S.L. 460.35 Art. 11Security requirements and incident notification.    Cap. 399.

(1) The CIIP shall ensure that operators of Unit essential services:

(a) take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which they use in their operations. Having regard to the state of the art, those measures shall ensure a level of security of network and information systems appropriate to the risk posed;

(b) take appropriate measures to prevent and minimise the impact of incidents affecting the security of the network and information systems used for the provision of such essential services, with a view to ensuring the continuity of those services; and

(c) appoint a security liaison officer who shall have the necessary expertise and who shall:

(i) facilitate the development, implementation, maintenance and review of an operator of essential services preparedness, processes and solutions;

(ii) ensure that an operator of essentials services conducts and maintains appropriate risk assessments;

(iii) ensure that the operator of essential services maintains and exercises an operator security plan; and

(iv) act as the point of contact for security related issues for ensuring the fulfilment of the obligations laid down in this order between the operator of essential services and the Critical Information Infrastructure Protection (CIIP) Unit.

(2) Operators of essential services shall notify the CIIP Unit, without undue delay, of incidents having a significant impact on the continuity of the essential services they provide. Notifications shall include information enabling the CIIP Unit to determine, any local or cross-border impact of the incident. Notification shall not make the notifying party subject to increased liability.

(3) In order to determine the significance of the impact of an incident, the following parameters in particular shall be taken into account:

(a) the number of users affected by the disruption of essential service;

(b) the duration of the incident;

(c) the geographical spread with regard to the area affected by the incident;

(d) the sectors affected by the disruption of essential service;

(e) the dependency of a critical infrastructure, critical information infrastructure, or both, on the disruption of essential services.

(4) On the basis of the information provided in the notification by the operator of essential services, the CIIP Unit shall, inform the other affected Member States if the incident has a significant impact on the continuity of essential services in that Member State. In so doing, the CIIP Unit, in accordance with law, shall preserve the security and commercial interests of the operator of essential services, as well as the confidentiality of the information provided in its notification.

Where the circumstances allow, the CIIP Unit shall provide the notifying operator of essential services with relevant information regarding the follow-up of its notification, such as information that could support the effective incident handling.

The CIIP Unit shall forward notifications as referred to in the first paragraph to single points of contact of other affected Member States.

(5) Where a designated operator of essential services provides a service to an undertaking providing electronic communications networks and, or services in terms of the Electronic Communications (Regulation) Act, any security breach affecting such operator of essential services shall also be notified by the relevant CSIRT to the Malta Communications Authority:

Provided that in this context, in exercising their regulatory oversight, the CIIP Unit and the Malta Communications Authority shall consult each other and each shall give due consideration to any advice that the other may give.

(6) After consulting the notifying operator of essential services, the CIIP Unit may inform the public about individual incidents, where public awareness is necessary in order to prevent an incident or to deal with an ongoing incident.

(7) Any operator of essential services which fails to comply with the obligations of this article shall be liable to an administrative OF NETWORK AND INFORMATION SYSTEMS

fine in accordance with the procedure under article 19.