Handles health records, in Malta

S.L. 460.41, art. 20, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order · Read the law's page

• Notify the national CSIRT, which article 8(1) establishes within the Malta Information Technology Agency, immediately of any incident that has a significant impact on the provision of your services; treat an incident as significant where it has caused or is capable of causing severe operational disruption of the service or financial loss for you, or considerable material or non-material damage to another person.
• Submit an early warning to the national CSIRT, without undue delay and in any event within 24 hours of becoming aware of the significant incident, stating where applicable whether it is suspected of being caused by unlawful or malicious acts or could have a cross-border impact.
• Follow with an incident notification within 72 hours of becoming aware of the incident, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, the indicators of compromise.
• Submit an intermediate report on relevant status updates if the national CSIRT asks for one, and a final report not later than one month after the incident notification, covering a detailed description of the incident, its likely root cause, the mitigation applied and any cross-border impact; if the incident is still ongoing then, send a progress report at that point and a final report within one month of handling it.
• Where appropriate, notify the recipients of your services without undue delay of a significant incident likely to adversely affect those services, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.
• If you are a trust service provider, notify a significant incident that affects your trust services within 24 hours of becoming aware of it, without the 72-hour stage that applies to other entities.
• This binds an essential or important entity under articles 3 and 4 of the Order, reached as on this jurisdiction's companion risk-management row: an entity of a type listed in the First or Second Schedule that is at least medium-sized, or that the Order names regardless of size, and that falls under Malta's jurisdiction under article 23, including a social networking services platform, online marketplace or online search engine provider.

S.L. 460.41, arts. 18, 19 and 24, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of incidents on the recipients of your services and on other services (article 19(1)).
• Base those measures on an all-hazards approach and cover at least: policies on risk analysis and information system security; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies and procedures to assess the effectiveness of the measures; basic cyber hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; human resources security, insider risk management, access control and asset management; multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems where appropriate; and logging and traceability (article 19(2)).
• When choosing supply chain measures, take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of its products and cybersecurity practices, including its secure development procedures (article 19(3)).
• Appoint a security liaison officer with the necessary expertise, who develops and maintains your business continuity plans, ensures risk assessments are carried out, maintains and exercises your operator security plan and acts as your point of contact with the CIP Department or the designated competent authority (article 19(1)(c)).
• Receive CSIRT monitoring services from an internal CSIRT or an autonomous CSIRT that meets the requirements of article 9(1) (article 19(1)(d)).
• Have your management body approve the risk-management measures and oversee their implementation, have its members follow cybersecurity risk-management training, and offer similar training to your employees on a regular basis; the natural persons composing the management body may be held liable for an infringement of article 19 (article 18).
• Register on the national self-registration mechanism of the CIP Department with your name, the CSIRT providing monitoring services to you, your contact details and IP ranges, your sector and the Member States where you provide services, and notify it of any change without delay and within two weeks (article 7(4) and (5)); a DNS service provider, top-level domain name registry, domain name registration service, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider also submits the article 24(1) registry information by the prescribed date and notifies changes within three months.
• Where you find you do not comply with the measures in article 19(2), take, without undue delay, all necessary, appropriate and proportionate corrective measures (article 19(4)).
• This binds an essential or important entity under articles 3 and 4 of the Order that falls under Malta's jurisdiction under article 23: an entity established in Malta or, for a DNS service, top-level domain name registry, domain name registration, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider, one whose main establishment in the Union is in Malta or whose Union representative is established in Malta. It reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and are named in the First or Second Schedule, or where the Order names you regardless of size; the Second Schedule names online marketplace, online search engine and social networking services platform providers, and the wider sector classes it reaches (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT services management, public administration, space and others) are reached by declaring that you are an essential or important entity.