S.L. 460.41 Art. 2Interpretation. 

(1) In this order unless the context otherwise requires:

"autonomous CSIRT" means an outsourced CSIRT which provides a monitoring function of CSIRT services to essential or important entities;

"background check" means a background check as defined in Directive (EU) 2022/2557;

"Charter" means the Charter of Fundamental Rights of the European Union;

"CIP Department" means the Critical Infrastructure Protection Department as established by virtue of article 7;

"cloud computing service" means a digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources, including where such resources are distributed across several locations. For the purposes of this definition:

(i) computing resources shall include resources such as networks, servers or other infrastructure, operating systems, software, storage, applications and services. The service models of cloud computing include, Infrastructure as a Service inter alia, CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

(IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) and Network as a Service (NaaS). The deployment models of cloud computing shall include private, community, public and hybrid cloud;

(ii) the cloud computing service and deployment models shall have the same meaning as the terms of service and deployment models defined under ISO/IEC 17788:2014 standard;

(iii) the capability of the cloud computing user to unilaterally self-provision computing capabilities, such as server time or network storage, without any human interaction by the cloud computing service provider may be described as on-demand administration;

(iv) the term "broad remote access" is used to describe that the cloud capabilities are provided over the network and accessed through mechanisms promoting use of heterogeneous thin or thick client platforms, including mobile phones, tablets, laptops and workstations;

(v) the term "scalable" refers to computing resources that are flexibly allocated by the cloud service provider, irrespective of the geographical location of the resources, in order for the resources provided to handle fluctuations in demand;

(vi) the term "elastic pool" is used to describe computing resources that are provided and released according to demand in order to rapidly increase and decrease resources available depending on workload.

(vii) the term "shareable" is used to describe computing resources that are provided to multiple users who share a common access to the service, but where the processing is carried out separately for each user, although the service is provided from the same electronic equipment;

(viii) the term "distributed" is used to describe computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing;

"Commission Recommendation 2003/361/EC" means the Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises;

"Committee" means the Enforcement Committee established by virtue of article 5;

"competent authority" means the Critical Infrastructure Protection Department or any authority as may from time to time be designated by the Prime Minister under article 7;

"consumer" means a consumer as defined in article 2 of the Consumer Affairs Act;

"content delivery network" means a network of geographically distributed servers for the purpose of ensuring high availability, accessibility or fast delivery of digital content and services to internet users on behalf of content and service providers;

"Cooperation Group" means the Cooperation Group established in accordance with Article 14 of Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive);

"coordinated vulnerability disclosure" means a structured process through which potential vulnerabilities pertaining to ICT products, ICT processes or ICT services could be identified and reported to the entity. Coordinated vulnerability disclosure also includes coordination between the reporting natural or legal person and the entity of the potentially vulnerable ICT products, ICT processes or ICT services;

"critical information infrastructure" or "CII" means an information and communication technology assets, systems, networks or part thereof which are essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in Malta as a result of the failure to maintain those functions;

"critical infrastructure" or "CI" has the same meaning assigned to it in Directive (EU) 2022/2557;

"CSIRT" means a computer security incident response team;

"CSIRTs network" means the network of national CSIRTs established in accordance with Article 15 of the Directive (EU) 2022/2555; CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

"cyber threat" means a cyber threat as defined in Article 2(8) of Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act);

"cybersecurity" means cybersecurity as defined in Article 2(1) of Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act);

"data centre service" means a service that encompasses structures, or groups of structures, dedicated to the centralised accommodation, interconnection and operation of IT and network equipment providing data storage, processing and transport services together with all the facilities and infrastructures for power distribution and environmental control, and shall not apply to in-house corporate data centres owned and operated by the entity concerned for its own purpose;

"Director General" means the Director General within the Ministry for Home Affairs responsible for the CIP Department;

"DNS service provider" means an entity that provides:

(a) publicly available recursive domain name resolution services for internet end-users; or

(b) authoritative domain name resolution services for third-party use, with the exception of root name servers;

"Directive (EU) 2022/2555" means Directive (EU) 2022/ 2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive);

"Directive (EU) 2022/2557 means Directive (EU) 2022/ 2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC;

