S.L. 460.35 Art. 23Decisions of the Tribunal.

In determining an appeal the Tribunal shall take into account the merits of the appeal, and may in whole or in part, confirm or annul the decision appealed from, giving in writing the reasons for its decision and shall cause such decision to be made public and communicated to the parties to the appeal. OF NETWORK AND INFORMATION SYSTEMS

FIRST SCHEDULE

REQUIREMENTS AND TASKS OF COMPUTER SECURITY INCIDENT RESPONSE TEAMS (CSIRTs)

The requirements and tasks of CSIRTs shall be adequately and clearly defined and supported by national policy and, or regulation. Such requirements and tasks shall include the following:

(1) Requirements for all CSIRTs:

(a) CSIRTs shall ensure a high level of availability of their communications services by avoiding single points of failure and shall have several means for being contacted and for contacting others at all times. Furthermore, the communication channels shall be clearly specified and well known to the constituency and cooperative partners.

(b) CSIRTs' premises and the supporting information systems shall be located in secure sites.

(c) Operator Security and Business continuity:

(i) CSIRTs shall be equipped with an appropriate system for managing and routing requests, in order to facilitate handovers.

(ii) CSIRTs shall be adequately staffed with computer security incident response officers (CSIROs) to ensure availability at all times.

(iii) CSIRTs shall rely on an infrastructure the continuity of which is ensured. To that end, redundant systems and backup working space shall be available.

(d) CSIRTs shall have the possibility to participate, where they wish to do so, in local, international cooperation networks or both.

(2) CSIRTMalta’s tasks:

(a) CSIRTMalta tasks shall include at least the following:

(i) monitoring incidents at a national level;

(ii) providing early warning, alerts, announcements and dissemination of information to relevant stakeholders about risks and incidents;

(iii) Coordinating and responding to incidents providing the necessary support and advice to constituents;

(iv) providing dynamic risk and incident analysis and situational awareness;

(v) participating in the CSIRTs network and in the European Cooperation Group to ensure the effective, efficient and secure cooperation at the European level;

(b) CSIRTMalta shall establish cooperation relationships with the public and private sector;

(c) To facilitate cooperation, CSIRTMalta shall promote the adoption and use of common or standardised practices for:

(i) incident and risk-handling procedures;

(ii) incident, risk and information classification schemes.

(3) CSIRTs' tasks:

(a) CSIRTs' tasks shall include at least the following:

(i) monitoring incidents of assets, systems, or networks;

(ii) providing early warning, alerts, announcements and dissemination of information to relevant stakeholders about risks and incidents;

(iii) responding to incidents;

(iv) providing dynamic risk and incident analysis and situational awareness. OF NETWORK AND INFORMATION SYSTEMS

SECOND SCHEDULE

TYPES OF ENTITIES FOR THE PURPOSES OF THE INTERPRETATION OF "OPERATOR OF ESSENTIAL SERVICES" UNDER ARTICLE 2

Sector Subsector Type of entity