MaltaElectronic Communications Networks and Services (General) Regulations, Security Incident Notification to the Malta Communications Authority
L.N. 379 of 2021, reg. 28, Electronic Communications Networks and Services (General) Regulations
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a provider of public electronic communications networks or of publicly available electronic communications services, including a gateway operator, which is such a provider whose network or service includes a submarine connection between the Maltese islands or an international connection between Malta and other countries. Read it by hand if you provide a network or service of that kind in Malta.
- Notify the Authority, the Malta Communications Authority, without undue delay of any security incident that has a significant impact on the operation of your networks or services (regulation 28(2)(a)).NIST CSF 2.0RS.CO-02
- If you are a gateway operator, notify the Authority without undue delay of any failure or serious degradation of the connectivity you provide (regulation 28(2)(b)).NIST CSF 2.0RS.CO-02
- Take account, where available, of the number of users affected, the duration of the incident, its geographical spread, the extent to which the network or service is affected and the extent of its impact on economic and societal activities when judging whether an incident has a significant impact (regulation 28(4)).NIST CSF 2.0RS.MA-03
- Where there is a particular and significant threat of a security incident, inform the users who may be potentially affected of any possible protective measures or remedies they can take and, where appropriate, of the threat itself (regulation 28(7)).NIST CSF 2.0RS.CO-03
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Malta Communications Authority
Settledness
The Malta Communications Authority Technical Guideline on Reporting Incidents is written under Subsidiary Legislation 399.28.
- As of
- Open questions
- At what number of users affected, duration and geographical spread does a security incident have a significant impact on the operation of networks or services under regulation 28(2)(a), given that the Malta Communications Authority reporting thresholds were issued under Subsidiary Legislation 399.28 rather than these Regulations?
What this law does
Regulation 28(2) of the Electronic Communications Networks and Services (General) Regulations requires a provider of public electronic communications networks or of publicly available electronic communications services, or a gateway operator, to notify the Authority without undue delay of any security incident that has a significant impact on the operation of networks or services.
A gateway operator must also notify the Authority without undue delay of a failure or serious degradation of the connectivity it provides. The Authority is the Malta Communications Authority. A security incident is an event having an actual adverse effect on the security of electronic communications networks and, or services.
A gateway operator is an undertaking providing or authorised to provide a public network or service that includes a submarine connection between the Maltese islands, an international connection between Malta and other countries, or both.
In judging whether an incident has a significant impact, the provider takes into account, where available, the number of users affected, the duration of the incident, its geographical spread, the extent to which the network or service is affected and the extent of its impact on economic and societal activities.
Where there is a particular and significant threat of a security incident, the provider must inform its users who may be potentially affected of any possible protective measures or remedies they can take. The Regulations came into force on . They revoked the Electronic Communications Networks and Services (General) Regulations, 2011.
When LexLint raises it
When your app profile says your app provides telecom services.