S.L. 460.43 Art. 12Riskassessmentby critical entities.           Cap. 9. 17

(1) Notwithstanding the deadline established in article

7(3), the CIP Department, or the designated competent authorities shall ensure that critical entities carry out a risk assessment within nine (9) months of receiving the notification referred to in article 7(3), whenever necessary subsequently, and at least every four (4) years, on the basis of the national risk assessment and other relevant sources of information, in order to assess all relevant risks that could disrupt the provision of their essential services (critical entity risk assessment).

(2) Critical entity risk assessments shall account for all the relevant natural and human-caused risks which may lead to an incident, including those of a cross-sectoral or cross-border nature, accidents, natural disasters, public health emergencies and hybrid threats and other antagonistic threats, including terrorist offences as provided for under Sub-title IV A of Title IX of Part II of Book First of the Criminal

Code. A critical entity risk assessment shall take into account the extent to which other sectors as established in the Schedule depend on the essential service provided by the critical entity and the extent to which such critical entity depends on essential services provided by other entities in such other sectors, including where relevant in Member States and third countries:

Provided that where a critical entity has carried out other risk assessments or drawn up documents pursuant to obligations established in other legal acts that are relevant for its critical entity risk assessment, it may use those assessments and documents to satisfy the requirements established in this article:

Provided further that when exercising its supervisory functions, the competent authorities may declare an existing risk assessment carried out by a critical entity that addresses the risks and extent of dependence referred to in the first proviso conforms, in whole or in part, with the obligations in accordance with this article.