjarji għandu, fir-rigward ta’ inċidenti sinifikanti li jkollhom impatt
fuq il-forniment tas-servizzi fiduċjarji tiegħu, jinnotifika lis-CSIRT
nazzjonali mingħajr dewmien żejjed u fi kwalunkwe każ fi żmien
erbgħa u għoxrin (24) siegħa minn meta jsir jaf bl-inċident sinifikanti.
(7)
Is-CSIRT nazzjonali għandu jipprovdi, mingħajr
dewmien żejjed u fejn ikun possibbli fi żmien erbgħa u għoxrin (24)
siegħa minn meta jirċievi t-twissija bikrija msemmija fis-subartikolu
(5)(a), rispons lill-entità notifikanti, inkluż feedback inizjali dwar l-
inċident sinifikanti u, fuq talba tal-entità, gwida jew pariri operattivi
dwar l-implimentazzjoni ta’ miżuri potenzjali ta’ mitigazzjoni
Iżda meta s-CSIRT nazzjonali ma jkunx ir-riċevitur
inizjali tan-notifika msemmija fis-subartikolu (1), il-gwida għandha
tingħata mill-awtorità kompetenti maħtura f’kooperazzjoni mas-CSIRT
nazzjonali. Is-CSIRT nazzjonali għandu jipprovdi appoġġ tekniku
addizzjonali jekk l-entità kkonċernata titlob dan, diment li l-kapaċità
teknika tkun disponibbli.
(8)
Fejn ikun hemm suspett raġonevoli li l-inċident
sinifikanti huwa reat kriminali, is-CSIRT nazzjonali, id-Dipartiment
tas-CIP jew fejn maħtura l-awtorità kompetenti, għandhom jipprovdu
wkoll gwida dwar ir-rappurtar tal-inċident sinifikanti lill-Pulizija
Eżekuttiva.
(9)
Fejn xieraq, u b’mod partikolari fejn l-inċident sinifikanti
jikkonċerna lil Malta u tal-inqas Stat Membru ieħor, is-CSIRT
nazzjonali, b’koordinazzjoni minn qabel mad-Dipartiment tas-CIP u
fejn maħtura l-awtorità kompetenti, għandu jinforma, mingħajr
dewmien żejjed, lill-Istat Membru l-ieħor affettwat u lill-ENISA dwar
l-inċident sinifikanti u tali informazzjoni għandha tinkludi t-tip ta’
informazzjoni riċevuta skont is-subartikolu (5)
Iżda meta jagħmel dan, is-CSIRT nazzjonali għandu,
skont il-liġi nazzjonali u, jew il-liġi tal-Unjoni, iħares l-interessi tas-
sigurtà u kummerċjali tal-entità kif ukoll il-kunfidenzjalità tal-
informazzjoni pprovduta.
(10) Fejn l-għarfien tal-pubbliku jkun meħtieġ għall-
prevenzjoni ta’ inċident sinifikanti jew għat-trattament ta’ inċident
sinifikanti li jkun għadu għaddej, jew fejn id-divulgazzjoni tal-inċident
sinifikanti tkun xort’oħra fl-interess pubbliku, is-CSIRT nazzjonali u
fejn xieraq is-CSIRTs jew l-awtoritajiet kompetenti ta’ Stati Membri
oħra kkonċernati, jistgħu, wara konsultazzjoni mal-entità kkonċernata,
jinfurmaw lill-pubbliku dwar l-inċident sinifikanti jew jeħtieġu lill-
entità tagħmel dan.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
(11) Mat-talba tas-CSIRT nazzjonali jew fejn maħtura l-
awtorità kompetenti maħtura, id-Dipartiment tas-CIP għandu jibgħat
in-notifiki li jkun irċieva skont is-subartikolu (1) lill-punti uniċi ta’
kuntatt tal-Istati Membri l-oħra affettwati.
(12) Is-CSIRT nazzjonali għandu jipprovdi lid-Dipartiment
tas-CIP informazzjoni dwar inċidenti sinifikanti, inċidenti, theddid
ċibernetiku u kważi inċidenti notifikati skont is-subartikolu (1) u mal-
artikolu 27.
(13) Id-Dipartiment tas-CIP għandu jippreżenta lill-ENISA u
lill-Kumitat ta’ Tmexxija Nazzjonali taċ-Ċibersigurtà, rapport
sommarju li jkun fih data anonimizzata u aggregata dwar l-inċidenti
sinifikanti, l-inċidenti, it-theddid ċibernetiku u l-kważi inċidenti
notifikati skont is-subartikolu (1) u mal-artikolu 27.
(14) Kull tliet (3) xhur, il-punt uniku ta’ kuntatt għandu
jippreżenta lill-ENISA rapport sommarju li jkun fih data anonimizzata
u aggregata dwar l-inċidenti sinifikanti, l-inċidenti, it-theddid
ċibernetiku u l-kważi inċidenti notifikati skont is-subartikolu (1) u
mal-artikolu 27.
(1)
Fl-implimentazzjoni
tal-artikolu 19,
id-
Dipartiment tas-CIP għandu mingħajr ma jimponi jew jiddiskrimina
favur l-użu ta’ kwalunkwe tip ta’ teknoloġija partikolari, jinkoraġġixxi
l-użu ta’ prodotti tal-ICT, servizzi tal-ICT u proċessi tal-ICT,
żviluppati mill-entità essenzjali jew importanti jew akkwistati minn
partijiet terzi, li huma ċċertifikati taħt l-iskemi Ewropej taċ-
ċertifikazzjoni taċ-ċibersigurtà adottati skont l-Artikolu 49 tar-
Regolament (UE) 2019/881 tal-Parlament Ewropew u tal-Kunsill tas-
17 ta’ April 2019 dwar l-ENISA (l-Aġenzija tal-Unjoni Ewropea għaċ-
Ċibersigurtà) u dwar iċ-ċertifikazzjoni taċ-ċibersigurtà tat-teknoloġija
tal-informazzjoni u tal-komunikazzjoni u li jħassar ir-Regolament
(UE) Nru 526/2013 (l-Att dwar iċ-Ċibersigurtà)
Iżda d-Dipartiment tas-CIP, jew fejn maħtura l-awtorità
kompetenti, għandhom jeħtieġu, fejn applikabbli, li l-entitajiet
essenzjali u importanti jużaw tali prodotti tal-ICT, servizzi tal-ICT u
proċessi tal-ICT
Iżda wkoll li kategoriji speċifiċi ta’ entitajiet essenzjali u
importanti elenkati fl-atti delegati tal-Kummissjoni, għandhom jużaw
ċerti prodotti tal-ICT, servizzi tal-ICT u proċessi tal-ICT iċċertifikati
jew jiksbu ċertifikat taħt skema Ewropea taċ-ċertifikazzjoni taċ-
ċibersigurtà adottata skont l-Artikolu 49 tar-Regolament (UE) 2019/
881. (2)
L-entitajiet essenzjali u importanti jistgħu jużaw servizzi
fiduċjarji kwalifikati.
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
Sabiex jippromwovi l-implimentazzjoni konverġenti tal-
artikolu 19(1) u (2), id-Dipartiment tas-CIP għandu, mingħajr ma
jimponi jew jiddiskrimina favur l-użu ta’ xi tip ta’ teknoloġija
partikolari, jinkoraġġixxi l-użu ta’ standards u speċifikazzjonijiet
tekniċi Ewropej u internazzjonali li jkunu rilevanti għas-sigurtà tan-
network u s-sistemi tal-informazzjoni.
TAQSIMA V - ĠURISDIZZJONI U REĠISTRAZZJONI
(1)
L-entitajiet li jaqgħu fil-kamp tal-applikazzjoni ta’
dan l-ordni għandhom jitqiesu li jaqgħu taħt il-ġurisdizzjoni ta’ Malta
jekk ikunu stabbiliti f’Malta, ħlief fil-każ ta’
(a)
fornituri ta’ networks pubbliċi tal-komunikazzjoni
elettronika jew fornituri ta’ servizzi tal-komunikazzjoni
elettronika disponibbli pubblikament, li għandhom jitqiesu li
jaqgħu taħt il-ġurisdizzjoni tal-Istat Membru li fih jipprovdu s-
servizzi tagħhom;
(b)
fornituri ta’ servizzi tad-DNS, ir-reġistri ta’
ismijiet tat-TLD, l-entitajiet li jipprovdu servizzi ta’
reġistrazzjoni tal-ismijiet ta’ dominju, il-fornituri ta’ servizzi
tal-cloud computing, il-fornituri ta’ servizzi ta’ ċentri tad-data,
il-fornituri ta’ networks tal-konsenja tal-kontenut, il-fornituri ta’
servizzi ġestiti, il-fornituri ta’ servizzi tas-sigurtà ġestiti, kif
ukoll il-fornituri ta’ swieq online, ta’ magni tat-tiftix online, jew
ta’ pjattaformi ta’ servizzi ta’ networking soċjali, li għandhom
jitqiesu li jaqgħu taħt il-ġurisdizzjoni tal-Istat Membru fejn
għandhom l-istabbiliment prinċipali tagħhom fl-Unjoni skont is-
subartikolu (2);
(ċ)
entitajiet tal-amministrazzjoni pubblika, li
għandhom jitqiesu li jaqgħu taħt il-ġurisdizzjoni tal-Istat
Membru li stabbiliehom.
(2)
Għall-finijiet ta’ dan l-ordni, entità kif provdut fis-
subartikolu (1)(b) għandha titqies li għandha l-istabbiliment ewlieni
tagħha fl-Unjoni, fl-Istat Membru fejn jittieħdu l-biċċa l-kbira tad-
deċiżjonijiet relatati mal-miżuri ta’ ġestjoni tar-riskji taċ-ċibersigurtà
Iżda jekk tali Stat Membru ma jkunx jista’ jiġi
ddeterminat jew jekk tali deċiżjonijiet ma jittiħdux fl-Unjoni, l-
istabbiliment ewlieni għandu jitqies li jkun fl-Istat Membru fejn
jitwettqu l-operazzjonijiet taċ-ċibersigurtà
Iżda wkoll jekk tali Stat Membru ma jkunx jista’ jiġi
ddeterminat, l-istabbiliment ewlieni għandu jitqies li jkun fl-Istat
Membru fejn l-entità kkonċernata jkollha l-istabbiliment bl-akbar
numru ta’ impjegati fl-Unjoni.
(3)
Jekk entità kif imsemmi fis-subartikolu (1)(b), ma tkunx
ĊIBERSIGURTÀ MADWAR L-UNJONI EWROPEA (MALTA)
stabbilita fl-Unjoni, iżda toffri servizzi fl-Unjoni, din għandha taħtar
rappreżentant fl-Unjoni u tali rappreżentant għandu jkun stabbilit
f’wieħed (1) minn dawk l-Istati Membri fejn huma offruti s-servizzi.
