S.L. 460.43 Art. 3Competent authorities and the single point of contact.          S.L. 460.41. 7    S.L. 460.41.

(1) The CIP Department, shall be the national supervisory authority responsible for the monitoring and the application of this order at national level and ensuring compliance therewith, implementing relevant provisions of this order and covering the sectors, sub-sectors and categories of entities found in the Schedule.

(2) The CIP Department shall be designated as the single point of contact to exercise a liaison function for the purpose of ensuring cross-border cooperation with the single points of contact of other Member States and the Critical Entities Resilience Group established in Article 19 of Directive (EU) 2022/2557. The CIP Department shall also act as the single point of contact to exercise a liaison function with the Commission and ensure cooperation with third countries.

(3) With regard to the critical entities in the sectors established in items 3 and 4 of the Schedule, the competent authorities shall in principle, be the competent authorities referred to in Article 46

of Regulation (EU) 2022/2554. With regard to the critical entities in the sector established in the Schedule, the competent authorities shall in principle, be the competent authorities under the Measures for a High

Common Level of Cybersecurity across the European Union (Malta) Order.

(4) The Schedule designates the competent authorities for each sectors or sub-sectors and clearly establishes the tasks of each competent authorities concerned. The designated competent authorities shall cooperate effectively, under the supervision of the CIP Department as the national supervisory authority, to fulfil their tasks in accordance with this order. The designated competent authorities shall make available to the CIP Department all information and documents required for the CIP Department to ensure compliance with this order.

(5) The CIP Department shall submit, every two (2) years, a summary report to the Commission and to the Critical Entities Resilience Group, on the notifications it has received, including the number of notifications, the nature of notified incidents and the actions taken in accordance with article 22(3).

(6) The CIP Department, or the designated competent authorities, shall have the powers and the adequate financial, human and technical resources to carry out, in an effective and efficient manner, the tasks assigned to them.

(7) The CIP Department and the competent authorities referred to in the Schedule shall, whenever appropriate, consult and cooperate with other relevant national authorities, including the Police, the Armed Forces of Malta, the Information and Data Protection Commissioner, the Department of Civil Protection, and with critical entities and relevant interested parties.

(8) The designated competent authorities listed in the

Schedule shall cooperate and exchange information with designated competent authorities under article 8 of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order on cybersecurity risks, cyber threats and cyber incidents and non-cyber risks, threats and incidents affecting critical entities, including with regard to relevant measures its designated competent authorities and designated competent authorities under article 7 of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order have taken.

(9) Within three (3) months of the designation or establishment of the competent authorities in accordance with this article, their identity, tasks, responsibilities, contact details, and any subsequent changes in that regard shall be communicated to the Commission in accordance with this order.