S.L. 460.43 Art. 5Strategy on the resilience of critical entities. 10 [S.L.      S.L. 460.41.

(1) The CIP Department in cooperation with the competent authorities referred to in the Schedule, shall adopt a national strategy for enhancing the resilience of critical entities hereinafter referred to as the "strategy", The strategy shall be adopted following a consultation, to the extent practically possible, open to relevant stakeholders and shall set out strategic objectives and policy measures, building upon relevant existing national and sectoral strategies, plans or similar documents, with a view to achieving and maintaining a high level of resilience on the part of critical entities and covering at least the sectors set out in the Schedule.

(2) The strategy shall contain at least the following elements:

(a) strategic objectives and priorities for the purposes of enhancing the overall resilience of critical entities, taking into account cross-border and cross-sectoral dependencies and interdependencies;

(b) a governance framework to achieve the strategic objectives and priorities, including a description of the roles and responsibilities of the different authorities, critical entities and other parties involved in the implementation of the strategy;

(c) a description of measures necessary to enhance the overall resilience of critical entities, including a description of the risk assessment referred to in article 6;

(d) a description of the process by which critical entities are identified;

(e) a description of the process supporting critical entities in accordance with this order, including measures to enhance cooperation between the public sector and the private INFRASTRUCTURES (IDENTIFICATION, 460.43 DESIGNATION AND PROTECTION)

sector and public and private entities;

(f) a list of the main authorities and relevant stakeholders, other than critical entities, involved in the implementation of the strategy;

(g) a policy framework for coordination between the

CIP Department and the designated competent authorities in accordance with this order and the designated competent authorities in accordance with article 7 of the Measures for a

High Common Level of Cybersecurity across The European Union (Malta) Order for the purposes of information sharing on cybersecurity risks, cyber threats and cyber incidents and non-cyber risks, threats and incidents and the exercise of supervisory tasks;

(h) a description of measures already in place which aim to facilitate the implementation of obligations in accordance with Part III by small and medium-sized enterprises within the meaning of the Annex to Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises and by small mid-cap enterprises within the meaning of the Annex to Commission Recommendation of 21st May 2025 on the definition of small mid-cap enterprises (2025) 3500 that the Member State in question has identified as critical entities.

(3) Following a consultation that is, to the extent practically possible, open to relevant stakeholders, the CIP Department and the competent authorities listed in the Schedule shall update the strategy at least every four (4) years.

(4) The CIP Department shall communicate the strategy, and substantial updates thereto to the Commission within three (3) months of their adoption.

(5) The strategy, and substantial updates thereto, shall be approved by the Cabinet before the CIP Department communicates the strategy to the Commission and before the strategy may be implemented by the CIP Department and the designated competent authorities.