Tali entità għandha titqies li taqa’ taħt il-ġurisdizzjoni tal-Istat
Membru fejn ikun stabbilit ir-rappreżentant.
(4)
Fin-nuqqas ta’ rappreżentant fl-Unjoni maħtur skont is-
subartikolu (3), id-Dipartiment tas-CIP, jew, fejn maħtura, l-awtorità
kompetenti, jistgħu jieħdu azzjoni legali kontra l-entità għall-ksur ta’
dan l-ordni fejn l-entità tipprovdi s-servizzi tagħha f’Malta.
(5)
Il-ħatra ta’ rappreżentant minn entità kif pprovdut fis-
subartikolu (1)(b) għandha tkun bla ħsara għal kwalunkwe azzjoni
legali li tista’ tinbeda kontra l-entità nnifisha.
(6)
Fuq talba għal assistenza reċiproka fir-rigward ta’ entità
fis-subartikolu (1)(b), id-Dipartiment tas-CIP jew, fejn maħtura, l-
awtorità kompetenti, jistgħu fil-limiti ta’ tali talba, jieħdu miżuri
superviżorji u ta’ infurzar xierqa fir-rigward tal-entità kkonċernata li
tipprovdi servizzi jew li għandha network u sistema ta’ informazzjoni
f’Malta.
(9)
Sub-articles (7) and (8) shall not apply where an entity
acts as a trust service provider.
(10) This order shall not apply to entities which are exempted
from the scope of Regulation (EU) 2022/2554 of the European
Parliament and of the Council of 14 December 2022 on digital
operational resilience for the financial sector and amending
Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/
2014, (EU) No 909/2014 and (EU) 2016/1011, in accordance with
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
Article 2(4) of the said Regulation.
(11) The obligations established in this order shall not entail
the supply of information the disclosure of which would be contrary to
the essential interests of the national security, public security or
defence of Malta.
(12) This order applies without prejudice to the Data
Protection Act, the Processing of Personal Data (Electronic
Communications Sector) Regulations, the Criminal Code and Directive
(EU) 2022/2557;
(13) Without prejudice to Article 346 of the Treaty on the
Functioning of the European Union, information that is confidential
pursuant to Union or national rules, such as rules on business
confidentiality, shall be exchanged with the European Commission and
other relevant authorities in accordance with this order only where that
exchange is necessary for the application of this order. The information
exchanged shall be limited to that which is relevant and proportionate
to the purpose of such exchange. The exchange of information shall
preserve the confidentiality of such information and protect the security
and commercial interests of entities concerned.
(14) Entities, the CIP Department or where designated the
competent authority, the single point of contact and CSIRTs shall
process personal data to the extent necessary for the purposes of this
order and in accordance with the Data Protection Act, including the
regulations made thereunder, and Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation), in particular such
processing shall rely on Article 6 of the said Regulation.
(15) The processing of personal data pursuant to this order by
providers of public electronic communications networks or providers
of publicly available electronic communications services shall be
carried out in conformity with national data protection legislation,
Union data protection law and Union privacy law, in particular the
Processing of Personal Data (Electronic Communications Sector)
Regulations.
(16) Where sector-specific Union legal acts require essential
or important entities to adopt cybersecurity risk-management measures
or to notify the CSIRT of significant incidents and where those
requirements are at least equivalent in effect to the obligations
established in this order, the relevant provisions of this order, including
the provisions on supervision and enforcement established in Part VII,
shall not apply to such entities
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
Provided that where sector-specific Union legal acts do
not cover all entities in a specific sector falling within the scope of this
order, the relevant provisions of this order shall continue to apply to
the entities not covered by those sector-specific Union legal acts.
(17) The requirements in sub-article (16) shall be considered
to be equivalent in effect to the obligations established in this order
where
(a)
the cybersecurity risk-management measures are
at least equivalent in effect to those in articles 19(1), (2) and
(3); or
(b)
the sector-specific Union legal act provides for
immediate access, where appropriate automatic and direct, to
the incident notifications by the CSIRTs, the CIP Department or
where designated the competent authorities or the single points
of contact in accordance with this order and where requirements
to notify significant incidents are at least equivalent in effect to
those established in articles 20(1) to (6).
4. (1)
For the purposes of this order, the following
entities shall be considered to be essential entities
(a)
entities of a type indicated in the First Schedule
which exceed the ceilings for medium-sized enterprises
provided for in accordance with Article 2(1) of the Annex to the
Commission Recommendation 2003/361/EC;
(b)
qualified trust service providers and top-level
domain name registries as well as DNS service providers,
regardless of their size;
(c)
providers of public electronic communications
networks or of publicly available electronic communications
services which qualify as medium-sized enterprises in
accordance with Article 2 of the Annex to the Commissioner
Recommendation 2003/361/EC;
(d)
public administration entities mentioned in article
3(3)(f)(i);
(e)
any other entity of a type referred to in the First or
Second Schedule that are identified by the CIP Department or
where designated the competent authority as an essential entity
pursuant to articles 3(3)(b) to (e);
(f)
entities identified as critical entities under the
Resilience of Critical Entities and Infrastructures
(Identification, Designation and Protection) Order in article
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
3(4);
(g)
entities which the CIP Department or where
designated the competent authority identified before 16 January
2023 as operators of essential services in conformity with
(i)
Directive (EU) 2022/2555 of the European
Parliament and of the Council of 14 December 2022 on
measures for a high common level of cybersecurity across
the Union, amending Regulation (EU) No 910/2014 and
Directive (EU) 2018/1972, and repealing Directive (EU)
2016/1148 (NIS 2 Directive); or
(ii)
national law.
(2)
For the purposes of this order, entities of a type referred to
in the First or Second Schedule which do not qualify as essential
entities pursuant to sub-article (1) shall be considered to be important
entities. This includes entities identified by the CIP Department or
where designated the competent authority as important entities
pursuant to articles 3(3)(b) to (e).
PART II – ENFORCEMENT COMMITTEE, CRITICAL
INFRASTRUCTURE PROTECTION DEPARTMENT AND
CSIRTs
5. (1)
There shall be a committee designated as the
Enforcement Committee, composed of such members as shall be
appointed by the Minister from amongst public officers occupying a
senior position and performing duties in the ministries responsible for
matters relating to cybersecurity of essential and important entities, as
well as from amongst employees occupying a senior position in the
other organisations having a main interest in the management, running
and control of cybersecurity at essential or important entities in Malta
Provided that the Minister may appoint other persons as
members of the Committee who appear to him to have the experience
and to have shown the capacity in matters relating to cyber resilience of
essential and important entities
Provided further that the competent authorities listed in
the First and Second Schedules, other than the CIP Department, may
appoint one (1) person as their representative in the Committee.
(2)
The Director General responsible for the CIP Department
shall be the chairperson of the Committee, the Director of this
Department shall be the deputy chairperson, and one other
representative from this Department shall act as the secretary of the
Committee. The chairperson, deputy chairperson and secretary shall
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
not possess voting rights. The deputy chairperson shall act instead of
the chairperson whenever the chairperson is absent from a meeting of
the Committee or is unable to act as chairperson for any reason.
(3)
The appointed members shall hold office for such term,
that shall not be more than three (3) years, as may be specified in their
letter of appointment.
(4)
If any vacancy in the Committee occurs during the period
of appointment, on account of death, resignation or for any other
cause, the Minister shall, as soon as practicable, appoint another
person to fill the vacancy
Provided that the Committee and the members thereof
may act notwithstanding any such vacancy.
(5)
Notwithstanding any other provision of this article, the
Minister may at any time terminate the appointment of an appointed
member if, in his opinion, such appointed member is unfit to continue
in office or has become incapable of properly performing his
functions.
(6)
The Committee shall meet as often as necessary and shall
regulate its own procedures.
6. It shall be the duty of the Committee to issue decisions in
relation to the imposition of an administrative penalty in accordance
with articles 32, 33, 34 and 38.
7. (1)
The CIP Department shall be the national
supervisory authority responsible for monitoring the implementation
of this order at national level and ensuring compliance therewith,
implementing relevant provisions of this order and covering the
sectors, sub-sectors and types of entities listed in the tables to the First
and Second Schedules
Provided that as the national supervisory authority the
CIP Department shall be responsible for
(a)
establishing the criteria for the identification and
designation of essential and important entities;
(b)
building partnerships with operators of critical
information infrastructures for information sharing, without
prejudice to article 26;
(c)
establishing
a
national
self-registration
mechanism for essential and important entities providing
services in Malta, the CSIRTs providing monitoring services
within such entities as well as entities providing domain name
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
registration services in Malta, which shall provide information
in accordance with article 24(1);
(d)
establishing a register on the basis of paragraph (h)
and reviewing and, where appropriate, updating such register on
a regular basis and at least every two (2) years;
(e)
adopting the strategy on the security of network
and information systems, as detailed in the National
Cybersecurity Strategy in accordance with article 15;
(f)
supervising and enforcing measures on all CSIRTs
in accordance with articles 29 and 30;
(g)
managing an internal cybersecurity operations
center and an internal CSIRT;
(h)
acting as a coordinator for the purposes of the
coordinated vulnerability disclosure in accordance with article
13(1); and
(i)
ensuring effective, efficient and secure cooperation
in the Cooperation Group.
(2)
The First and Second Schedules designate the competent
authorities for each sectors or sub-sectors and clearly establish the tasks
of each competent authorities concerned. The designated competent
authorities shall cooperate effectively, under the supervision of the CIP
Department as the national supervisory authority, to fulfil their tasks
under this order. The designated competent authorities shall make
available to the CIP Department all information and documents
required for the Department to ensure compliance with this Order.
(3)
Unless otherwise expressly provided in this order or any
other law, and unless another designated competent authority is
responsible for the sector, sub-sector or type of entity in the First or
Second Schedule, the CIP Department shall be responsible for
(a)
identifying and designating essential and important
entities;
(b)
identifying the services provided by essential and
important entities;
(c)
ensuring that risk assessments are carried out by
essential and important entities;
(d)
ensuring that operator security plans and business
continuity plans are drawn up and maintained by essential and
important entities;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(e)
instigating simulated runs of operator security
plans and business continuity plans by essential and important
entities;
(f)
monitoring
cybersecurity
risk-management
measures undertaken by essential and important entities in
accordance with article 19;
(g)
monitoring reporting obligations undertaken by
essential and important entities in accordance with article 20;
and
(h)
supervising and enforcing measures on essential
and important entities, and on all CSIRTs in accordance with
articles 29 and 30
Provided that the CIP Department shall be deemed as
duly authorised in the carrying out of any of the above measures in
accordance with article 337C(2) of the Criminal Code
Provided further that in accordance with Article 47(1) of
Regulation (EU) 2022/2554 of the European Parliament and of the
Council of 14 December 2022 on digital operational resilience for the
financial sector and amending Regulations (EC) No 1060/2009, (EU)
No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/
1011, the Malta Financial Services Authority may participate in the
activities of the Cooperation Group for matters that concern its
supervisory activities in relation to financial entities
Provided further that the Malta Financial Services
Authority may request the CIP Department to participate in the
activities of the Cooperation Group for matters pertaining to essential
or important entities, subject to such entities having been designated in
accordance with this order as critical ICT third-party service providers
in accordance with Article 31 of Regulation (EU) 2022/2554 of the
European Parliament and of the Council of 14 December 2022 on
digital operational resilience for the financial sector and amending
Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/
2014, (EU) No 909/2014 and (EU) 2016/1011
Provided further that the CIP Department shall exercise a
liaison function as a single point of contact in accordance with this
order, to ensure cross-border cooperation of Maltese authorities with
the relevant authorities of other Member States and, where
appropriate, with the European Commission and ENISA, as well as to
ensure cross-sectoral cooperation with other competent authorities
within Malta
Provided further that the national CSIRT shall have
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
access to the register as defined in article 7(1)(d) as maintained and
updated by the CIP Department.
