MaltaMeasures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an essential or important entity under articles 3 and 4 of the Order, reached as on this jurisdiction's companion risk-management row: an entity of a type listed in the First or Second Schedule that is at least medium-sized, or that the Order names regardless of size, and that falls under Malta's jurisdiction under article 23, including a social networking services platform, online marketplace or online search engine provider.
- Notify the national computer security incident response team (CSIRT), which article 8(1) establishes within the Malta Information Technology Agency, immediately of any incident that has a significant impact on the provision of your services; treat an incident as significant where it has caused or is capable of causing severe operational disruption of the service or financial loss for you, or considerable material or non-material damage to another person.NIST CSF 2.0RS.CO-02
- Submit an early warning to the national CSIRT, without undue delay and in any event within 24 hours of becoming aware of the significant incident, stating where applicable whether it is suspected of being caused by unlawful or malicious acts or could have a cross-border impact.NIST CSF 2.0RS.CO-02
- Follow with an incident notification within 72 hours of becoming aware of the incident, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, the indicators of compromise.NIST CSF 2.0RS.CO-02
- Submit an intermediate report on relevant status updates if the national CSIRT asks for one, and a final report not later than one month after the incident notification, covering a detailed description of the incident, its likely root cause, the mitigation applied and any cross-border impact; if the incident is still ongoing then, send a progress report at that point and a final report within one month of handling it.NIST CSF 2.0RS.CO-03
- Where appropriate, notify the recipients of your services without undue delay of a significant incident likely to adversely affect those services, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.NIST CSF 2.0RS.CO-02
- If you are a trust service provider, notify a significant incident that affects your trust services within 24 hours of becoming aware of it, without the 72-hour stage that applies to other entities.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Order's penalty regime for an infringement of articles 19 or 20 is administrative: fines imposed by the Enforcement Committee under articles 32 and 33, appealed to the Administrative Review Tribunal under article 41. No provision of the Order makes the infringement a criminal offence, although article 31(10)(b) lets the CIP Department ask the competent bodies to prohibit temporarily a chief executive or legal representative of an essential entity from exercising managerial functions until the entity complies.
Penalty structure
Article 32(3) sets the maximum administrative penalty for an essential entity that infringes article 19 or 20 at EUR 10,000,000 or 2 percent of the total worldwide annual turnover of the preceding financial year of the undertaking the entity belongs to, whichever is higher. Article 32(4) sets the important-entity tier at EUR 7,000,000 or 1.4 percent of that turnover, whichever is higher. Article 38 lets the Enforcement Committee, on the request of the CIP Department or the designated competent authority, impose a daily penalty payment of EUR 100 for each breach the entity repeatedly fails to cease or rectify, and the payment may be backdated to the date the breach was committed. A decision of the Committee can be appealed to the Administrative Review Tribunal within 20 days under article 41.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Critical Infrastructure Protection Department (CIP Department), the national supervisory authority under article 7 of the Order; the Malta Communications Authority is the competent authority the Schedules name for digital infrastructure, digital providers and postal services, and the Enforcement Committee imposes the administrative fines on the report of the CIP Department or the designated competent authority under article 33.
Settledness
- As of
- Open questions
- Does regulation 28(2) of the Electronic Communications Networks and Services (General) Regulations (Legal Notice 379 of 2021), which requires a provider of public electronic communications networks or services to notify the Malta Communications Authority of a security incident with a significant impact, apply beside article 20 of the Order to an electronic communications provider that is also an essential or important entity?
What this law does
Article 20 requires an essential entity or important entity to notify the national computer security incident response team (CSIRT) immediately of any incident that has a significant impact on the provision of its services. A significant incident is one that has caused or is capable of causing severe operational disruption of the service or financial loss for the entity, or that has affected or is capable of affecting other natural or juridical persons by causing considerable material or non-material damage.
The entity must submit an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours with an initial assessment of its severity and impact, an intermediate report if the national CSIRT asks for one, and a final report not later than one month after the 72-hour notification. A trust service provider notifies within 24 hours of becoming aware of a significant incident that affects its trust services.
Where appropriate the entity must also notify the recipients of its services, without undue delay, of significant incidents likely to adversely affect the provision of those services. Notifying does not itself subject the entity to increased liability. The national CSIRT is the team established within the Malta Information Technology Agency by article 8(1).
Regulation 3(16) disapplies the relevant provisions of this Order, including supervision and enforcement under Part VII, to an essential or important entity that a sector-specific Union legal act requires to adopt cybersecurity risk-management measures or to notify the CSIRT of significant incidents with at least equivalent effect.
Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .