S.L. 460.41 Art. 20Reporting obligations. 

(1) Essential and important entities shall immediately notify the national CSIRT, of any incident that has a significant impact on the provision of their services in accordance with sub-

article (6):

Provided that the mere act of notification shall not subject the notifying entity to an increased liability:

Provided further that the national CSIRT shall CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

immediately notify in writing the CIP Department and any other designated competent authority as the case may be, of any incident that has a significant impact on the provision of the services provided by an essential or important entity which such authority regulates.

(2) Where appropriate, essential and important entities shall notify, without undue delay, the recipients of their services of significant incidents that are likely to adversely affect the provision of those services. Those entities shall report any information enabling the national CSIRT to determine any cross-border impact of the incident.

(3) In the case of a cross-border or cross-sectoral significant incident, the CIP Department, shall be provided in due time with relevant information notified in accordance with sub-article (5).

(4) Where applicable, essential and important entities shall communicate, without undue delay, to the recipients of their services that are potentially affected by a significant cyber threat any measures or remedies that those recipients are able to take in response to such threat. Where appropriate, the entities shall also inform those recipients of the significant cyber threat itself.

(5) For the purpose of notification in accordance with sub-article (1), the entities concerned shall submit to the national CSIRT:

(a) without undue delay and in any event within twenty-four (24) hours of becoming aware of the significant incident, an early warning, which where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;

(b) without undue delay and in any event within seventy-two (72) hours of becoming aware of the significant incident, an incident notification, which where applicable, shall update the information referred to in paragraph (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as where available, the indicators of compromise;

(c) upon the request of the national CSIRT, an intermediate report on relevant status updates;

(d) a final report not later than one (1) month after the submission of the incident notification in accordance with sub-article (5)(b), including the following:

(i) a detailed description of the incident, including its severity and impact;

(ii) the type of threat or root cause that is likely to have triggered the incident;

(iii) applied and ongoing mitigation measures;

(iv) where applicable, the cross-border impact of the incident;

(e) in the event of an ongoing incident at the time of the submission of the final report referred to in paragraph (d), the entities concerned shall provide the national CSIRT with a progress report at that time and a final report within one (1) month of their handling of the incident.

(6) By way of derogation from sub-article (5)(b), a trust service provider shall, with regard to significant incidents that have an impact on the provision of its trust services, notify the national CSIRT without undue delay and in any event within twenty-four (24) hours of becoming aware of the significant incident.

(7) The national CSIRT shall provide, without undue delay and where possible within twenty-four (24) hours of receiving the early warning referred to in sub-article (5)(a), a response to the notifying entity, including initial feedback on the significant incident and, upon request of the entity, guidance or operational advice on the implementation of possible mitigation measures:

Provided that where the national CSIRT is not the initial recipient of the notification referred to in sub-article (1), the guidance shall be provided by the designated competent authority in cooperation with the national CSIRT. The national CSIRT shall provide additional technical support if the entity concerned so requests, provided the technical capability is available.

(8) Where the significant incident is reasonably suspected to be a criminal offence, the national CSIRT, the CIP Department or where designated the competent authority, shall also provide guidance on reporting the significant incident to the Executive Police.

(9) Where appropriate, and in particular where the significant incident concerns Malta and at least another Member State, the national CSIRT, with prior coordination with the CIP Department and where designated the competent authority, shall inform, without undue delay, the other affected Member State and ENISA of the significant incident and such information shall include the type of information received in accordance with sub-article (5):

Provided that in so doing, the national CSIRT shall, in CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

accordance with national law and, or Union law, preserve the entity’s security and commercial interests as well as the confidentiality of the information provided.

(10) Where public awareness is necessary to prevent a significant incident or to deal with an ongoing significant incident, or where disclosure of the significant incident is otherwise in the public interest, the national CSIRT, and where appropriate, the CSIRTs or the competent authorities of other Member States concerned may, after consulting the entity concerned, inform the public about the significant incident or require the entity to do so.

(11) At the request the national of CSIRT, or where designated the competent authority, the CIP Department shall forward notifications received in accordance with sub-article (1) to the single points of contact of other affected Member States.

(12) The national CSIRT shall provide to the CIP Department information about significant incidents, incidents, cyber threats and near misses notified in accordance with sub-article (1) and article 27.

(13) The CIP Department shall submit to ENISA and to the National Cybersecurity Steering Committee, a summary report, including anonymised and aggregated data on significant incidents, incidents, cyber threats and near misses notified in accordance with sub-article (1) and with article 27.

(14) Every three (3) months, the single point of contact shall submit to ENISA a summary report containing anonymised and aggregated data on significant incidents, incidents, cyber threats and near misses notified in accordance with sub-article (1) and article 27.