"domain name system" or "DNS" means a hierarchical distributed naming system which enables the identification of internet services and resources, allowing end-user devices to use internet routing and connectivity services to reach those services and resources;

"electronic communications service" means an electronic communications service as defined in article 2 of the Electronic

Communications (Regulation) Act;

"ENISA" means the European Union Agency for Cybersecurity established in accordance with Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation

(EU) No 526/2013 (Cybersecurity Act);

"entity" means a person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;

"entity providing domain name registration services" means a registrar or an agent acting on behalf of registrars, such as a privacy or proxy registration service provider or reseller;

"ICT process" means an ICT process as defined in Article 2(14) of Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act);

"ICT product" means an ICT product as defined in Article 2(12) of Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act);

"ICT service" means an ICT service as defined in Article 2(13) of Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act);

"incident" means an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

network and information systems;

"incident handling" means any actions and procedures aimed at preventing, detecting, analysing, and containing or responding to and recovering from it;

"Information and Data Protection Commissioner" means the Information and Data Protection Commissioner as appointed in accordance with article 11 of the Data Protection Act;

"internal CSIRT" means an internal CSIRT that operates within the structure of an entity to which it provides CSIRT monitoring services;

"internet exchange point" means a network facility which enables the interconnection of more than two (2) independent networks or autonomous systems, primarily for the purpose of facilitating the exchange of internet traffic, which provides interconnection only for autonomous systems and which neither requires the internet traffic passing between any pair of participating autonomous systems to pass through any third autonomous system nor alters or otherwise interferes with such traffic;

"large-scale cybersecurity incident" means an incident which causes a level of disruption that exceeds a Member State’s capacity to respond to it or which has a significant impact on at least two (2) Member States;

"legitimate access seekers" means any person making a lawful and duly substantiated request for access to domain name registration services in accordance with national and Union law. They can include the CIP Department or where designated the competent authority in accordance with this order and those that are competent under national law or Union law for the prevention, investigation, detection or prosecution of criminal offences, and CERTs or CSIRTs;

"managed security service provider" means a managed service provider that carries out or provides assistance for activities relating to cybersecurity risk management;

"managed service provider" means an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure and applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely;

"management body" shall include the head of the essential and important entity and any other officers appointed by the head for the purpose of carrying out article 18(1);

"Minister" means the Minister responsible for critical infrastructure protection;

"National Cyber Security Steering Committee" means the Committee as established in accordance with article 15;

"national CSIRT" means the national computer security incident response team designated or established in accordance with article 8;

"national cybersecurity strategy" means a coherent framework providing strategic objectives and priorities in the area of cybersecurity and the governance to achieve them at national level;

"near miss" means an event that may have compromised the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via network and information systems, but that was successfully prevented from materialising or that did not materialise;

"network and information system" means:

(a) an electronic communications network as defined in article 2 of the Electronic Communications

(Regulation) Act;

(b) any device or group of interconnected or related devices, one (1) or more of which, pursuant to a programme, carry out automatic processing of digital data; or

(c) digital data stored, processed, retrieved or transmitted by elements covered under paragraphs (a) and (b) for the purposes of their operation, use, protection and maintenance;

"online marketplace" means an online marketplace as defined in article 51A of the Consumer Affairs Act;

"online search engine" means an online search engine as defined in Article 2(5) of Regulation (EU) 2019/1150 of the European Parliament and of the Council of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services; CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

"operator security plan” means the overall procedure identifying the assets, systems, networks or part thereof within critical information infrastructures, essential and important entities, identifying the security solutions and technical measures that exist or are being implemented for their protection and the identification, selection and prioritisation;

"peer review" means the exercise organised in accordance with Article 19 of the Directive;

"person" means a person as defined in article 4 of the

Interpretation Act;

"protocol on the sharing of information (Traffic Light Protocol)" means a protocol on the sharing of information (Traffic Light Protocol) which is a means of providing information on any limitations regarding the further dissemination of the same information;

"public administration entity" means an entity recognised as such in accordance with national law, not including the judiciary, the Parliament of Malta or the Central Bank of Malta, which complies with the following criteria:

