S.L. 460.43 Art. 13Resilience measuresofcritical entities. 18 [S.L.

(1) The CIP Department, or the designated competent authorities, shall ensure that critical entities take appropriate and proportionate technical, security and organisational measures to ensure their resilience, based on the relevant information provided by Malta on the National Risk Assessment and on the outcomes of the critical entity risk assessment, including measures necessary to:

(a) prevent incidents from occurring, duly considering disaster risk reduction and climate adaptation measures;

(b) ensure adequate physical protection of their premises and critical infrastructure, duly considering, for example, fencing, barriers, perimeter monitoring tools and routines, detection equipment and access controls;

(c) respond to, resist, and mitigate the consequences of incidents, duly considering the implementation of risk and crisis management procedures and protocols and alert routines;

(d) recover from incidents, duly considering business continuity measures and the identification of alternative supply chains, to ensure the continuity of the provision of the essential service;

(e) ensure adequate employee security management, duly considering measures including establishing categories of personnel who exercise critical functions, establishing access rights to premises, critical infrastructure and sensitive information, the establishment of procedures for background checks in accordance with article 15 and designating the categories of persons who are required to undergo such background checks, and establishing appropriate training requirements and qualifications:

Provided that for the purposes of this paragraph, the CIP Department, or designated competent authorities shall ensure that critical entities consider the personnel of external service providers when establishing categories of personnel who exercise critical functions. INFRASTRUCTURES (IDENTIFICATION, 460.43 DESIGNATION AND PROTECTION)

(f) raise awareness about the measures referred to in paragraphs (a) to (e) among relevant personnel, duly considering training courses, information materials and exercises:

(2) Critical entities shall develop and keep updated a resilience plan or equivalent documents which describe the measures taken pursuant to sub-article (1). The plan or equivalent documents shall include internal quality control measures describing how compliance with the plan is to be monitored by the critical entities. The plan or equivalent documents shall be submitted to the designated competent authorities, which may either approve it or direct the critical entity to make any necessary amendments. Once approved by the designated competent authorities, the entities shall ensure that all measures described in the plan are fully implemented. A copy of the plan with the approval letter from the designated competent authorities shall be submitted to the CIP Department by the critical entities:

Provided that where critical entities have drawn up documents or taken measures pursuant to obligations established in other legal acts that are relevant for the measures referred to in sub-article (1), they may use those documents and measures to satisfy the requirements established in this article. When exercising its supervisory functions, the competent authorities may declare existing resilience-enhancing measures taken by a critical entity that address, in an appropriate and proportionate manner, the technical, security and organisational measures referred to in sub-article (1) as compliant, in whole or in part, with the obligations under this article.

(3) Critical entities shall designate at least one (1) security liaison officer (SLO) or the equivalent and inform the CIP Department and the designated competent authorities. The security liaison officer

(SLO) or the equivalent shall act as the point of contact with the CIP Department and the designated competent authorities. The security liaison officer shall ensure that the measures described in the resilience plan or equivalent documents are fully implemented. The security liaison officer shall ensure that internal quality control activities are conducted so to ensure compliance with the resilience plan or equivalent documents.