S.L. 460.41 Art. 14Qualified auditors. 

(1) An essential or important entity shall appoint a qualified auditor who shall verify if the entity has implemented the cybersecurity risk-management measures in accordance with article 19:

Provided that the qualified auditor shall satisfy the requirements listed in sub-article (4) before being appointed:

Provided further that if the qualified auditor satisfies the requirements listed in sub-article (4), the appointment shall be approved by the CIP Department, or where designated the competent authority.

(2) If the qualified auditor is unable to verify whether the essential or important entity has implemented the cybersecurity risk-management measures in accordance with article 19 he shall notify this in writing to the essential or important entity and the CIP Department, or where designated the competent authority.

(3) The CIP Department, or where designated the competent authority, shall ensure that the essential or important entity takes, without undue delay, all necessary, appropriate and proportionate corrective measures.

(4) The CIP Department, or where designated the competent authority, shall approve an appointment in accordance with sub-article (1), if the qualified auditor submits a reasoned request with accompanying documentation to the CIP Department, or where designated, the competent authority, demonstrating that he is:

(a) independent from the essential or important entity being audited, including submitting a Declaration of Independence as determined by the CIP Department;

(b) in possession of documentation attesting to a background check on the said auditor, issued by the competent authority in accordance with Directive (EU) 2022/2557;

(c) in possession of a valid European and, or international cybersecurity certification or cybersecurity standard as determined by the CIP Department; and

(d) experienced and has skillsets as determined by the CIP Department.

(5) The CIP Department shall maintain a list of qualified auditors and make this list available to essential and important entities.

(6) The CIP Department shall establish the procedure for the approval of the qualified auditor in accordance with sub-article (1). CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)