S.L. 460.41 ст. 13Coordinated vulnerability disclosure. 

(1) The CIP Department shall be designated as coordinator for the purposes of coordinated vulnerability disclosure under this order:

Provided that the CIP Department shall immediately notify in writing to the national CSIRT any vulnerabilities reported to it. The CIP Department shall immediately notify in writing any other designated competent authority or authorities, as the case may be, of any vulnerabilities reported to it that has a significant impact on the provision of the services provided by an essential or important entity which such authority regulates. CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

(2) The CIP Department shall act as a trusted intermediary and facilitating, where necessary, the interaction between the reporting natural or legal person and the entity making use of the potentially vulnerable ICT products, ICT processes or ICT services, upon the request of either party.

(3) The tasks of the CIP Department designated as coordinator for vulnerability disclosure shall include:

(a) the adoption of common or standardised practices, classification schemes and taxonomies;

(b) identifying and contacting the entities concerned;

(c) providing assistance to the natural or legal persons reporting a vulnerability;

(d) negotiating disclosure timelines and managing vulnerabilities that affect multiple entities; and

(e) establishing and maintaining a register of coordinated vulnerability disclosure policies.

(4) Any person shall be able to report, anonymously, a vulnerability to the CIP Department. The CIP Department shall ensure the anonymity and confidentiality of the persons throughout the vulnerability disclosure.

(5) The CIP Department shall ensure that diligent follow-up action is carried out with regard to the reported vulnerability.

(6) Where a reported vulnerability may have a significant impact on entities in more than one Member State, the national CSIRT shall, where appropriate, cooperate with other CSIRTs designated as coordinators within the CSIRTs network.

(7) For the purposes of coordinated vulnerability disclosure, the reporting natural or legal person shall be deemed to have acted with authorisation in accordance with article 337C of the Criminal Code, insofar as the reporting natural or legal person complies with the coordinated vulnerability disclosure policy of such entity.

(8) The CIP Department shall carry out the technical operations strictly necessary for the characterisation of the risk or threat referred to in this article:

Provided that the CIP Department shall be deemed as duly authorised in the carrying out of this measure in accordance with article 337C(2) of the Criminal Code.