S.L. 460.35 Art. 12Implementation and enforcement.

(1) The Minister shall ensure that the CIIP Unit has the necessary powers and means to assess the compliance of operators of essential services with their obligations under article 11 and the effects thereof on the security of network and information systems.

(2) Upon the request of the CIIP Unit, operators of essential services shall without undue delay provide:

(a) the information necessary to assess the security of their network and information systems, including documented security policies;

(b) evidence of the effective implementation of security policies, such as the results of a security audit carried out by the CIIP Unit or a qualified auditor and, in the latter case to make the results thereof, including the underlying evidence, available to the CIIP Unit.

When requesting such information, the CIIP Unit shall state the purpose of the request and specify what information is needed.

(3) Following the assessment of information, evidence or results of security audits referred to in sub-article (2), the CIIP Unit may issue binding instructions to the operators of essential service to remedy the deficiencies identified.

(4) The CIIP Unit shall work in close cooperation with the Data Protection Commissioner when addressing incidents resulting in personal data breaches.