(4)
Essential and important entities providing services in
Malta as well as entities providing domain name registration services in
Malta shall register on the national self-registration mechanism
established by the CIP Department in accordance with sub-article 3(h),
and shall provide at least the following information
(a)
the name of the entity;
(b)
the name of the CSIRT providing monitoring
services to the entity and whether it is an internal or autonomous
CSIRT;
(c)
the address and up-to-date contact details,
including email addresses, IP ranges and telephone numbers;
(d)
where applicable, the relevant sector and sub-
sector listed in the First or Second Schedule; and
(e)
where applicable, a list of the Member States
where they provide services falling within the scope of this
order.
(5)
The essential or important entities shall notify the CIP
Department about any changes to the details submitted in accordance
with sub-article (4) without delay and, in any event, within two (2)
weeks of the date of the change.
(6)
The CIP Department shall also perform such related and
consequential duties as the Minister may delegate from time to time.
(7)
The Director General or his delegate shall represent the
CIP Department in any judicial proceedings.
8. (1)
There shall be established a national CSIRT within
the Malta Information Technology Agency, which shall comply with
the requirements established in sub-article 9(1). It shall be responsible
for incident handling in accordance with a well-defined process and
shall cover at least the sectors, sub-sectors and types of entities listed in
the First and Second Schedule.
(2)
The national CSIRT shall
(a)
cooperate and, where appropriate, exchange
relevant information in accordance with article 26 with sectoral
or cross-sectoral communities of essential and important
entities;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(b)
participate in peer
reviews
organised
in
accordance with article 17; and
(c)
act as the national representative to the CSIRT
network.
(3)
The national CSIRT may establish cooperation
relationships with third countries’ national CSIRTs subject to a
cooperation agreement. The cooperation agreement shall facilitate
effective, efficient and secure information exchange with those third
countries’ national CSIRTs, using relevant information-sharing
protocols, including the Traffic Light Protocol.
(4)
As part of such cooperation relationships, the national
CSIRT may
(a)
exchange relevant information with third
countries’ national CSIRTs, including personal data in
accordance with Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection
Regulation);
(b)
cooperate with third countries’ national CSIRTs
or equivalent third-country bodies, in particular for the purpose
of providing them with cybersecurity assistance.
9. (1)
All CSIRTs shall comply with the following
requirements
(a)
the CSIRTs shall ensure a high level of
availability of their communication channels by avoiding single
points of failure, and shall have several means for being
contacted and for contacting others at all times, they shall
clearly specify the communication channels and make them
known to constituency and cooperative partners;
(b)
the CSIRTs’ offices and the supporting
information systems shall be located at secure sites;
(c)
the CSIRTs shall be equipped with an appropriate
system for managing and routing requests, in particular to
facilitate effective and efficient handovers;
(d)
the CSIRTs shall ensure the confidentiality and
trustworthiness of their operations;
(e)
the CSIRTs shall be adequately staffed to ensure
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
availability of their services at all times, and they shall ensure
that their staff is trained appropriately; and
(f)
the CSIRTs shall be equipped with redundant
systems and backup working space to ensure continuity of their
services.
(2)
The CSIRTs may participate in international cooperation
networks.
10. (1)
The national CSIRT shall have the following tasks
(a)
monitoring and analysing cyber threats,
vulnerabilities and incidents at national level and, upon request,
providing assistance to essential and important entities
concerned regarding real-time or near real-time monitoring of
their network and information systems;
(b)
providing early warnings, alerts, announcements
and dissemination of information to essential and important
entities concerned as well as to the competent authorities and
other relevant stakeholders on cyber threats, vulnerabilities and
incidents, if possible in near real-time;
(c)
responding to incidents and providing assistance to
the essential and important entities concerned, where applicable;
(d)
collecting and analysing forensic data and
providing dynamic risk and incident analysis and situational
awareness regarding cybersecurity;
(e)
providing upon the request of an essential or
important entity, a proactive scanning of the network and
information systems of the entity concerned to detect
vulnerabilities with a potential significant impact;
(f)
participating as the leading national representative,
in the CSIRTs network and providing mutual assistance in
accordance with their capacities and competencies to other
members of the CSIRTs network upon their request, provided
that the CIP Department may participate in the CSIRTs network;
(g)
contributing to
the
deployment
of
secure
information-sharing tools.
(2)
The national CSIRT may carry out proactive non-
intrusive scanning of publicly accessible network and information
systems of essential and important entities. Such scanning shall be
carried out to detect vulnerable or insecurely configured network and
information systems and inform the entities concerned and shall not
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
have any negative impact on the functioning of the entities’ services
Provided that the essential and important entities shall be
notified in writing of the proactive and non-intrusive scanning of their
publicly accessible network and information systems, and following
such scanning, shall be notified in writing of any vulnerable or
insecurely configured network and information systems
Provided further that the national CSIRT shall be deemed
as duly authorised in the carrying out of this measure in accordance
with article 337C(2) of the Criminal Code
Provided further that the national CSIRT shall notify the
CIP Department, and where designated, the other competent
authorities, about all the assistance, information, scanning, incidence
response or other services that are to be provided to the essential and
important entities in line with any of the provisions of this article.
(3)
When carrying out the tasks referred to in sub-article (1),
the national CSIRT may prioritise particular tasks on the basis of a
risk-based approach.
(4)
The national CSIRT shall establish cooperation
relationships with relevant stakeholders in the private sector, with a
view to achieving the objectives of this order.
(5)
In order to facilitate cooperation referred to in sub-article
(4), the national CSIRT shall promote the adoption and use of common
or standardised practices, classification schemes and taxonomies in
relation to incident-handling procedures.
(6)
Internal and autonomous CSIRTs shall have at least the
following tasks
(a)
monitoring and analysing cyber threats,
vulnerabilities and incidents of the essential and important
entities and providing real-time or near real-time monitoring of
their network and information systems;
(b)
providing early warnings, alerts, announcements
and dissemination of information on cyber threats,
vulnerabilities and incidents, if possible in near real-time to the
essential and important entities;
(c)
responding to incidents and providing assistance
to the essential and important entities;
(d)
collecting and analysing forensic data and
providing dynamic risk and incident analysis and situational
awareness regarding cybersecurity of the essential and
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
important entities;
(e)
providing a proactive scanning of the network and
information systems of the essential and important entities to
detect vulnerabilities with a potential significant impact
Provided that the tasks referred to in this sub-article shall
be carried out by internal and autonomous CSIRTs providing CSIRT
monitoring services to essential and important entities in accordance
with article 19(1)(d).
11. Adequate human, financial and technical resources shall
be provided to the CIP Department, to the national CSIRT and to the
designated competent authorities to carry out, in an effective and
efficient manner, the tasks assigned to them and thereby to fulfil the
objectives of this order, in particular
(a)
to have the technical capabilities necessary to carry
out the tasks referred to in article 10(1);
(b)
to be allocated sufficient resources including
adequate staffing levels and appropriate training for the purpose
of enabling it to develop its technical capabilities; and
(c)
to have at their disposal an appropriate, secure, and
resilient communication and information infrastructure through
which it shall exchange information with other essential and
important entities and other relevant stakeholders.
12. (1)
The CIP Department, the national CSIRT or where
designated the competent authorities shall cooperate with each other
with regard to the fulfilment of the obligations laid down in this order.
(2)
The national CSIRT shall receive notifications of
significant incidents in accordance with article 20 and incidents, cyber
threats and near misses in accordance with article 27.
(3)
The national CSIRT shall inform in writing the CIP
Department and relevant competent authorities of notifications of
incidents, cyber threats and near misses submitted in accordance with
article 20(1).
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(4)
The CIP Department, and where designated, the
competent authority, and national CSIRT shall cooperate with the
Executive Police, the Office of the Information and Data Protection
Commissioner in accordance with the Data Protection Act, the
Aviation Security Department in accordance with the Airports and
Civil Aviation (Security) Act, the Civil Aviation Directorate in
accordance with the Air Navigation Act, the Malta Communications
Authority in accordance with the Electronic Commerce Act, the
Electronic Communications (Regulation) Act and the Radio
Equipment Regulations, the Malta Financial Services Authority in
accordance with Regulation (EU) 2022/2554 of the European
Parliament and of the Council of 14 December 2022 on digital
operational resilience for the financial sector and amending
Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/
2014, (EU) No 909/2014 and (EU) No 2016/1011, the CIP Department
in accordance with Directive (EU) 2022/2557 as well as the competent
authorities under other sector-specific Union legal acts, within Malta.
(5)
The CIP Department and the national CSIRT shall
exchange relevant information on a regular basis, including with
regard to relevant incidents and cyber threats with competent
authorities under this order.
(6)
The CIP Department, or where designated the competent
authority under this order and the competent authority in accordance
with Directive (EU) 2022/2557 shall cooperate and exchange
information on a regular basis with regard to the identification of
critical entities, on risks, cyber threats, and incidents as well as on non-
cyber risks, threats and incidents affecting entities identified as critical
entities under the said order, and the measures taken in response to
such risks, threats and incidents.
(7)
The reporting shall be simplified through technical
means for notifications in articles 20 and 27.
(8)
Repealed by Legal Notice 89 of 2026.
13. (1)
The CIP Department shall be designated as
coordinator for the purposes of coordinated vulnerability disclosure
under this order
Provided that the CIP Department shall immediately
notify in writing to the national CSIRT any vulnerabilities reported to
it. The CIP Department shall immediately notify in writing any other
designated competent authority or authorities, as the case may be, of
any vulnerabilities reported to it that has a significant impact on the
provision of the services provided by an essential or important entity
which such authority regulates.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(2)
The CIP Department shall act as a trusted intermediary
and facilitating, where necessary, the interaction between the reporting
natural or legal person and the entity making use of the potentially
vulnerable ICT products, ICT processes or ICT services, upon the
request of either party.
