S.L. 460.24 Art. 10Sensitive critical infrastructure protection-related information. ECI pursuant be applied in article 2 shall methods for criteria set the availability be taken into in article 2 steps of this the next service, the or both shall be be applied to account - availability of shall not be

(1) Any person handling classified information pursuant to this Order on behalf of the Department or the Government of

Malta shall have an appropriate level of security vetting to be determined by the Department.

(2) The Department shall ensure that sensitive critical infrastructure protection-related information submitted to it is not used for any purpose other than the protection of critical infrastructures.

(3) The provisions of this article shall also apply to non-written information exchanged during meetings at which sensitive subjects are discussed. (IDENTIFICATION, DESIGNATION AND PROTECTION) [

SCHEDULE [Article 4]

Procedure for the identification of critical infrastructures which may be designated as an ECI.

In identifying critical infrastructures which may be designated as an to article 4, the Department shall apply the following consecutive steps:

(1) In Step 1, the sectoral criteria referred to in article 4(7) shall order to make a first selection of critical infrastructures within each sector.

(2) In Step 2, the definition of the term "critical infrastructure" in be applied to the potential ECI identified under Step 1. The significance of the impact shall be determined by using national identifying critical infrastructures or with reference to the cross-cutting out in article 4(2). For infrastructure providing an essential service, of alternatives and the duration of disruption or recovery or both shall account.

(3) In Step 3, the trans-boundary element of the definition of "ECI" shall be applied to the potential ECI that has passed the first two procedure. A potential ECI which does satisfy the definition shall follow step of the procedure. For infrastructure providing an essential availability of alternatives and the duration of disruption or recovery taken into account.

(4) In Step 4, the cross-cutting criteria set out in article 4(2) shall the remaining potential ECIs. Such cross-cutting criteria shall take into

(a) the severity of impact;

(b) for infrastructure providing an essential service, the alternatives; and

(c) the duration of disruption or recovery or both. A potential ECI which does not satisfy the cross-cutting criteria considered to be an ECI.