S.L. 460.43 Art. 7Identification of critical entities. 13    S.L. 460.41.

(1) The competent authorities shall identify the critical entities in the sectors and sub-sectors established in the Schedule, that fall under their responsibility.

(2) When the competent authorities identify critical entities pursuant to sub-article (1), they shall take into account the outcomes of the risk assessments and the strategy referred to in articles 5 and 6 and shall apply the following criteria:

(a) the entity provides one (1) or more essential services;

(b) the entity operates and its critical infrastructure is located on the territory of Malta; and

(c) an incident would have significant disruptive effects, as determined in accordance with sub-article (1) of article 8, on the provision by the entity of one (1) or more essential services or on the provision of other essential services in the sectors established in the Schedule that depend on that or those essential services.

(3) The competent authorities shall establish a list of the critical entities identified pursuant to sub-articles (1) and (2) and ensure that those critical entities are notified that they have been identified as critical entities within one (1) month of such identification. When notifying the critical entities, the designated competent authorities shall also notify the CIP Department. This Department shall maintain a national list of critical entities identified by the competent authorities:

Provided that the designated competent authorities shall inform those critical entities of their obligations under Parts III, IV and V and the date from which those obligations apply to them, without prejudice to article 8. The CIP Department or the designated competent authorities of this order shall inform critical entities in the sectors established in the Schedule that they have no obligations under Parts III, IV, and V unless national measures provide otherwise. When notifying the critical entities, the designed competent authorities shall also notify the CIP Department:

Provided further that for the critical entities concerned, Part III shall apply after ten (10) months from the date of the notification referred to in the first paragraph of this article.

(4) The CIP Department or the designated competent authorities shall notify the competent authorities designated in accordance with article 7 of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order of the identity of the critical entities that they have identified in accordance with this article within one (1) month of such identification. Such notification shall specify, where applicable, that the critical entities concerned are entities in the sectors established in the Schedule and have no obligations in accordance with Parts III, IV and V. When notifying the designated competent authorities in accordance with the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, of the identity of the critical entities, the designated competent authorities shall also notify the CIP Department.

(5) The competent authorities shall, where necessary and in any event at least every four (4) years review and where appropriate, update the list of identified critical entities referred to in sub-article (3). Where those updates lead to the identification of additional critical entities, sub-articles (3) and (4) shall apply to those additional critical entities. In addition, they shall ensure that entities that are no longer identified as critical entities following any such update are notified in due time of the fact that they are no longer subject to the obligations under Parts III, IV and V from the date of receipt of such notification. When notifying additional critical entities or when notifying critical entities that are no longer identified as critical entities, the competent authorities shall also notify the CIP Department that shall update the national list of critical entities.