(3)
The tasks of the CIP Department designated as
coordinator for vulnerability disclosure shall include
(a)
the adoption of common or standardised practices,
classification schemes and taxonomies;
(b)
identifying and contacting the entities concerned;
(c)
providing assistance to the natural or legal persons
reporting a vulnerability;
(d)
negotiating disclosure timelines and managing
vulnerabilities that affect multiple entities; and
(e)
establishing and maintaining
a
register
of
coordinated vulnerability disclosure policies.
(4)
Any person shall be able to report, anonymously, a
vulnerability to the CIP Department. The CIP Department shall ensure
the anonymity and confidentiality of the persons throughout the
vulnerability disclosure.
(5)
The CIP Department shall ensure that diligent follow-up
action is carried out with regard to the reported vulnerability.
(6)
Where a reported vulnerability may have a significant
impact on entities in more than one Member State, the national CSIRT
shall, where appropriate, cooperate with other CSIRTs designated as
coordinators within the CSIRTs network.
(7)
For the purposes of coordinated vulnerability disclosure,
the reporting natural or legal person shall be deemed to have acted with
authorisation in accordance with article 337C of the Criminal Code,
insofar as the reporting natural or legal person complies with the
coordinated vulnerability disclosure policy of such entity.
(8)
The CIP Department shall carry out the technical
operations strictly necessary for the characterisation of the risk or
threat referred to in this article
Provided that the CIP Department shall be deemed as
duly authorised in the carrying out of this measure in accordance with
article 337C(2) of the Criminal Code.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
14. (1)
An essential or important entity shall appoint a
qualified auditor who shall verify if the entity has implemented the
cybersecurity risk-management measures in accordance with article
19
Provided that the qualified auditor shall satisfy the
requirements listed in sub-article (4) before being appointed
Provided further that if the qualified auditor satisfies the
requirements listed in sub-article (4), the appointment shall be
approved by the CIP Department, or where designated the competent
authority.
(2)
If the qualified auditor is unable to verify whether the
essential or important entity has implemented the cybersecurity risk-
management measures in accordance with article 19 he shall notify
this in writing to the essential or important entity and the CIP
Department, or where designated the competent authority.
(3)
The CIP Department, or where designated the competent
authority, shall ensure that the essential or important entity takes,
without undue delay, all necessary, appropriate and proportionate
corrective measures.
(4)
The CIP Department, or where designated the competent
authority, shall approve an appointment in accordance with sub-article
(1), if the qualified auditor submits a reasoned request with
accompanying documentation to the CIP Department, or where
designated, the competent authority, demonstrating that he is
(a)
independent from the essential or important entity
being audited, including submitting a Declaration of
Independence as determined by the CIP Department;
(b)
in possession of documentation attesting to a
background check on the said auditor, issued by the competent
authority in accordance with Directive (EU) 2022/2557;
(c)
in possession of a valid European and, or
international cybersecurity certification or cybersecurity
standard as determined by the CIP Department; and
(d)
experienced and has skillsets as determined by the
CIP Department.
(5)
The CIP Department shall maintain a list of qualified
auditors and make this list available to essential and important entities.
(6)
The CIP Department shall establish the procedure for the
approval of the qualified auditor in accordance with sub-article (1).
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
PART III – NATIONAL CYBERSECURITY STRATEGY
15. (1)
The National Cyber Security Steering Committee
shall oversee the national cybersecurity strategy which established the
strategic objectives, the resources required to achieve those objectives,
and policy and regulatory measures with a view to achieving and
maintaining a high level of cybersecurity in Malta.
(1a)
The National Cyber Security Steering Committee shall
(a)
act as the national point of reference on
cybersecurity within the public sector, private sector and the
public together with the respective sectorial and implementing
entities;
(b)
provide a coordinated response to cybersecurity
incidents upon request of the Chairperson; and
(c)
provide guidance on cybersecurity policy and
technical matters upon request of Ministries and entities.
(2)
The national cybersecurity strategy shall include
(a)
objectives and priorities of the strategy on the
security of network and information systems covering in
particular the sectors, sub-sectors and types of entities listed in
the First and Second Schedule;
(b)
a governance framework to achieve the objectives
and priorities referred to in sub-article (2)(a), including the
policies referred to in sub-article (3);
(c)
a governance framework defining the roles and
responsibilities of relevant stakeholders at the national level,
underpinning the cooperation and coordination at the national
level between the competent authorities, the single point of
contact, and the CSIRTs in accordance with this order, as well as
coordination and cooperation between those bodies and
competent authorities in accordance with sector-specific Union
legal acts;
(d)
a mechanism to identify relevant assets and an
assessment of the risks in Malta;
(e)
identification
of
the
measures
ensuring
preparedness for, responsiveness to, and recovery from
incidents, including cooperation between the public and private
sectors;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(f)
a list of the various authorities and stakeholders
involved in the implementation of the national cybersecurity
strategy;
(g)
a policy framework for enhanced coordination
between the competent authorities under this order and the
competent authorities in accordance with in accordance with
Directive (EU) 2022/2557 for the purpose of information
sharing on risks, cyber threats, and incidents, as well as on non-
cyber risks, threats and incidents and the exercise of
supervisory tasks, as appropriate; and
(h)
a plan, including necessary measures, to enhance
the general level of cybersecurity awareness among citizens.
(3)
The national cybersecurity strategy shall include the
following policies
(a)
addressing cybersecurity in the supply chain for
ICT products and ICT services used by entities for the
provision of their services;
(b)
on the inclusion and specification of
cybersecurity-related requirements for ICT products and ICT
services in public procurement, including in relation to
cybersecurity certification, encryption and the use of open-
source cybersecurity products;
(c)
managing vulnerabilities, encompassing the
promotion and facilitation of coordinated vulnerability
disclosure in accordance with article 13(1);
(d)
related to sustaining the general availability,
integrity and confidentiality of the public core of the open
internet, including, where relevant, the cybersecurity of
undersea communications cables;
(e)
promoting the development and integration of
relevant advanced technologies aiming to implement state-of-
the-art cybersecurity risk-management measures;
(f)
promoting and developing education and training
on cybersecurity, cybersecurity skills, awareness raising and
research and development initiatives, as well as guidance on
good cyber hygiene practices and controls, aimed at citizens,
stakeholders and entities;
(g)
supporting academic and research institutions to
develop, enhance and promote the deployment of cybersecurity
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
tools and secure network infrastructure;
(h)
including relevant procedures and appropriate
information-sharing tools to support voluntary cybersecurity
information sharing between entities in conformity with Union
law;
(i)
strengthening the cyber resilience and the cyber
hygiene baseline of small and medium-sized enterprises, in
particular those excluded from the scope of this order, by
providing easily accessible guidance and assistance for their
specific needs; and
(j)
promoting active cyber protection.
(4)
The national cybersecurity strategy shall be assessed on a
regular basis and at least every five (5) years on the basis of key
performance indicators and, where necessary, be updated.
15A. (1)
The National Cyber Security Steering Committee
shall be composed of the following members
(a)
the Principal Permanent Secretary or his delegate;
(b)
a representative of the Ministry responsible for
foreign affairs;
(c)
a representative of the Ministry responsible for
home affairs;
(d)
a representative
of
the
Malta
Information
Technology Agency;
(e)
a representative of the Malta Financial Services
Authority;
(f)
a representative of the Malta Gaming Authority;
(g)
a representative of the Malta Communications
Authority;
(h)
a representative of the Malta Digital Innovation
Authority;
(i)
a
representative
of
the
National
Security
Authority;
(j)
a representative of the Malta Police Force;
(k)
a representative of the Armed Forces; and
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(l)
a representative of the CIP Department.
(2)
The National Cyber Security Steering Committee may,
whenever it deems so necessary or expedient, engage one (1) or more
persons, whom it considers to be in possession of suitable expertise
and security clearance, to assist it in carrying out specific tasks
requiring such expertise.
(3)
The National Cyber Security Steering Committee may
also establish sub-committees focusing on specific and thematic areas
to assist the National Cyber Security Steering Committee. The sub-
committees established under the authority of the National Cyber
Security Steering Committee shall operate internally and exclusively
within the functional remit of the National Cyber Security Steering
Committee and shall not possess autonomous decision-making powers
unless expressly delegated by the said Committee.
(4)
The Chairperson of the National Cyber Security Steering
Committee shall be the Principal Permanent Secretary or his delegate.
(5)
A Deputy Chairperson shall be appointed by the
Principal Permanent Secretary from among the members of the
National Cyber Security Steering Committee.
(6)
The meetings of the National Cyber Security Steering
Committee shall be chaired by the Chairperson or, in the absence of
the Chairperson, by the Deputy Chairperson.
(7)
The National Cyber Security Steering Committee shall
meet at such regular intervals, and shall as a minimum meet once
every two (2) months.
(8)
The members of the National Cyber Security Steering
Committee and experts appointed in accordance with sub-article (1)
shall treat any information acquired in the performance of their duties
or the exercise of the functions as part of the National Cyber Security
Steering Committee as confidential.
16. (1)
There shall be established a national cyber crisis
management framework which shall establish the management and
coordination of large-scale cybersecurity incidents and crises in Malta,
including the
(a)
identifying of capabilities, assets and procedures
that may be deployed in the case of a large-scale cybersecurity
incident or crisis for the purposes of this order; and
(b)
drawing up of a national large-scale cybersecurity
incident and crisis response plan where the objectives of, and
arrangements for, the management of large-scale cybersecurity
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
incidents and crises are established.
(2)
The plan shall establish, in particular
(a)
the objectives of national preparedness measures
and activities;
(b)
the cyber crisis management authorities including
tasks and responsibilities;
(c)
the cyber crisis management procedures, including
their integration into the general national crisis management
framework and information exchange means;
(d)
national preparedness
measures,
including
exercises and training activities;
(e)
the relevant public and private stakeholders and
infrastructure involved;
(f)
national procedures and arrangements between
relevant national authorities and bodies to ensure Malta’s
effective participation in, and support of, the coordinated
management of large-scale cybersecurity incidents and crises at
Union level; and
(g)
the
common
or
standardised
practices,
classification schemes and taxonomies to be used in relation to
cyber crisis management.
(3)
The crisis management authorities shall have adequate
resources to carry out, in an effective and efficient manner, the tasks
referred to in sub-article (2).
(4)
The framework shall be coherent with the existing
frameworks for general national crisis management.
(5)
The CIP Department shall be the leading national
representative for the purposes of cyber crisis management to the
European cyber crisis liaison organisation network (EU CyCLONe)
established in accordance with Article 16 of the Directive (EU) 2022/
2555. The national CSIRT may also participate in the European cyber
crisis liaison organisation network.
17. Prior to a commencement of a peer review on Malta, a
self-assessment of the reviewed aspects may be carried out by CIP
Department in cooperation with the national CSIRT, designated
competent entities and other entities and stakeholders where necessary
and as appropriate. The CIP Department shall provide such self-
assessment to the designated cybersecurity experts in accordance with
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
Article 19 of the Directive.
