S.L. 460.43 ст. 21General aspects concerning supervision and enforcement. 26 [S.L.      S.L. 460.41. 27

(1) In order to assess the compliance of the entities identified as critical entities pursuant with the obligations established in this order, the CIP Department or the designated competent authorities shall have the powers and means to:

(a) conduct on-site inspections of the critical infrastructure and the premises that the critical entity uses to provide its essential services and off-site supervision of measures taken by critical entities in accordance with article 13 of this order;

(b) conduct or order audits in respect of critical entities.

(2) The CIP Department and the competent authorities shall have the powers and means to require, critical entities to provide within a reasonable time limit established by the CIP Department or the competent authorities: INFRASTRUCTURES (IDENTIFICATION, 460.43 DESIGNATION AND PROTECTION)

(a) the information necessary to assess whether the measures taken by those entities to ensure their resilience satisfy the requirements established in article 13 of this order;

(b) evidence of the effective implementation of those measures, including the results of internal quality control activities. Internal quality control activities may include an audit conducted by an independent and qualified auditor selected by the respective critical entity and conducted at its expense;

(c) access to other data, documents and information necessary for the CIP Department, or the designated competent authorities, to carry out their supervisory tasks;

(d) a resilience plan or equivalent documents:

Provided that when requiring such information, the CIP Department or the competent authorities shall state the purpose of the requirement and specify the information required.

(3) Without prejudice to the possibility to impose administrative penalties, the CIP Department or the competent authorities may, following the supervisory actions referred to in sub-article (1) or the assessment of the information referred to in sub-article (2), order the critical entities concerned to take the necessary and proportionate measures to remedy any identified breach of this order, within a reasonable time limit established by those authorities and to provide those authorities with information on the measures taken. Those orders shall take into account, in particular, the seriousness of the breaches.

(4) The CIP Department or the competent authorities shall ensure that the powers provided for in this article may only be exercised subject to appropriate safeguards. Those safeguards shall guarantee, in particular, that such exercise takes place in an objective, transparent and proportionate manner and that the rights and legitimate interests of the critical entities affected, such as the protection of trade and business secrets, are duly safeguarded, including the right to be heard, the right of defence and the right to an effective remedy before an independent court.

(5) The CIP Department or the competent authorities shall, when assessing the compliance of a critical entity pursuant to this article, inform the competent authorities of the Member States concerned under Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order. The CIP Department or the competent authorities shall ensure that competent authorities in accordance with this order, may request the competent authorities under the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, to exercise their supervisory and enforcement powers in relation to an entity under that order that has been identified as a critical entity under this order. The CIP Department or the competent authorities shall cooperate and exchange information with the competent authorities under the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order.