S.L. 460.41 Art. 12Cooperation at national level. 

(1) The CIP Department, the national CSIRT or where designated the competent authorities shall cooperate with each other with regard to the fulfilment of the obligations laid down in this order.

(2) The national CSIRT shall receive notifications of significant incidents in accordance with article 20 and incidents, cyber threats and near misses in accordance with article 27.

(3) The national CSIRT shall inform in writing the CIP Department and relevant competent authorities of notifications of incidents, cyber threats and near misses submitted in accordance with article 20(1).

(4) The CIP Department, and where designated, the competent authority, and national CSIRT shall cooperate with the

Executive Police, the Office of the Information and Data Protection

Commissioner in accordance with the Data Protection Act, the

Aviation Security Department in accordance with the Airports and

Civil Aviation (Security) Act, the Civil Aviation Directorate in accordance with the Air Navigation Act, the Malta Communications

Authority in accordance with the Electronic Commerce Act, the

Electronic Communications (Regulation) Act and the Radio

Equipment Regulations, the Malta Financial Services Authority in accordance with Regulation (EU) 2022/2554 of the European

Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending

Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/

2014, (EU) No 909/2014 and (EU) No 2016/1011, the CIP Department in accordance with Directive (EU) 2022/2557 as well as the competent authorities under other sector-specific Union legal acts, within Malta.

(5) The CIP Department and the national CSIRT shall exchange relevant information on a regular basis, including with regard to relevant incidents and cyber threats with competent authorities under this order.

(6) The CIP Department, or where designated the competent authority under this order and the competent authority in accordance with Directive (EU) 2022/2557 shall cooperate and exchange information on a regular basis with regard to the identification of critical entities, on risks, cyber threats, and incidents as well as on non-cyber risks, threats and incidents affecting entities identified as critical entities under the said order, and the measures taken in response to such risks, threats and incidents.

(7) The reporting shall be simplified through technical means for notifications in articles 20 and 27.

(8) Repealed by Legal Notice 89 of 2026.