PART IV – CYBERSECURITY RISK-MANAGEMENT
MEASURES AND REPORTING OBLIGATIONS
18. (1)
The CIP Department, or where designated the
competent authority, shall ensure that management bodies of such
essential and important entities approve the cybersecurity risk-
management measures in accordance with article 19 and oversee their
implementation. The natural persons composing the management
bodies may be held liable for infringements by the aforesaid entities of
the said article in accordance with articles 31(10)(b) and 33.
(2)
The application of sub-article (1) and this sub-article
shall be without prejudice to national law as regards the liability rules
applicable to public institutions, as well as the liability of public
servants and elected or appointed officials.
(3)
Members of the management bodies of essential and
important entities are required to follow training in order to carry out
their tasks.
(4)
Essential and important entities shall offer similar
training to their employees on a regular basis, in order that they gain
sufficient knowledge and skills to enable them to identify risks and
assess cybersecurity risk-management practices and their impact on
the services provided by the entity.
19. (1)
The CIP Department, or where designated the
competent authority, shall ensure that essential and important entities
(a)
take appropriate and proportionate technical,
operational and organisational measures to manage the risks
posed to the security of network and information systems which
those entities use for their operations or for the provision of
their services, and to prevent or minimise the impact of
incidents on recipients of their services and on other services;
(b)
ensure a level of security of network and
information systems appropriate to the risks posed, taking into
account the state-of-the-art and, where applicable, relevant
European and international standards, as well as the cost of
implementation, the measures referred to in paragraph (a)
Provided that when assessing the proportionality of the
measures, they shall take due consideration of the degree of the
entity’s exposure to risks, the entity’s size and the likelihood of
occurrence of incidents and their severity, including their societal and
economic impact;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(c)
appoint a security liaison officer who shall have
the necessary expertise and who shall
(i)
facilitate the development, implementation,
maintenance and review of business continuity plans and
where necessary termination plans that include the
preparedness, processes and solutions of the essential or
important entity;
(ii)
ensure that the essential or important entity
conducts and maintains appropriate risk assessments;
(iii) ensure that the essential or important entity
maintains and exercises an operator security plan; and
(iv) act as the point of contact between the
essential or important entity and the CIP Department, or
where designated the competent authority, to ensure the
fulfilment of the obligations established in this order;
(d)
receive CSIRT monitoring services from any of the
following CSIRTs, which CSIRTs shall comply with the
requirements established in article 9(1) and carry out the tasks
set out in article 10(2)
(i)
an internal CSIRT; or
(ii)
an autonomous CSIRT.
(2)
The measures in sub-article (1) shall be based on an all-
hazards approach that aims to protect network and information systems
and the physical environment of those systems from incidents, and
shall include at least the following
(a)
policies on risk analysis and information system
security;
(b)
incident handling;
(c)
business continuity, such as backup management
and disaster recovery, and crisis management;
(d)
supply chain security, including security-related
aspects concerning the relationships between each entity and its
direct suppliers or service providers;
(e)
security in network and information systems
acquisition, development and maintenance, including
vulnerability handling and disclosure;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(f)
policies and procedures to assess the effectiveness
of cybersecurity risk-management measures;
(g)
basic cyber hygiene practices and cybersecurity
training;
(h)
policies and procedures regarding the use of
cryptography and, where appropriate, encryption;
(i)
human
resources
security,
insider
risk
management policy, access control policies and
asset
management;
(j)
the use of multi-factor authentication or
continuous authentication solutions, secured voice, video and
text communications and secured emergency communication
systems within the entity, where appropriate; and
(k)
logging
and
traceability
of
network
and
information systems.
(3)
The CIP Department, or where designated the competent
authority, shall ensure that, when considering which measures referred
to in sub-article (2)(d) are appropriate, entities shall take into account
the vulnerabilities specific to each direct supplier and service provider
and the overall quality of products and cybersecurity practices of their
suppliers and service providers, including their secure development
procedures. The CIP Department, or where designated the competent
authority, shall also ensure that, when considering which measures in
the said sub-article are appropriate, entities are required to take into
account the results of the coordinated security risk assessments of
critical supply chains carried out in accordance with Article 22(1) of
the Directive.
(4)
The CIP Department, or where designated the competent
authority, shall ensure that, where an essential or important entity finds
that it does not comply with the measures provided for in sub-article
(2), the entity concerned shall take, without undue delay, all necessary,
appropriate and proportionate corrective measures referred to in article
29 for essential entities or article 30 for important entities.
20. (1)
Essential and important entities shall immediately
notify the national CSIRT, of any incident that has a significant
impact on the provision of their services in accordance with sub-
article (6)
Provided that the mere act of notification shall not subject
the notifying entity to an increased liability
Provided
further
that
the
national
CSIRT
shall
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
immediately notify in writing the CIP Department and any other
designated competent authority as the case may be, of any incident that
has a significant impact on the provision of the services provided by an
essential or important entity which such authority regulates.
(2)
Where appropriate, essential and important entities shall
notify, without undue delay, the recipients of their services of
significant incidents that are likely to adversely affect the provision of
those services. Those entities shall report any information enabling the
national CSIRT to determine any cross-border impact of the incident.
(3)
In the case of a cross-border or cross-sectoral significant
incident, the CIP Department, shall be provided in due time with
relevant information notified in accordance with sub-article (5).
(4)
Where applicable, essential and important entities shall
communicate, without undue delay, to the recipients of their services
that are potentially affected by a significant cyber threat any measures
or remedies that those recipients are able to take in response to such
threat. Where appropriate, the entities shall also inform those recipients
of the significant cyber threat itself.
(5)
For the purpose of notification in accordance with sub-
article (1), the entities concerned shall submit to the national CSIRT
(a)
without undue delay and in any event within
twenty-four (24) hours of becoming aware of the significant
incident, an early warning, which where applicable, shall
indicate whether the significant incident is suspected of being
caused by unlawful or malicious acts or could have a cross-
border impact;
(b)
without undue delay and in any event within
seventy-two (72) hours of becoming aware of the significant
incident, an incident notification, which where applicable, shall
update the information referred to in paragraph (a) and indicate
an initial assessment of the significant incident, including its
severity and impact, as well as where available, the indicators of
compromise;
(c)
upon the request of the national CSIRT, an
intermediate report on relevant status updates;
(d)
a final report not later than one (1) month after the
submission of the incident notification in accordance with sub-
article (5)(b), including the following
(i)
a detailed description of the incident,
including its severity and impact;
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(ii)
the type of threat or root cause that is likely
to have triggered the incident;
(iii)
applied and ongoing mitigation measures;
(iv) where applicable, the cross-border impact
of the incident;
(e)
in the event of an ongoing incident at the time of
the submission of the final report referred to in
paragraph (d), the entities concerned shall provide
the national CSIRT with a progress report at that
time and a final report within one (1) month of their
handling of the incident.
(6)
By way of derogation from sub-article (5)(b), a trust
service provider shall, with regard to significant incidents that have an
impact on the provision of its trust services, notify the national CSIRT
without undue delay and in any event within twenty-four (24) hours of
becoming aware of the significant incident.
(7)
The national CSIRT shall provide, without undue delay
and where possible within twenty-four (24) hours of receiving the
early warning referred to in sub-article (5)(a), a response to the
notifying entity, including initial feedback on the significant incident
and, upon request of the entity, guidance or operational advice on the
implementation of possible mitigation measures
Provided that where the national CSIRT is not the initial
recipient of the notification referred to in sub-article (1), the guidance
shall be provided by the designated competent authority in cooperation
with the national CSIRT. The national CSIRT shall provide additional
technical support if the entity concerned so requests, provided the
technical capability is available.
(8)
Where the significant incident is reasonably suspected to
be a criminal offence, the national CSIRT, the CIP Department or
where designated the competent authority, shall also provide guidance
on reporting the significant incident to the Executive Police.
(9)
Where appropriate, and in particular where the
significant incident concerns Malta and at least another Member State,
the national CSIRT, with prior coordination with the CIP Department
and where designated the competent authority, shall inform, without
undue delay, the other affected Member State and ENISA of the
significant incident and such information shall include the type of
information received in accordance with sub-article (5)
Provided that in so doing, the national CSIRT shall, in
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
accordance with national law and, or Union law, preserve the entity’s
security and commercial interests as well as the confidentiality of the
information provided.
(10) Where public awareness is necessary to prevent a
significant incident or to deal with an ongoing significant incident, or
where disclosure of the significant incident is otherwise in the public
interest, the national CSIRT, and where appropriate, the CSIRTs or the
competent authorities of other Member States concerned may, after
consulting the entity concerned, inform the public about the significant
incident or require the entity to do so.
(11) At the request the national of CSIRT, or where designated
the competent authority, the CIP Department shall forward
notifications received in accordance with sub-article (1) to the single
points of contact of other affected Member States.
(12) The national CSIRT shall provide to the CIP Department
information about significant incidents, incidents, cyber threats and
near misses notified in accordance with sub-article (1) and article 27.
(13) The CIP Department shall submit to ENISA and to the
National Cybersecurity Steering Committee, a summary report,
including anonymised and aggregated data on significant incidents,
incidents, cyber threats and near misses notified in accordance with
sub-article (1) and with article 27.
(14) Every three (3) months, the single point of contact shall
submit to ENISA a summary report containing anonymised and
aggregated data on significant incidents, incidents, cyber threats and
near misses notified in accordance with sub-article (1) and article 27.
21. (1)
In the implementation of article 19 the CIP
Department shall without imposing or discriminating in favour of any
particular type of technology, encourage the use of ICT products, ICT
services and ICT processes, developed by the essential or important
entity or procured from third parties, that are certified under European
cybersecurity certification schemes adopted in accordance with
Article 49 of Regulation (EU) 2019/881 of the European Parliament
and of the Council of 17 April 2019 on ENISA (the European Union
Agency for Cybersecurity) and on information and communications
technology cybersecurity certification and repealing Regulation (EU)
No 526/2013 (Cybersecurity Act)
Provided that the CIP Department, or where designated
the competent authority, shall require where applicable, essential and
important entities to use such ICT products, ICT services and ICT
processes
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
Provided further that specific categories of essential and
important entities listed in Commission delegated acts, shall use
certain certified ICT products, ICT services and ICT processes or
obtain a certificate under a European cybersecurity certification
scheme adopted in accordance with Article 49 of Regulation (EU)
2019/881.
(2)
Essential and important entities may use qualified trust
services.
22. In order to promote the convergent implementation of
article 19(1) and (2), the CIP Department shall, without imposing or
discriminating in favour of the use of a particular type of technology,
encourage the use of European and international standards and
technical specifications relevant to the security of network and
information systems.
