MaltaMeasures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential or important entity under articles 3 and 4 of the Order that falls under Malta's jurisdiction under article 23: an entity established in Malta or, for a DNS service, top-level domain name registry, domain name registration, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider, one whose main establishment in the Union is in Malta or whose Union representative is established in Malta. It reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and are named in the First or Second Schedule, or where the Order names you regardless of size; the Second Schedule names online marketplace, online search engine and social networking services platform providers, and the wider sector classes it reaches (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT services management, public administration, space and others) are reached by declaring that you are an essential or important entity.
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of incidents on the recipients of your services and on other services (article 19(1)).NIST CSF 2.0ID.RA-06
- Base those measures on an all-hazards approach and cover at least: policies on risk analysis and information system security; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies and procedures to assess the effectiveness of the measures; basic cyber hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; human resources security, insider risk management, access control and asset management; multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems where appropriate; and logging and traceability (article 19(2)).NIST CSF 2.0GV.PO-01
- When choosing supply chain measures, take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of its products and cybersecurity practices, including its secure development procedures (article 19(3)).NIST CSF 2.0GV.SC-07
- Appoint a security liaison officer with the necessary expertise, who develops and maintains your business continuity plans, ensures risk assessments are carried out, maintains and exercises your operator security plan and acts as your point of contact with the CIP Department or the designated competent authority (article 19(1)(c)).NIST CSF 2.0GV.RR-02
- Receive computer security incident response team (CSIRT) monitoring services from an internal CSIRT or an autonomous CSIRT that meets the requirements of article 9(1) (article 19(1)(d)).NIST CSF 2.0DE.CM-01
- Have your management body approve the risk-management measures and oversee their implementation, have its members follow cybersecurity risk-management training, and offer similar training to your employees on a regular basis; the natural persons composing the management body may be held liable for an infringement of article 19 (article 18).NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- Register on the national self-registration mechanism of the CIP Department with your name, the CSIRT providing monitoring services to you, your contact details and IP ranges, your sector and the Member States where you provide services, and notify it of any change without delay and within two weeks (article 7(4) and (5)); a DNS service provider, top-level domain name registry, domain name registration service, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider also submits the article 24(1) registry information by the prescribed date and notifies changes within three months.NIST CSF 2.0GV.OC-03
- Where you find you do not comply with the measures in article 19(2), take, without undue delay, all necessary, appropriate and proportionate corrective measures (article 19(4)).NIST CSF 2.0ID.RA-06
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- GV.SC-07The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Order's penalty regime for an infringement of articles 19 or 20 is administrative: fines imposed by the Enforcement Committee under articles 32 and 33, appealed to the Administrative Review Tribunal under article 41. No provision of the Order makes the infringement a criminal offence, although article 31(10)(b) lets the CIP Department ask the competent bodies to prohibit temporarily a chief executive or legal representative of an essential entity from exercising managerial functions until the entity complies.
Penalty structure
Article 32(3) sets the maximum administrative penalty for an essential entity that infringes article 19 or 20 at EUR 10,000,000 or 2 percent of the total worldwide annual turnover of the preceding financial year of the undertaking the entity belongs to, whichever is higher. Article 32(4) sets the important-entity tier at EUR 7,000,000 or 1.4 percent of that turnover, whichever is higher. Article 38 lets the Enforcement Committee, on the request of the CIP Department or the designated competent authority, impose a daily penalty payment of EUR 100 for each breach the entity repeatedly fails to cease or rectify, and the payment may be backdated to the date the breach was committed. A decision of the Committee can be appealed to the Administrative Review Tribunal within 20 days under article 41.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Critical Infrastructure Protection Department (CIP Department), the national supervisory authority under article 7 of the Order; the Malta Communications Authority is the competent authority the Schedules name for digital infrastructure, digital providers and postal services, and the Enforcement Committee imposes the administrative fines on the report of the CIP Department or the designated competent authority under article 33.
Settledness
- As of
- Open questions
- By what date must the providers named in article 24(1) of the Order submit their registration information to the CIP Department, given that the article says only "by the prescribed date"?
What this law does
Article 19 requires an essential entity or important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems it uses for its operations or services, and to prevent or minimise the impact of incidents on the recipients of its services and on other services.
The measures must follow an all-hazards approach and cover at least the areas article 19(2) lists, which include incident handling, supply chain security and security in the acquisition, development and maintenance of systems including vulnerability handling and disclosure. The entity must also appoint a security liaison officer. It must receive monitoring services from an internal or an autonomous computer security incident response team (computer security incident response team (CSIRT)).
Article 18 requires the entity's management body to approve the measures and oversee their implementation, and the natural persons composing the body may be held liable for an infringement of article 19. The Order applies to a public or private entity of a type listed in its First or Second Schedule that is at least medium-sized.
Regardless of size it also applies to providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain name registries and DNS service providers. The Second Schedule names online marketplace, online search engine and social networking services platform providers as digital providers.
The First Schedule names cloud computing, data centre and content delivery network providers as digital infrastructure and managed service and managed security service providers under ICT services management. A cloud computing, data centre, content delivery network, managed service, DNS, online marketplace, online search engine or social networking services platform provider must also register with the CIP Department by the prescribed date.
Regulation 3(16) disapplies the relevant provisions of this Order, including supervision and enforcement under Part VII, to an essential or important entity that a sector-specific Union legal act requires to adopt cybersecurity risk-management measures or to notify the CSIRT of significant incidents with at least equivalent effect.
Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
Regulation 3(17) measures that equivalence against the risk-management measures of article 19(1) to (3) and the notification duties of article 20(1) to (6), so the registration under article 7(1)(c) and article 24(1) that this row names still binds such an entity.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank, is a securities firm or provides telecom services.
Back to the example · Lint your app
Page updated .