S.L. 460.41 Art. 8National CSIRT.  Amended: L.N. 89 of 2026. 21

(1) There shall be established a national CSIRT within the Malta Information Technology Agency, which shall comply with the requirements established in sub-article 9(1). It shall be responsible for incident handling in accordance with a well-defined process and shall cover at least the sectors, sub-sectors and types of entities listed in the First and Second Schedule.

(2) The national CSIRT shall:

(a) cooperate and, where appropriate, exchange relevant information in accordance with article 26 with sectoral or cross-sectoral communities of essential and important entities;

(b) participate in peer reviews organised in accordance with article 17; and

(c) act as the national representative to the CSIRT network.

(3) The national CSIRT may establish cooperation relationships with third countries’ national CSIRTs subject to a cooperation agreement. The cooperation agreement shall facilitate effective, efficient and secure information exchange with those third countries’ national CSIRTs, using relevant information-sharing protocols, including the Traffic Light Protocol.

(4) As part of such cooperation relationships, the national CSIRT may:

(a) exchange relevant information with third countries’ national CSIRTs, including personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

(b) cooperate with third countries’ national CSIRTs or equivalent third-country bodies, in particular for the purpose of providing them with cybersecurity assistance.