S.L. 460.41 Art. 10Tasks of the national CSIRT and of the internal and autonomous CSIRTs. 

(1) The national CSIRT shall have the following tasks:

(a) monitoring and analysing cyber threats, vulnerabilities and incidents at national level and, upon request, providing assistance to essential and important entities concerned regarding real-time or near real-time monitoring of their network and information systems;

(b) providing early warnings, alerts, announcements and dissemination of information to essential and important entities concerned as well as to the competent authorities and other relevant stakeholders on cyber threats, vulnerabilities and incidents, if possible in near real-time;

(c) responding to incidents and providing assistance to the essential and important entities concerned, where applicable;

(d) collecting and analysing forensic data and providing dynamic risk and incident analysis and situational awareness regarding cybersecurity;

(e) providing upon the request of an essential or important entity, a proactive scanning of the network and information systems of the entity concerned to detect vulnerabilities with a potential significant impact;

(f) participating as the leading national representative, in the CSIRTs network and providing mutual assistance in accordance with their capacities and competencies to other members of the CSIRTs network upon their request, provided that the CIP Department may participate in the CSIRTs network;

(g) contributing to the deployment of secure information-sharing tools.

(2) The national CSIRT may carry out proactive non-intrusive scanning of publicly accessible network and information systems of essential and important entities. Such scanning shall be carried out to detect vulnerable or insecurely configured network and information systems and inform the entities concerned and shall not have any negative impact on the functioning of the entities’ services:

Provided that the essential and important entities shall be notified in writing of the proactive and non-intrusive scanning of their publicly accessible network and information systems, and following such scanning, shall be notified in writing of any vulnerable or insecurely configured network and information systems:

Provided further that the national CSIRT shall be deemed as duly authorised in the carrying out of this measure in accordance with article 337C(2) of the Criminal Code:

Provided further that the national CSIRT shall notify the CIP Department, and where designated, the other competent authorities, about all the assistance, information, scanning, incidence response or other services that are to be provided to the essential and important entities in line with any of the provisions of this article.

(3) When carrying out the tasks referred to in sub-article (1), the national CSIRT may prioritise particular tasks on the basis of a risk-based approach.

(4) The national CSIRT shall establish cooperation relationships with relevant stakeholders in the private sector, with a view to achieving the objectives of this order.

(5) In order to facilitate cooperation referred to in sub-article (4), the national CSIRT shall promote the adoption and use of common or standardised practices, classification schemes and taxonomies in relation to incident-handling procedures.

(6) Internal and autonomous CSIRTs shall have at least the following tasks:

(a) monitoring and analysing cyber threats, vulnerabilities and incidents of the essential and important entities and providing real-time or near real-time monitoring of their network and information systems;

(b) providing early warnings, alerts, announcements and dissemination of information on cyber threats, vulnerabilities and incidents, if possible in near real-time to the essential and important entities;

(c) responding to incidents and providing assistance to the essential and important entities;

(d) collecting and analysing forensic data and providing dynamic risk and incident analysis and situational awareness regarding cybersecurity of the essential and CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

important entities;

(e) providing a proactive scanning of the network and information systems of the essential and important entities to detect vulnerabilities with a potential significant impact:

Provided that the tasks referred to in this sub-article shall be carried out by internal and autonomous CSIRTs providing CSIRT monitoring services to essential and important entities in accordance with article 19(1)(d).