S.L. 460.41 Art. 19Cybersecurity risk- management measures. 34 [S.L. 35

(1) The CIP Department, or where designated the competent authority, shall ensure that essential and important entities:

(a) take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services;

(b) ensure a level of security of network and information systems appropriate to the risks posed, taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in paragraph (a):

Provided that when assessing the proportionality of the measures, they shall take due consideration of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact; CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

(c) appoint a security officer who shall have liaison the necessary expertise and who shall:

(i) facilitate the development, implementation, maintenance and review of business continuity plans and where necessary termination plans that include the preparedness, processes and solutions of the essential or important entity;

(ii) ensure that the essential or important entity conducts and maintains appropriate risk assessments;

(iii) ensure that the essential or important entity maintains and exercises an operator security plan; and

(iv) act as the point of contact between the essential or important entity and the CIP Department, or where designated the competent authority, to ensure the fulfilment of the obligations established in this order;

(d) receive CSIRT monitoring services from any of the following CSIRTs, which CSIRTs shall comply with the requirements established in article 9(1) and carry out the tasks set out in article 10(2):

(i) an internal CSIRT; or

(ii) an autonomous CSIRT.

(2) The measures in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:

(a) policies on risk analysis and information system security;

(b) incident handling;

(c) business continuity, such as backup management and disaster recovery, and crisis management;

(d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;

(e) security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;

(f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures;

(g) basic cyber hygiene practices and cybersecurity training;

(h) policies and procedures regarding the use of cryptography and, where appropriate, encryption;

(i) human resources security, insider risk management policy, access control policies and asset management;

(j) the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate; and

(k) logging and traceability of network and information systems.

(3) The CIP Department, or where designated the competent authority, shall ensure that, when considering which measures referred to in sub-article (2)(d) are appropriate, entities shall take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. The CIP Department, or where designated the competent authority, shall also ensure that, when considering which measures in the said sub-article are appropriate, entities are required to take into account the results of the coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1) of the Directive.

(4) The CIP Department, or where designated the competent authority, shall ensure that, where an essential or important entity finds that it does not comply with the measures provided for in sub-article (2), the entity concerned shall take, without undue delay, all necessary, appropriate and proportionate corrective measures referred to in article 29 for essential entities or article 30 for important entities.