NIS2 Malta: law, scope, obligations and compliance

What are the NIS2 obligations in Malta?

NIS2 registration in Malta (Art. 24)

Essential and important entities providing services in Malta are required to register with the Critical Infrastructure Protection Department (CIP Department).

The entity must provide the following information via the national self-registration system:

• Name of the organisation;
• Sector and sub-sector;
• The address of the entity’s head office and any other legal establishments within the EU, or, if the entity is not established in the EU, the address of its designated representative;
• Contact details of the entity, including email addresses and telephone numbers, and, where applicable, those of its representative;
• List of EU Member States in which the entity provides services;
• IP address ranges;
• List of the computer, network and operational technology resources used.

Any changes to this information must be reported within 3 months of the change.

NIS2 cybersecurity risk-management measures in Malta (Art. 19)

If your organisation is categorised as an essential or important entity, this means that you are responsible for implementing appropriate technical and organisational measures to ensure the security of your network and information systems:

• Risk analysis and security of information systems
• Incident management
• Business continuity, such as backup management and disaster recovery, and crisis management
• Supply chain security
• Security in network and information systems acquisition, development and maintenance
• Policies and procedures to assess the effectiveness of measures for managing cybersecurity risks
• Cyber hygiene and cybersecurity training
• Policies and procedures relating to cryptography and, where applicable, encryption
• Security aspects relating to personnel, access policies and asset management
• Use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications, and secured emergency communications systems within the organisation, where applicable
• Logging and traceability of network and information systems

Every essential or important entity must appoint a Security Liaison Officer with expertise in cybersecurity, risk management and business continuity. This person coordinates the relevant NIS2 obligations and acts as a point of contact with the CIP Department or the competent sectoral authority.

In Implementing Regulation 2024/2690, the European Commission has set out the above minimum cybersecurity measures for DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplace providers, online search engine providers and social networking service platform providers, and trust service providers.

NIS2 incident reporting in Malta (Art. 20)

Essential and important entities are required to notify the Computer Security Incident Response Team (CSIRT) when a significant incident occurs. In addition, they must also inform the recipients of their services if the significant incident affects the provision of those services.

An incident is considered significant if it

• ‘has caused or is capable of causing severe operational disruption of the service or financial loss for the entity concerned; or
• has affected or is capable of affecting other natural or juridical persons by causing considerable material or non-material damage.’

The significant incident must be reported by the essential or important entity to CSIRT Malta (csirtmalta@gov.mt) in accordance with the following procedure:

1. Immediately and within 24 hours of becoming aware of the significant incident, the entity must submit an early warning, stating the suspected cause and any cross-border implications.
2. Immediately and within 72 hours of becoming aware of the significant incident, the entity must submit an incident report containing an update on the information and an initial assessment of the incident. For providers of regulated trust services, the deadline is 24 hours.
3. Upon request, the entity shall submit an interim report.
4. No later than one month after the incident report, the entity shall submit a final report stating:
   1. A detailed description of the incident, as well as its severity and consequences;
   2. The type of threat or root cause that likely led to the incident;
   3. Applied and ongoing risk mitigation measures;
   4. The cross-border consequences of the incident, if applicable.
5. If the incident is still ongoing one month after the incident report, the entity must submit a progress report, and a final report must be submitted  within one month of the incident being resolved. 

In Implementing Regulation 2024/2690, the European Commission has set out the criteria for a significant incident for DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplace providers, online search engine providers and social networking service platform providers, and trust service providers. These specific rules take precedence over national rules in the event of any conflict.

Finally, all entities, regardless of whether they fall within the scope of the Maltese NIS2 Act, may voluntarily report (significant) incidents, cyber threats and near-misses to the CSIRT.

Management responsibilities under NIS2 in Malta (Art. 18)

The governing bodies of essential and important entities are responsible for compliance with the Maltese NIS2 Act and must fulfil various obligations, including:

• Approving cybersecurity management measures and monitoring compliance with them;
• Undertaking training to acquire sufficient knowledge and skills to identify risks and assess control measures and their impact on their services;
• Providing ongoing training to the entity’s employees in the field of cybersecurity.

The governing bodies are liable in the event of non-compliance with the Maltese NIS2 Act.

Cooperation with Maltese NIS2 authorities

Essential and important entities must cooperate with the national authorities. This involves exchanging information on the security of network and information systems, reporting incidents, cooperating with the inspection service, and so on.