PART V – JURISDICTION AND REGISTRATION
23. (1)
Entities falling within the scope of this order shall
be considered to fall under the jurisdiction of Malta if they are
established in Malta, except in the case of
(a)
providers of public electronic communications
networks or providers of publicly available electronic
communications services, which shall be considered to fall
under the jurisdiction of the Member State in which they
provide their services;
(b)
DNS service providers, TLD name registries,
entities providing domain name registration services, cloud
computing service providers, data centre service providers,
content delivery network providers, managed service providers,
managed security service providers, as well as providers of
online marketplaces, of online search engines or of social
networking services platforms, which shall be considered to fall
under the jurisdiction of the Member State in which they have
their main establishment in the Union in accordance with sub-
article (2);
(c)
public administration entities, which shall be
considered to fall under the jurisdiction of the Member State
which established them.
(2)
For the purposes of this order, an entity as provided for in
in sub-article (1)(b), shall be considered to have its main establishment
in the Union, in the Member State where the decisions related to the
cybersecurity risk-management measures are predominantly taken
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
Provided that, if such a Member State cannot be
determined or if such decisions are not taken in the Union, the main
establishment shall be considered to be in the Member State where
cybersecurity operations are carried out.
Provided further that, if such a Member State cannot be
determined, the main establishment shall be considered to be in the
Member State where the entity concerned has the establishment with
the highest number of employees in the Union.
(3)
If an entity in sub-article (1)(b), is not established in the
Union, but offers services within the Union, it shall designate a
representative in the Union and such representative shall be established
in one (1) of those Member States where the services are offered. Such
an entity shall be considered to fall under the jurisdiction of the
Member State where the representative is established.
(4)
In the absence of a representative in the Union designated
in accordance with sub-article (3), the CIP Department or, where
designated, the competent authority, may take legal action against the
entity for the infringement of this order where the entity provides
services in Malta.
(5)
The designation of a representative by an entity as
provided for in sub-article (1)(b), shall be without prejudice to legal
action which could be initiated against the entity itself.
(6)
Upon a request for mutual assistance in relation to an
entity in sub-article (1)(b), the CIP Department or, where designated,
the competent authority may, within the limits of such request, take
appropriate supervisory and enforcement measures in relation to the
entity concerned that provides services or which has a network and
information system in Malta.
24. (1)
DNS service providers, TLD name registries,
entities providing domain name registration services, cloud computing
service providers, data centre service providers, content delivery
network providers, managed service providers, managed security
service providers, as well as providers of online marketplaces, of online
search engines and of social networking services platforms shall submit
to the CIP Department, by the prescribed date, the following
information
(a)
the name of the entity;
(b)
the relevant sector, sub-sector and type of entity in
the First or Second Schedule, where applicable;
(c)
the address of the entity’s main establishment and
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
its other legal establishments in the Union or, if not established
in the Union, of its representative designated pursuant to article
23(3);
(d)
up-to-date contact details, including email
addresses and telephone numbers of the entity and, where
applicable, its representative designated pursuant to article
23(3);
(e)
the Member States where the entity provides
services;
(f)
the entity’s IP ranges; and
(g)
a detailed list of computer, network and
operational technology resources used.
(2)
The entities in sub-article (1) shall notify the CIP
Department about any changes to the information they submitted
without delay and in any event within three (3) months of the date of
the change
Provided that the entity shall provide information in
accordance with sub-article (1)(g) to the CIP Department upon
request.
(3)
Upon receipt of the information provided for in sub-
articles (1) and (2), except for that provided for in sub-articles (1)(f)
and (g), the CIP Department shall, without undue delay, forward such
information to ENISA.
(4)
Where applicable, the information provided for in sub-
articles (1) and (2) shall be submitted through the national self-
registration mechanism provided for in sub-article 7(3).
(5)
By 17 April 2025 and every two (2) years thereafter, the
CIP Department shall notify
(a)
the European Commission and the Cooperation
Group of the number of essential and important entities listed
pursuant to article 7(2)(i) for each sector and sub-sector in the
First or Second Schedule; and
(b)
the European Commission of relevant information
about the number of essential and important entities identified
pursuant to sub-articles (1)(b) to (e), the sector and sub-sector
provided for in the First or Second Schedule to which they
belong, the type of service that they provide, and the provision,
from among those established in sub-articles (1)(b) to (e),
pursuant to which they were identified.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(6)
Until 17 April 2025 and upon request of the European
Commission, Malta may notify the European Commission of the names
of the essential and important entities provided for in sub-article (5)(b).
(1)
For the purpose of contributing to the security,
stability and resilience of the DNS, the CIP Department shall require
TLD name registries and entities providing domain name registration
services to collect and maintain accurate and complete domain name
registration data in a dedicated database with due diligence in
accordance with European Union law in relation to information which
constitutes personal data.
(2)
For the purposes of sub-article (1), the database of
domain name registration data shall contain the necessary information
to identify and contact the holders of the domain names and the points
of contact administering the domain names under the TLDs. Such
information shall include
(a)
the domain name;
(b)
the date of registration;
(c)
the registrant’s name, contact email address and
telephone number;
(d)
the contact email address and telephone number of
the point of contact administering the domain name in the event
that they are different from those of the registrant.
(3)
The TLD name registries and the entities providing
domain name registration services shall have in place policies and
procedures, including verification procedures, to ensure that the
databases in sub-article (1) include accurate and complete information.
Such policies and procedures shall be made publicly available.
(4)
The TLD name registries and the entities providing
domain name registration services shall make publicly available,
without undue delay after the registration of a domain name, the
domain name registration data which are not personal data.
(5)
The TLD name registries and the entities providing
domain name registration services shall provide access to specific
domain name registration data upon lawful and duly substantiated
requests by legitimate access seekers, in accordance with national data
protection legislation and Union data protection law. The TLD name
registries and the entities providing domain name registration services
shall reply without undue delay and in any event within seventy-two
(72) hours of receipt of any requests for access. Policies and procedures
with regard to the disclosure of such data shall be made publicly
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
available
Provided that domain name registration data shall be free
of charge to legitimate access seekers upon lawful and duly
substantiated requests.
(6)
Compliance with the obligations established in sub-
articles (1) to (5) shall not result in a duplication of collecting domain
name registration data. To that end, TLD name registries and entities
providing domain name registration services shall cooperate with each
other.
PART VI – INFORMATION SHARING
(1)
The national CSIRT shall ensure that the entities
falling within the scope of this order and, where relevant, other
CSIRTs of entities not falling within the scope of this order are able to
exchange on a voluntary basis relevant cybersecurity information
among themselves, including information relating to cyber threats,
near misses, vulnerabilities, techniques and procedures, indicators of
compromise, adversarial tactics, threat-actor-specific information,
cybersecurity alerts and recommendations regarding the configuration
of cybersecurity tools to detect cyberattacks, where such information
sharing
(a)
aims to prevent, detect, respond to or recover from
incidents or to mitigate their impact;
(b)
enhances the level of cybersecurity, in particular
through raising awareness in relation to cyber threats, limiting
or impeding the ability of such threats to spread, supporting a
range of defensive capabilities, vulnerability remediation and
disclosure, threat detection, containment and prevention
techniques, mitigation strategies, or response and recovery
stages or promoting collaborative cyber threat research between
public and private entities
Provided that the cybersecurity information sharing
arrangement shall be without prejudice, to the operator security plan of
the entities falling within the scope of this order, pursuant to article
19(1)(c)(iii).
(2)
The national CSIRT shall ensure that the exchange of
information takes place within communities of essential and important
entities, and where relevant, their suppliers or service providers. Such
exchange shall be implemented by means of cybersecurity
information-sharing arrangements in respect of the potentially
sensitive nature of the information shared.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(3)
The national CSIRT, shall facilitate the establishment of
cybersecurity information-sharing arrangements in sub-article (2).
Such arrangements may specify operational elements, including the use
of dedicated ICT platforms and automation tools, content and
conditions of the information-sharing arrangements
Provided that in establishing the details of the
involvement of public authorities in such arrangements, the national
CSIRT may impose conditions on the information made available by
any competent authority or CSIRTs. The national CSIRT shall offer
assistance for the application of such arrangements in accordance with
its policies provided for in article 15(3)(h).
(4)
Essential and important entities shall notify the CIP
Department of their participation in the cybersecurity information-
sharing arrangements provided for in sub-article (2), upon entering into
such arrangements, or as applicable, of their withdrawal from such
arrangements, once the withdrawal takes effect.
(1)
In addition to the notification obligation provided
for in article 20, notifications may be submitted to the national CSIRT
on a voluntary basis by
(a)
essential and important entities with regard to
incidents, cyber threats and near misses;
(b)
entities other than those in sub-article (1)(a),
regardless of whether they fall within the scope of this order,
with regard to significant incidents, cyber threats and near
misses.
(2)
The national CSIRT shall process the notifications in sub-
article (1) in accordance with the procedure established in article 20
and may prioritise the processing of mandatory notifications over
voluntary notifications.
(3)
Where applicable, the national CSIRT shall provide the
CIP Department and where designated the competent authority, with
the information about notifications received pursuant to this article,
while ensuring the confidentiality and appropriate protection of the
information provided by the notifying entity.
(4)
Without prejudice to the prevention, investigation,
detection and prosecution of criminal offences, voluntary reporting
shall not result in the imposition of any additional obligations upon the
notifying entity to which it would not have been subject had it not
submitted the notification.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
PART VII – SUPERVISION AND ENFORCEMENT
(1)
The CIP Department, or where designated the
competent authority, shall effectively supervise and take the measures
necessary to ensure compliance with this order.
(2)
The CIP Department, or where designated the competent
authority, may prioritise on a risk-based approach the supervisory
tasks provided for in articles 29 and 30
Provided that when exercising such prioritisation, the
CIP Department, or where designated the competent authority, shall
establish supervisory methodologies allowing for a prioritisation of
such tasks following a risk-based approach.
(3)
The CIP Department, or where designated the competent
authority, shall work in close cooperation with the Information and
Data Protection Commissioner when addressing incidents resulting in
personal data breaches, and this is without prejudice to the competence
and tasks of the Information and Data Protection Commissioner under
Regulation (EU) 2016/679.
(4)
Without prejudice to national legislative and institutional
frameworks in the supervision of compliance of public administration
entities with this order and the imposition of enforcement measures
with regard to infringements of this order, the CIP Department, or
where designated the competent authority, shall carry out such tasks
with operational independence from the public administration entities
being supervised
Provided that the enforcement measures under article
31(10)(a) and (b) shall not be applicable to public administration
entities subject to this order.
(1)
The CIP Department, or where designated the
competent authority, shall ensure that the supervisory or enforcement
measures imposed on essential entities in respect of the obligations
established in this order are effective, proportionate and dissuasive,
taking into account the circumstances of each individual case
Provided that the implementation of such supervisory
and, or enforcement measures shall be without prejudice to article
3(16).
