S.L. 460.41 Art. 7Critical Infrastructure Protection Department. 

(1) The CIP Department shall be the national supervisory authority responsible for monitoring the implementation of this order at national level and ensuring compliance therewith, implementing relevant provisions of this order and covering the sectors, sub-sectors and types of entities listed in the tables to the First and Second Schedules:

Provided that as the national supervisory authority the CIP Department shall be responsible for:

(a) establishing the criteria for the identification and designation of essential and important entities;

(b) building partnerships with operators of critical information infrastructures for information sharing, without prejudice to article 26;

(c) establishing a national self-registration mechanism for essential and important entities providing services in Malta, the CSIRTs providing monitoring services within such entities as well as entities providing domain name CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

registration services in Malta, which shall provide information in accordance with article 24(1);

(d) establishing a register on the basis of paragraph (h) and reviewing and, where appropriate, updating such register on a regular basis and at least every two (2) years;

(e) adopting the strategy on the security of network and information systems, as detailed in the National Cybersecurity Strategy in accordance with article 15;

(f) supervising and enforcing measures on all CSIRTs in accordance with articles 29 and 30;

(g) managing an internal cybersecurity operations center and an internal CSIRT;

(h) acting as a coordinator for the purposes of the coordinated vulnerability disclosure in accordance with article 13(1); and

(i) ensuring effective, efficient and secure cooperation in the Cooperation Group.

(2) The First and Second Schedules designate the competent authorities for each sectors or sub-sectors and clearly establish the tasks of each competent authorities concerned. The designated competent authorities shall cooperate effectively, under the supervision of the CIP Department as the national supervisory authority, to fulfil their tasks under this order. The designated competent authorities shall make available to the CIP Department all information and documents required for the Department to ensure compliance with this Order.

(3) Unless otherwise expressly provided in this order or any other law, and unless another designated competent authority is responsible for the sector, sub-sector or type of entity in the First or Second Schedule, the CIP Department shall be responsible for:

(a) identifying and designating essential and important entities;

(b) identifying the services provided by essential and important entities;

(c) ensuring that risk assessments are carried out by essential and important entities;

(d) ensuring that operator security plans and business continuity plans are drawn up and maintained by essential and important entities;

(e) instigating simulated runs of operator security plans and business continuity plans by essential and important entities;

(f) monitoring cybersecurity risk-management measures undertaken by essential and important entities in accordance with article 19;

(g) monitoring reporting obligations undertaken by essential and important entities in accordance with article 20; and

(h) supervising and enforcing measures on essential and important entities, and on all CSIRTs in accordance with articles 29 and 30:

Provided that the CIP Department shall be deemed as duly authorised in the carrying out of any of the above measures in accordance with article 337C(2) of the Criminal Code:

Provided further that in accordance with Article 47(1) of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/ 1011, the Malta Financial Services Authority may participate in the activities of the Cooperation Group for matters that concern its supervisory activities in relation to financial entities:

Provided further that the Malta Financial Services Authority may request the CIP Department to participate in the activities of the Cooperation Group for matters pertaining to essential or important entities, subject to such entities having been designated in accordance with this order as critical ICT third-party service providers in accordance with Article 31 of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/ 2014, (EU) No 909/2014 and (EU) 2016/1011:

Provided further that the CIP Department shall exercise a liaison function as a single point of contact in accordance with this order, to ensure cross-border cooperation of Maltese authorities with the relevant authorities of other Member States and, where appropriate, with the European Commission and ENISA, as well as to ensure cross-sectoral cooperation with other competent authorities within Malta:

Provided further that the national CSIRT shall have CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

access to the register as defined in article 7(1)(d) as maintained and updated by the CIP Department.

(4) Essential and important entities providing services in Malta as well as entities providing domain name registration services in Malta shall register on the national self-registration mechanism established by the CIP Department in accordance with sub-article 3(h), and shall provide at least the following information:

(a) the name of the entity;

(b) the name of the CSIRT providing monitoring services to the entity and whether it is an internal or autonomous CSIRT;

(c) the address and up-to-date contact details, including email addresses, IP ranges and telephone numbers;

(d) where applicable, the relevant sector and sub-sector listed in the First or Second Schedule; and

(e) where applicable, a list of the Member States where they provide services falling within the scope of this order.

(5) The essential or important entities shall notify the CIP Department about any changes to the details submitted in accordance with sub-article (4) without delay and, in any event, within two (2) weeks of the date of the change.

(6) The CIP Department shall also perform such related and consequential duties as the Minister may delegate from time to time.

(7) The Director General or his delegate shall represent the CIP Department in any judicial proceedings.