S.L. 460.41 Art. 29Supervisory and enforcement measures in relationtoessential entities. 

(1) The CIP Department, or where designated the competent authority, shall ensure that the supervisory or enforcement measures imposed on essential entities in respect of the obligations established in this order are effective, proportionate and dissuasive, taking into account the circumstances of each individual case:

Provided that the implementation of such supervisory and, or enforcement measures shall be without prejudice to article 3(16).

(2) When exercising the supervisory tasks in relation to essential entities, the CIP Department, or where designated the competent authority, shall have the power to subject those entities at least to the following supervisory measures:

(a) on-site inspections and off-site supervision, CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

including random checks conducted by trained professionals;

(b) regular and targeted security audits carried out by an independent body, or the CIP Department, or where designated the competent authority;

(c) audits, including where justified on the ad hoc ground of a significant incident or an infringement of this order by the essential entity concerned;

(d) security scans based on objective, non-discriminatory, fair and transparent risk assessment criteria, where necessary with the cooperation of the essential entity concerned;

(e) requests for information necessary to assess the cybersecurity risk-management measures adopted by the essential entity concerned, including documented cybersecurity policies, as well as compliance with the obligation to submit information to the CIP Department, pursuant to article 24;

(f) requests to access data, documents and information necessary for the CIP Department, or where designated the competent authority, to carry out their supervisory tasks;

(g) requests for evidence of implementation of cybersecurity policies, such as the results of security audits carried out by a qualified auditor and the respective underlying evidence;

(h) requests for evidence of CSIRT monitoring services in accordance with article 19(1)(d);

(i) requests for evidence of compliance with policies issued by the CIP Department, or where designated the competent authority, by the CSIRT providing monitoring services to the essential entity;

(j) requests for evidence of operator security plans, business continuity plans and where necessary termination plans;

(k) any other supervisory measures which the CIP Department, or where designated the competent authority shall consider necessary in accordance with its powers at law.

(3) The targeted security audits in sub-article (2)(b), shall be based on risk assessments conducted by the CIP Department, or where designated the competent authority or the audited essential entity, or on other risk-related available information.

(4) The results of any targeted security audit in sub-articles (2)(b) and (3), shall be made available to the CIP Department, or where designated the competent authority. The costs of such targeted security audit carried out by an independent body shall be paid by the audited essential entity, except in duly substantiated cases when the CIP Department, or where designated the competent authority shall decide otherwise.

(5) When exercising the supervisory powers under sub-articles (2)(e) to (j), the CIP Department, or where designated, the competent authority, shall state the purpose of the request and specify the information requested.

(6) When exercising enforcement powers in relation to an essential entity, the CIP Department, or where designated the competent authority, shall have the power to take any or all of the following enforcement measure:

(a) issue warnings about infringements of this order by the essential entity concerned including but not limited to failure to cooperate or comply with any of the supervisory measures under sub-article (2);

(b) adopt binding instructions, including with regard to measures necessary to prevent or remedy an incident, as well as time-limits for the implementation of such measures and for reporting on their implementation, or an order requiring the essential entity concerned to remedy the deficiencies identified or the infringements of this order;

(c) order the essential entity concerned to cease conduct that infringes this order and desist from repeating that conduct;

(d) order the essential entity concerned to ensure that their cybersecurity risk-management measures comply with article 19 and, or to fulfil the reporting obligations established in article 20, in a specified manner and within a specified period;

(e) order the essential entity concerned to inform the natural or juridical persons with regard to which they provide services or carry out activities which are potentially affected by a significant cyber threat, of the nature of the threat, as well as of any possible protective or remedial measures which can be taken by those natural or juridical persons in response to such threat;

(f) order the essential entity concerned to implement CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

the recommendations provided as a result of a security audit within a reasonable deadline;

(g) designate a monitoring officer with well-defined tasks for a determined period of time to oversee the compliance of the essential entity concerned with articles 19 and 20;

(h) order the essential entity concerned to make public aspects of infringements of this order in a specified manner;

(i) order the essential entity concerned to receive CSIRT monitoring services in accordance with article 19(1)(d);

(j) order the essential entity concerned to register under the national self-registration mechanism in article 7(3);

(k) any other enforcement measure which the CIP Department, or where designated the competent authority, shall consider necessary in accordance with its powers at law.

(7) In addition to the enforcement measures in sub-article (6)(a) to (k), the CIP Department, or where designated the competent authority, may request the imposition of an administrative penalty by the Committee, in accordance with national law pursuant to article 33.

(8) The CIP Department, or where designated the competent authority, may impose the measures contained in this article on essential entities periodically.

(9) The CIP Department, or where designated the competent authority, shall inform the competent authority established in accordance with Directive (EU) 2022/2557 when exercising supervisory and enforcement powers aiming to ensure compliance of an essential entity identified as a critical entity in accordance with the said Directive:

Provided that, where required, such essential entity may request the CIP Department, or where designated the competent authority, to exercise supervisory and enforcement powers in relation to an essential entity that is identified as a critical entity in accordance with Directive (EU) 2022/2557.