(2)
When exercising the supervisory tasks in relation to
essential entities, the CIP Department, or where designated the
competent authority, shall have the power to subject those entities at
least to the following supervisory measures
(a)
on-site inspections and off-site supervision,
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
including random checks conducted by trained professionals;
(b)
regular and targeted security audits carried out by
an independent body, or the CIP Department, or where
designated the competent authority;
(c)
ad hoc audits, including where justified on the
ground of a significant incident or an infringement of this order
by the essential entity concerned;
(d)
security scans based on objective, non-
discriminatory, fair and transparent risk assessment criteria,
where necessary with the cooperation of the essential entity
concerned;
(e)
requests for information necessary to assess the
cybersecurity risk-management measures adopted by the
essential entity concerned, including documented cybersecurity
policies, as well as compliance with the obligation to submit
information to the CIP Department, pursuant to article 24;
(f)
requests to access data, documents and information
necessary for the CIP Department, or where designated the
competent authority, to carry out their supervisory tasks;
(g)
requests for evidence of implementation of
cybersecurity policies, such as the results of security audits
carried out by a qualified auditor and the respective underlying
evidence;
(h)
requests for evidence of CSIRT monitoring
services in accordance with article 19(1)(d);
(i)
requests for evidence of compliance with policies
issued by the CIP Department, or where designated the
competent authority, by the CSIRT providing monitoring
services to the essential entity;
(j)
requests for evidence of operator security plans,
business continuity plans and where necessary termination
plans;
(k)
any other supervisory measures which the CIP
Department, or where designated the competent authority shall
consider necessary in accordance with its powers at law.
(3)
The targeted security audits in sub-article (2)(b), shall be
based on risk assessments conducted by the CIP Department, or where
designated the competent authority or the audited essential entity, or on
other risk-related available information.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(4)
The results of any targeted security audit in sub-articles
(2)(b) and (3), shall be made available to the CIP Department, or
where designated the competent authority. The costs of such targeted
security audit carried out by an independent body shall be paid by the
audited essential entity, except in duly substantiated cases when the
CIP Department, or where designated the competent authority shall
decide otherwise.
(5)
When exercising the supervisory powers under sub-
articles (2)(e) to (j), the CIP Department, or where designated, the
competent authority, shall state the purpose of the request and specify
the information requested.
(6)
When exercising enforcement powers in relation to an
essential entity, the CIP Department, or where designated the
competent authority, shall have the power to take any or all of the
following enforcement measure
(a)
issue warnings about infringements of this order
by the essential entity concerned including but not limited to
failure to cooperate or comply with any of the supervisory
measures under sub-article (2);
(b)
adopt binding instructions, including with regard
to measures necessary to prevent or remedy an incident, as well
as time-limits for the implementation of such measures and for
reporting on their implementation, or an order requiring the
essential entity concerned to remedy the deficiencies identified
or the infringements of this order;
(c)
order the essential entity concerned to cease
conduct that infringes this order and desist from repeating that
conduct;
(d)
order the essential entity concerned to ensure that
their cybersecurity risk-management measures comply with
article 19 and, or to fulfil the reporting obligations established
in article 20, in a specified manner and within a specified
period;
(e)
order the essential entity concerned to inform the
natural or juridical persons with regard to which they provide
services or carry out activities which are potentially affected by
a significant cyber threat, of the nature of the threat, as well as
of any possible protective or remedial measures which can be
taken by those natural or juridical persons in response to such
threat;
(f)
order the essential entity concerned to implement
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
the recommendations provided as a result of a security audit
within a reasonable deadline;
(g)
designate a monitoring officer with well-defined
tasks for a determined period of time to oversee the compliance
of the essential entity concerned with articles 19 and 20;
(h)
order the essential entity concerned to make public
aspects of infringements of this order in a specified manner;
(i)
order the essential entity concerned to receive
CSIRT monitoring services in accordance with article 19(1)(d);
(j)
order the essential entity concerned to register
under the national self-registration mechanism in article 7(3);
(k)
any other enforcement measure which the CIP
Department, or where designated the competent authority, shall
consider necessary in accordance with its powers at law.
(7)
In addition to the enforcement measures in sub-article
(6)(a) to (k), the CIP Department, or where designated the competent
authority, may request the imposition of an administrative penalty by
the Committee, in accordance with national law pursuant to article 33.
(8)
The CIP Department, or where designated the competent
authority, may impose the measures contained in this article on
essential entities periodically.
(9)
The CIP Department, or where designated the competent
authority, shall inform the competent authority established in
accordance with Directive (EU) 2022/2557 when exercising
supervisory and enforcement powers aiming to ensure compliance of
an essential entity identified as a critical entity in accordance with the
said Directive
Provided that, where required, such essential entity may
request the CIP Department, or where designated the competent
authority, to exercise supervisory and enforcement powers in relation to
an essential entity that is identified as a critical entity in accordance
with Directive (EU) 2022/2557.
(1)
When provided with evidence, indication or
information that an important entity allegedly does not comply with
this order, in particular articles 19 and, or 20, the CIP Department, or
where designated the competent authority, shall take action, where
necessary, through ex post supervisory measures. Such measures shall
be effective, proportionate and dissuasive, taking into account the
circumstances of each individual case
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
Provided that the implementation of such supervisory
tasks and, or enforcement measures shall be without prejudice to
article 3(16).
(2)
When exercising their supervisory tasks in relation to
important entities, the CIP Department, or where designated the
competent authority, shall have the power to subject such entities at
least to the following supervisory measures
(a)
on-site inspections and off-site ex post supervision
conducted by trained professionals;
(b)
targeted security audits carried out by an
independent body or the CIP Department, or where designated
the competent authority;
(c)
security scans based on objective, non-
discriminatory, fair and transparent risk assessment criteria,
where necessary with the cooperation of the essential entity
concerned;
(d)
requests for information necessary to assess, ex
post, the cybersecurity risk-management measures adopted by
the essential entity concerned, including documented
cybersecurity policies, as well as compliance with the
obligation to submit information to the CIP Department, or
where designated the competent authority, pursuant to article
24;
(e)
requests to access data, documents and
information necessary to carry out their supervisory tasks;
(f)
requests for evidence of implementation of
cybersecurity policies, such as the results of security audits
carried out by a qualified auditor and the respective underlying
evidence;
(g)
requests for evidence of CSIRT monitoring
services in accordance with article 19(1)(d);
(h)
requests for evidence of compliance with policies
issued by the CIP Department, or where designated the
competent authority, by the CSIRT providing monitoring
services to the important entity;
(i)
requests for evidence of operator security plans,
business continuity plans and where necessary termination
plans;
(j)
any other supervisory measures which the CIP
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
Department, or where designated the competent authority
considers necessary in accordance with its powers at law.
(3)
The targeted security audits provided for in sub-article
(2)(b), shall be based on risk assessments conducted by the CIP
Department or the audited entity, or on other risk-related available
information.
(4)
The results of any targeted security audit shall be made
available to the CIP Department, or where designated the competent
authority. The costs of such targeted security audit carried out by an
independent body shall be paid by the audited essential entity, except in
duly substantiated cases when the CIP Department, or where
designated the competent authority shall decide otherwise.
(5)
When exercising its powers in accordance with sub-
articles (2)(d) to (f), the CIP Department, or where designated the
competent authority, shall state the purpose of the request and specify
the information requested.
(6)
When exercising enforcement powers in relation to
important entities, the CIP Department, or where designated the
competent authority, shall have the power to take any or all of the
following measures
(a)
issue warnings about infringements of this order
by the important entity concerned including the failure to
cooperate or comply with the supervisory measures under sub-
article (2);
(b)
adopt binding instructions, including with regard
to measures necessary to prevent or remedy an incident, as well
as time-limits for the implementation of such measures and for
the reporting of the implementation, or an order requiring the
essential entity concerned to remedy the deficiencies identified
or the infringements of this order;
(c)
order the important entity concerned to cease
conduct that infringes this order and desist from repeating such
conduct;
(d)
order the important entity concerned to ensure that
its cybersecurity risk-management measures comply with article
19 and, or to fulfil the reporting obligations established in article
20, in a specified manner and within a specified period;
(e)
order the important entity concerned to inform the
natural or juridical persons with regard to which they provide
services or carry out activities which are potentially affected by
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
a significant cyber threat, of the nature of the threat, as well as
of any possible protective or remedial measures which can be
taken by those persons in response to such threat;
(f)
order the important entity concerned to implement
the recommendations provided as a result of a security audit
within a reasonable deadline;
(g)
order the important entity concerned to make
public aspects of infringements of this order in a specified
manner;
(h)
order the important entity concerned to receive
CSIRT monitoring services in accordance with article 19(1)(d);
(i)
order the important entity concerned to register
itself under the national self-registration mechanism in
accordance with article 7(3); and, or
(j)
any other enforcement measures which the CIP
Department, or where designated the competent authority
considers necessary in accordance with their powers at law.
(7)
In addition to the enforcement measures in sub-article
(6)(a) to (j), the CIP Department, or where designated the competent
authority, may request the imposition of an administrative penalty by
the Committee, in accordance with national law pursuant to article 33.
(1)
The CIP Department, or where designated the
competent authority, shall before proceeding to imposing the
enforcement measures in accordance with articles 29 and 30, notify in
writing the preliminary findings of an infringement to the essential or
important entity concerned, of the measure that may be taken and the
detailed reason why it may be taken by the CIP Department, or where
designated the competent authority, requiring the essential or
important entity concerned to make its submissions to the CIP
Department, or where designated the competent authority, in a period
not exceeding fifteen (15) working days and to propose any remedies
that rectify the acts or omissions required by the CIP Department, or
where designated the competent authority, to be so rectified
Provided that the request for the imposition of an
administrative penalty in accordance with articles 29(7) and 30(7)
shall not be considered an enforcement measure.
(2)
The period in sub-article (1), may be decreased if the CIP
Department, or where designated the competent authority, considers
that the continuance of an infringement under this order negatively
impacts the effective exercise by the CIP Department, or where
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
designated the competent authority, of its regulatory functions or
warrants the immediate intervention of the CIP Department, or where
designated the competent authority.
(3)
Without prejudice to sub-article (2), where the CIP
Department, or where designated the competent authority, has prima
facie evidence that an infringement represents an immediate and
significant incident in Malta, they may take any urgent interim
enforcement measure to remedy the situation in advance of issuing the
final enforcement measure, including ordering the immediate cessation
of the act or omission giving cause to the infringement
Provided that urgent interim enforcement measures shall
be valid for a maximum period of three (3) months.
(4)
Where the essential or important entity concerned
remedies the deficiency within the period established in sub-article (1)
and, or (3), and agrees in writing to abide with any enforcement
measure that the CIP Department, or where designated the competent
authority, may impose, the CIP Department, or where designated the
competent authority, may desist from proceeding any further, without
prejudice to any urgent interim enforcement measure imposed pursuant
to sub-article (3) and, or enforcement measure that may have already
been imposed.
(5)
If after the lapse of the period established in sub-article
(1) and, or (3), the CIP Department, or where designated the competent
authority, considers that the essential or important entity concerned has
not given any valid reason to demonstrate why no enforcement measure
or measures should be taken against the entity, the CIP Department, or
where designated the competent authority, shall notify in writing the
essential or important entity concerned, stating the enforcement
measure or measures intended to be taken.
