S.L. 460.43 Art. 24Enforcement measures in relation to critical entities. 29

(1) The Critical Entities Resilience Committee shall have the power to impose administrative penalties on any critical entity reported by the CIP Department or the competent authorities, as being non-compliant with the approved resilience plan or equivalent documents.

(2) Prior to deciding on whether critical entities, are compliant with the approved resilience plan or equivalent documents or otherwise, the Committee shall allow the critical entity concerned to provide documentation or make submissions as it deems fit.

(3) The Committee may, if it deems necessary, request more information or documentation from the CIP Department or the competent authorities or from the critical entity concerned.

(4) The Committee shall give reasons for its decision.

(5) Whenever the Committee finds that a critical entity has not complied with the approved resilience plan or equivalent documents and has not taken the necessary measures to remedy the breaches, it shall impose an administrative penalty. If the findings are classified by the CIP Department or the competent authorities as being "not complaint" the administrative penalty shall be of two thousand five hundred euro (€2,500). If the findings are classified by the CIP Department or the competent authorities as being "not compliant with serious breaches" the administrative penalty shall be of five thousand euro (€5,000).

(6) In its decision, the Committee shall provide a time-frame within which the critical entity, shall pay the administrative penalty and a time-frame within which the critical entity is to remedy its breaches:

Provided that if the critical entity does not pay the administrative penalty and, or does not remedy its breaches within the stipulated time-frame, the Committee shall impose a further administrative penalty equal to the administrative penalty originally imposed and, or a penalty of one hundred euro (€100) for each day during which the deficiency subsists. Any daily penalty imposed, may be backdated to the date of the commission or commencement of the breach.