S.L. 460.41 Art. 30Supervisory and enforcement measures in relation to important entities. 

(1) When provided with evidence, indication or information that an important entity allegedly does not comply with this order, in particular articles 19 and, or 20, the CIP Department, or where designated the competent authority, shall take action, where necessary, through supervisory measures. Such measures shall ex post be effective, proportionate and dissuasive, taking into account the circumstances of each individual case:

Provided that the implementation of such supervisory tasks and, or enforcement measures shall be without prejudice to article 3(16).

(2) When exercising their supervisory tasks in relation to important entities, the CIP Department, or where designated the competent authority, shall have the power to subject such entities at least to the following supervisory measures:

(a) on-site inspections and off-site supervision ex post conducted by trained professionals;

(b) targeted security audits carried out by an independent body or the CIP Department, or where designated the competent authority;

(c) security scans based on objective, non-discriminatory, fair and transparent risk assessment criteria, where necessary with the cooperation of the essential entity concerned;

(d) requests for information necessary to assess, ex the cybersecurity risk-management measures adopted by post, the essential entity concerned, including documented cybersecurity policies, as well as compliance with the obligation to submit information to the CIP Department, or where designated the competent authority, pursuant to article 24;

(e) requests to access data, documents and information necessary to carry out their supervisory tasks;

(f) requests for evidence of implementation of cybersecurity policies, such as the results of security audits carried out by a qualified auditor and the respective underlying evidence;

(g) requests for evidence of CSIRT monitoring services in accordance with article 19(1)(d);

(h) requests for evidence of compliance with policies issued by the CIP Department, or where designated the competent authority, by the CSIRT providing monitoring services to the important entity;

(i) requests for evidence of operator security plans, business continuity plans and where necessary termination plans;

(j) any other supervisory measures which the CIP CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

Department, or where designated the competent authority considers necessary in accordance with its powers at law.

(3) The targeted security audits provided for in sub-article (2)(b), shall be based on risk assessments conducted by the CIP Department or the audited entity, or on other risk-related available information.

(4) The results of any targeted security audit shall be made available to the CIP Department, or where designated the competent authority. The costs of such targeted security audit carried out by an independent body shall be paid by the audited essential entity, except in duly substantiated cases when the CIP Department, or where designated the competent authority shall decide otherwise.

(5) When exercising its powers in accordance with sub-articles (2)(d) to (f), the CIP Department, or where designated the competent authority, shall state the purpose of the request and specify the information requested.

(6) When exercising enforcement powers in relation to important entities, the CIP Department, or where designated the competent authority, shall have the power to take any or all of the following measures:

(a) issue warnings about infringements of this order by the important entity concerned including the failure to cooperate or comply with the supervisory measures under sub-article (2);

(b) adopt binding instructions, including with regard to measures necessary to prevent or remedy an incident, as well as time-limits for the implementation of such measures and for the reporting of the implementation, or an order requiring the essential entity concerned to remedy the deficiencies identified or the infringements of this order;

(c) order the important entity concerned to cease conduct that infringes this order and desist from repeating such conduct;

(d) order the important entity concerned to ensure that its cybersecurity risk-management measures comply with article 19 and, or to fulfil the reporting obligations established in article 20, in a specified manner and within a specified period;

(e) order the important entity concerned to inform the natural or juridical persons with regard to which they provide services or carry out activities which are potentially affected by a significant cyber threat, of the nature of the threat, as well as of any possible protective or remedial measures which can be taken by those persons in response to such threat;

(f) order the important entity concerned to implement the recommendations provided as a result of a security audit within a reasonable deadline;

(g) order the important entity concerned to make public aspects of infringements of this order in a specified manner;

(h) order the important entity concerned to receive CSIRT monitoring services in accordance with article 19(1)(d);

(i) order the important entity concerned to register itself under the national self-registration mechanism in accordance with article 7(3); and, or

(j) any other enforcement measures which the CIP Department, or where designated the competent authority considers necessary in accordance with their powers at law.

(7) In addition to the enforcement measures in sub-article (6)(a) to (j), the CIP Department, or where designated the competent authority, may request the imposition of an administrative penalty by the Committee, in accordance with national law pursuant to article 33.