(6)
Deleted by Legal Notice 89 of 2026.
(7)
Deleted by Legal Notice 89 of 2026.
(8)
Deleted by Legal Notice 89 of 2026.
(9)
Where enforcement measures imposed by the CIP
Department, or where designated the competent authority, pursuant to
sub-article (6) are ineffective, the essential entity concerned shall have
a period not being less than fifteen (15) working days in which to take
the necessary action to remedy the deficiencies and, or to comply with
the requirements imposed by the CIP Department, or where designated
the competent authority.
(10)
If the requested action is not taken within the stipulated
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
period in sub-article (9), the CIP Department, or where designated the
competent authority, shall have the power to
(a)
request the certification or authorisation body,
courts or tribunals in conformity with national law to suspend
temporarily a certification or authorisation concerning part or
all of the relevant services provided or activities carried out by
the essential entity, or all of them;
(b)
request the relevant bodies, courts or tribunals, to
prohibit temporarily any natural person who is responsible for
discharging managerial responsibilities of chief executive
officer or legal representation in the essential entity from
exercising managerial functions in such essential entity
Provided that temporary suspensions or prohibitions
imposed pursuant to this sub-article shall be applied only until the
essential entity concerned takes the necessary action to remedy the
deficiencies or comply with the requirements of the CIP Department,
or where designated the competent authority for which such
enforcement measures were applied
Provided further that the imposition of such temporary
suspensions or prohibitions shall be subject to appropriate procedural
safeguards in accordance with the general principles of Union law and
the Charter, including the right to an effective remedy and to a fair
trial, the presumption of innocence and the rights of the defence.
(1)
The administrative penalties shall be imposed in
addition to any of the enforcement measures in article 29(6)(a) to (k),
article 30(6)(a) to (k) and article 31(10).
(2)
Where the CIP Department, or where designated the
competent authority, requests the imposition of an administrative
penalty and at the same time, determines the amount of the
administrative penalty in each individual case, due regard shall be
given, to the elements provided for in article 31(8).
(3)
When they infringe articles 19 or 20, essential entities are
subject, in accordance with sub-articles (1) and (2), to administrative
penalties of a maximum of ten million euro (€10 000 000), or of a
maximum of two percent (2%) of the total worldwide annual turnover
in the preceding financial year of the undertaking to which the
essential entity belongs, whichever is higher.
(4)
When they infringe articles 19 or 20, important entities
are subject, in accordance with sub-articles (1) and (2), to
administrative penalties of a maximum of seven million euro (€7 000
000), or of a maximum of one point four percent (1.4%) of the total
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
worldwide annual turnover in the preceding financial year of the
undertaking to which the essential entity belongs, whichever is higher.
(5)
Without prejudice to the powers of the CIP Department,
or where designated the competent authority, administrative penalties
may be imposed against public administration entities.
(6)
Deleted by Legal Notice 89 of 2026.
(1)
The Enforcement Committee shall have the power
to impose administrative fines established by this order, on any entity
reported by the CIP Department, or where designated the competent
authority, as being non-compliant with this order.
(2)
Prior to deciding on whether an entity is compliant with
this order, the Committee shall allow the entity to provide
documentation or make submissions as it deems fit.
(3)
The Committee may, if it deems necessary, ask for more
information or documentation from the CIP Department, or where
designated the competent authority, or from the entity concerned.
(4)
Whenever the Committee establishes that an entity has
not complied with this order or has not taken the necessary supervisory
or enforcement measures in accordance with this order, it shall impose
an administrative fine.
(5)
In its decision the Committee shall indicate the amount of
the administrative penalty and a timeframe within which the entity
concerned shall pay the administrative penalty, as well as a timeframe
within which the entity is to remedy the breach. The Committee shall
give reasons for its decision.
(1)
Independently of whether a penalty is issued upon
the entity concerned, the CIP Department, or where designated the
competent authority may, in accordance with article 31 require the
entity to comply with the following provisions as applicable
(a)
cybersecurity risk-management measures and, or
reporting obligations in articles 19 and 20;
(b)
enforcement measures in article 29(6)(a) to (k),
article 30(6)(a) to (j) and article 31(10);
(c)
any other law or measure applicable to ensure
compliance and enforcement, taken by the CIP Department, or
where designated the competent authority.
(2)
The Committee shall notify the entity concerned of the
following
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(a)
the administrative penalty that shall be imposed;
(b)
the specific reasons on the basis of which the
administrative penalty shall be imposed;
(c)
the amount of the administrative penalty;
(d)
the timeframe within which the entity concerned
shall pay the administrative penalty
Provided that the timeframe referred to in article 34(2)(d)
shall be not more than twenty (20) working days or not less than five
(5) working days from the date of service of the notice.
(3)
Deleted by Legal Notice 89 of 2026.
(4)
Deleted by Legal Notice 89 of 2026.
(5)
Deleted by Legal Notice 89 of 2026.
(6)
Deleted by Legal Notice 89 of 2026.
Deleted by Legal Notice 89 of 2026.
Deleted by Legal Notice 89 of 2026.
(1)
Any natural person having the legal and judicial
representation of the essential or important entity concerned, including
the authority to take decisions on its behalf or, the authority to exercise
control of it, shall have the power to ensure its compliance with this
order and shall be liable for breach of his duties in case of non-
compliance of the essential or important entity by means of an
infringement of this order in particular articles 19 and, or 20
Provided that this sub-article shall be without prejudice
to national law regulating the liability of public servants and elected or
appointed officials.
(2)
If the natural person is found to be in breach of his
duties, in case of non-compliance by the essential or important entity
with this order, the CIP Department, or where designated the
competent authority, may proceed against such natural person under
article 31(10)(b).
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(1)
The CIP Department, or where designated the
competent authority, may request the imposition by the Committee of
daily penalty payments for each infringement which the essential or
important entity concerned repeatedly fails to cease and, or rectify in
accordance with a prior decision of the CIP Department, or where
designated the competent authority.
(2)
The daily penalty payment shall be one hundred euro
(€100) for each breach in terms of sub-article (1), for each day during
which the breach persists
Provided that any daily penalty payment imposed may be
backdated to the date on which the breach was committed or the breach
commenced.
(3)
When deciding about daily penalty payments, the
Committee shall act in accordance with articles 33 and 34.
(1)
Where the CIP Department, or where designated
the competent authority, becomes aware in the course of supervision or
enforcement that the infringement by an essential or important entity of
the obligations established in articles 19 and, or 20 may entail a
personal data breach, as defined in Article 4(12) of Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation) which is to
be notified in accordance with Article 32 of the said Regulation, it shall
without undue delay, inform the Information and Data Protection
Commissioner.
(2)
If the natural person is found in breach of his duties, in
case of non-compliance by the essential or important entity with this
order, the CIP Department, or where designated the competent
authority, may proceed against such natural person in accordance with
article 31(10)(b).
(3)
Where the supervisory authority competent in accordance
with Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of
such data, and repealing Directive 95/46/EC (General Data Protection
Regulation), is not established in Malta, the CIP Department, or where
designated the competent authority, shall inform the Information and
Data Protection Commissioner of the potential data breach referred to
in sub-article (1).
(1)
Where an entity provides services in Malta and in
other Member States, or provides services in Malta or in other Member
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
States and its network and information systems are located in Malta
and in other Member States, the CIP Department, or where designated
the competent authority, shall cooperate with and assist competent
authorities of the Member States concerned as necessary. Such
cooperation shall entail, at least, that
(a)
when the CIP Department, or the designated
competent authority, apply supervisory and, or enforcement
measures in Malta, the CIP Department, or where designated
the competent authority, shall inform and consult the competent
authorities in the other Member States concerned on the
supervisory and, or enforcement measures taken
Provided that the designated competent authority shall
notify in writing the Malta CIP Department, or where designated the
competent authority, of the application of such supervisory and, or
enforcement measures in Malta;
(b)
the Malta CIP Department, or where designated
the competent authority, may request the competent authority of
another Member State to take supervisory and enforcement
measures in Malta
Provided that such measures are exercised under the
guidance and agreement of the CIP Department, or where designated
the competent authority
Provided further that if the CIP Department, or where
designated the competent authority, is not responsible for the sector,
sub-sector, or type of entity under the First or Second Schedule, the
CIP Department shall cooperate with and coordinate measures arising
from this sub-article with the designated competent authority in Malta;
(c)
upon receipt of a substantiated request from
another competent authority, the CIP Department, or where
designated the competent authority, shall provide the other
competent authority mutual assistance proportionate to its own
resources so that the supervisory and enforcement measures
may be implemented in an effective, efficient and consistent
manner.
(2)
The mutual assistance referred to in sub-article (1)(c)
may cover information requests and supervisory measures, including
requests to carry out on-site inspections or off-site supervision or
targeted security audits.
(3)
The CIP Department, or where designated the competent
authority, shall not refuse the request under sub-article (2), unless it is
established that
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(a)
it does not have the competence to provide the
requested assistance;
(b)
the requested assistance is not proportionate to the
supervisory tasks of the competent authority; or
(c)
the request concerns information or entails
activities which, if disclosed or carried out, would be contrary to
the essential interests of Malta’s national security, public
security or defence
Provided that before refusing such a request, the CIP
Department, or where designated the competent authority, shall consult
the other competent authorities concerned and upon the request of one
of the Member States concerned, the European Commission and
ENISA
Provided further that the notification of such a request to
the competent authority of the other Member State shall be done by the
CIP Department, or where designated the competent authority.
(4)
Where appropriate and with common agreement, the CIP
Department, or where designated the competent authority, may carry
out joint supervisory actions with competent authorities of various
Member States
Provided that in joint supervisory actions, the CIP
Department, or where designated the competent authority may, where
appropriate, confer powers, including supervisory and, or enforcement
measures under articles 29 and 30 onto the members or staff of the
other competent authorities
Provided further that the joint supervisory actions shall be
coordinated by the CIP Department.
PART VIII – ADMINISTRATIVE REVIEW TRIBUNAL
(1)
Any decision taken by the Committee in
accordance with this order may be appealed within twenty (20) days
from the service of the decision by means of an application filed before
the Administrative Review Tribunal.
(2)
Any party to an appeal who feels aggrieved by a decision
of the Administrative Review Tribunal may, on a question of law,
appeal from such decision by filing an application to the Court of
Appeal constituted in accordance with article 41(9) of the Code of
Organization and Civil Procedure. Such application shall be filed
within twenty (20) days from the date of the decision of the
Administrative Review Tribunal.
CYBERSECURITY ACROSS THE EUROPEAN UNION
(MALTA)
(3)
The provisions of article 466 of the Code of Organization
and Civil Procedure shall, mutatis mutandis, apply to the
administrative penalties established by this order.
Appeals from
Deleted by Legal Notice 89 of 2026.
enforcement
measures.
Right of further
Deleted by Legal Notice 89 of 2026.
appeal.