S.L. 460.43 Art. 18Incident notification. 23 24 [S.L.    Cap. 50.      Cap. 586.

(1) The CIP Department or the designated competent authorities shall ensure that the critical entities notify the competent authorities, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services. The CIP Department or the designated competent authorities shall ensure that, unless operationally unable to do so, critical entities submit an initial notification not later than twenty-four (24) hours after becoming aware of an incident, followed where relevant, by a detailed report not later than one (1) month thereafter. To determine the significance of a disruption, the following parameters shall be considered:

(a) the number and proportion of users affected by the disruption;

(b) the duration of the disruption;

(c) the geographical area affected by the disruption, considering whether the area is geographically isolated;

(d) the sectors affected by the disruption of the essential service;

(e) the dependency of a critical entity, essential entities, important entity on the disruption of the essential services:

Provided that the management bodies of critical entities shall submit to the CIP Department and the designated competent authorities, a more detailed report within seventy-two (72) hours after becoming aware of such incident. Such report shall include the current mitigation measures that the critical entities are implementing. Within one (1) month from the incident the critical entities shall provide a final report of the incident that includes the suspected root cause of the incident:

Provided further that where an incident has or might have a significant impact on the continuity of the provision of essential services to or in six (6) or more Member States, the CIP Department shall notify the Commission of such incident.

(2) Notifications referred to in sub-article (1) shall include any available information necessary to enable the designated competent authorities to understand the nature, cause, and consequences of the incident, including any available information necessary to determine any cross-border impact of the incident. Such notifications shall not subject critical entities to increased liability.

(3) On the basis of the information provided by a critical entity by means of a notification referred to in sub-article (1), the CIP Department, shall inform the single point of contact of other affected Member States where the incident has, or might have a significant impact on critical entities and the continuity of the provision of essential services to, or in one or more other Member States: INFRASTRUCTURES (IDENTIFICATION, 460.43 DESIGNATION AND PROTECTION)

Provided that the CIP Department in sending and receiving information in accordance with sub-article (1) shall, in conformity with Union Law or with the Official Secrets Act, treat that information in a way that respects its confidentiality and protects the security and commercial interest of the critical entity concerned.

(4) As soon as possible following a notification in accordance with sub-article (1), the competent authorities concerned shall provide the critical entity concerned with relevant follow-up information, including information that may support such critical entity’s effective response to the incident in question. The CIP Department or the designated competent authorities shall inform the public where they determine that it is in the public interest to do so.

(5) When addressing incidents resulting in personal data breaches, the CIP Department, or the designated competent authorities, shall work in close cooperation with the Information and Data

Protection Commissioner, in accordance with the Data Protection Act and relevant subsidiary legislation, without prejudice to the competence and tasks of the Commissioner under the said legislation.