S.L. 460.43 Art. 23Supervisory measures in relation to critical entities. 28 [S.L.

(1) The CIP Department or the competent authorities shall ensure that critical entities establish, update and implement a resilience plan or equivalent documents. The approved resilience plan or equivalent documents shall be monitored and regularly audited by the CIP Department or the competent authorities.

(2) The CIP Department or the competent authorities shall, after carrying out an audit or other compliance monitoring activity on a critical entity, draw up a report stating the findings.

(3) The CIP Department or the competent authorities shall classify these findings into one of the following four (4) categories:

(a) fully compliant;

(b) compliant but improvement desired; INFRASTRUCTURES (IDENTIFICATION, 460.43 DESIGNATION AND PROTECTION)

(c) not compliant; or

(d) not compliant with serious breaches.

(4) The CIP Department or the competent authorities shall give reasons for the decision to classify the findings as such. The report shall be communicated to the critical entity. Failure by critical entities to submit a resilience plan or equivalent documents for approval by the designated competent authorities shall be classified by the CIP Department or the competent authorities as being "not compliant with serious breaches".

(5) If the findings are classified by the CIP Department or the competent authorities as being "not complaint" or "not compliant with serious breaches" the critical entity shall, within two (2) weeks from receipt of the report, submit an action plan wherein there shall be indicated the corrective actions which are to be taken by the critical entity to address the breaches, including the deadlines when such breaches shall be fully rectified.

(6) The CIP Department or the competent authorities shall examine the action plan and may either approve it or direct the critical entity concerned to make the necessary amendments within a stipulated period of time. The implementation of the action plan shall be monitored by the CIP Department or the competent authorities.

(7) If a critical entity fails to submit an action plan, fails to amend the action plan as necessary or fails to comply with the approved action plan, the CIP Department or the competent authorities may, depending on the severity and the particular circumstances of the case:

(a) give advice or make recommendations to the critical entity in order to explain the need to rectify the breaches identified during the compliance monitoring activities;

(b) issue a formal warning whereby the critical entity is directed to immediately rectify its breaches; and, or

(c) report the breaches to the Committee:

Provided that the CIP Department or the competent authorities shall inform the critical entity that failure to rectify its breaches may lead to the imposition of administrative penalties in accordance with this order.