(a) it is established for the specific purpose of meeting needs in the general interest and does not have an industrial or commercial character;

(b) it has legal personality or is entitled by law to act on behalf of another entity with legal personality;

(c) it is financed, for the most part, by the State, or by other bodies governed by public law, and is subject to management supervision by those authorities or bodies, or has an administrative, managerial or supervisory board, more than half of whose members are appointed by the State, or by other bodies governed by public law; and

(d) it has the power to address administrative or regulatory decisions to natural or juridical persons which affect their rights in the cross-border movement of persons, goods, services or capital;

"public electronic communications network" means a public electronic communications network as defined in article 2

of the Electronic Communications (Regulation) Act;

"qualified auditor" means a person who satisfies the requirements in accordance with article 14;

"qualified trust service" means a qualified trust service as defined in Article 3(17) of Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;

"qualified trust service provider" means a qualified trust service provider as defined in Article 3(20) of Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;

"Regional Committees" shall have the same meaning assigned to it in accordance with the Regional Committees Regulations;

"representative" means a natural or juridical person established in the Union explicitly designated to act on behalf of a DNS service provider, a TLD name registry, an entity providing domain name registration services, a cloud computing service provider, a data centre service provider, a content delivery network provider, a managed service provider, a managed security service provider, or a provider of an online marketplace, of an online search engine or of a social networking services platform that is not established in the Union, which may be addressed by the CIP Department or where designated the competent authority or CSIRT in the place of the entity itself with regard to the obligations of such entity in accordance with this order;

"research organisation" means an entity which has as its primary goal to conduct applied research or experimental development with a view to exploiting the results of such research for commercial purposes, but which does not include educational institutions;

"risk" means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident;

"risk assessment" means the overall process of risk identification, risk analysis and risk evaluation, incorporating the identification of risk sources, events, their causes and their potential consequences, comprehending the nature of risk and CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

determining the level of risk, with the ultimate objective of comparing the results of the risk analysis with the risk criteria in order to determine whether the risk and, or its magnitude is acceptable or tolerable;

"security of network and information systems" means the ability of network and information systems to resist, at a given level of confidence, any event that may compromise the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible by means of those network and information systems;

"service" means a service as defined in regulation 2 of the

Notification Procedure Regulations;

"single point of contact" means the CIP Department established by virtue of article 7;

"significant cyber threat" means a cyber threat which, based on its technical characteristics, may be assumed to have the potential to have a severe impact on the network and information systems of an entity or the users of the entity’s services by causing considerable material or non-material damage;

"significant incident" means an incident which:

(a) has caused or is capable of causing severe operational disruption of the service or financial loss for the entity concerned; or

(b) has affected or is capable of affecting other natural or juridical persons by causing considerable material or non-material damage;

"social networking services platform" means a platform that enables end-users to connect, share, discover and communicate with each other across multiple devices, in particular by means of chats, posts, videos and recommendations;

"standard" means a standard as defined in Article 2(1) of Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the

European Parliament and of the Council;

"technical specification" means a technical specification as defined in Article 2(4) of Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/ 686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council;

"top-level domain name registry" or "TLD name registry" means an entity which has been delegated a specific TLD and is responsible for administering the TLD including the registration of domain names under the TLD and the technical operation of the TLD, including the operation of its name servers, the maintenance of its databases and the distribution of TLD zone files across name servers, irrespective of whether any of those operations are carried out by the entity itself or are outsourced, but excluding situations where TLD names are used by a registry only for its own use;

"trader" means any natural or juridical person, who is acting, including through any person acting in his name or on his behalf, for purposes relating to his trade, business, craft or profession;

"Tribunal" means the Administrative Review Tribunal established by article 5(1) under the Administrative Justice Act;

"trust service" means a trust service as defined in Article 3(16) of the Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework;

"trust service provider" means a trust service provider as defined in Article 3(19) of Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, as regards establishing the European Digital Identity Framework;

"vulnerability" means a weakness, susceptibility or flaw of ICT products or ICT services that may be exploited by a cyber threat; CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

"Union" means the European Union.

(2) Unless the context otherwise requires, words and phrases used in this order which are not defined herein, shall have the same meaning as assigned to them in the Directive.