S.L. 460.41 Art. 15National cybersecurity strategy. 

(1) The National Cyber Security Steering Committee shall oversee the national cybersecurity strategy which established the strategic objectives, the resources required to achieve those objectives, and policy and regulatory measures with a view to achieving and maintaining a high level of cybersecurity in Malta.

(1a) The National Cyber Security Steering Committee shall also:

(a) act as the national point of reference on cybersecurity within the public sector, private sector and the public together with the respective sectorial and implementing entities;

(b) provide a coordinated response to cybersecurity incidents upon request of the Chairperson; and

(c) provide guidance on cybersecurity policy and technical matters upon request of Ministries and entities.

(2) The national cybersecurity strategy shall include:

(a) objectives and priorities of the strategy on the security of network and information systems covering in particular the sectors, sub-sectors and types of entities listed in the First and Second Schedule;

(b) a governance framework to achieve the objectives and priorities referred to in sub-article (2)(a), including the policies referred to in sub-article (3);

(c) a governance framework defining the roles and responsibilities of relevant stakeholders at the national level, underpinning the cooperation and coordination at the national level between the competent authorities, the single point of contact, and the CSIRTs in accordance with this order, as well as coordination and cooperation between those bodies and competent authorities in accordance with sector-specific Union legal acts;

(d) a mechanism to identify relevant assets and an assessment of the risks in Malta;

(e) identification of the measures ensuring preparedness for, responsiveness to, and recovery from incidents, including cooperation between the public and private sectors;

(f) a list of the various authorities and stakeholders involved in the implementation of the national cybersecurity strategy;

(g) a policy framework for enhanced coordination between the competent authorities under this order and the competent authorities in accordance with in accordance with Directive (EU) 2022/2557 for the purpose of information sharing on risks, cyber threats, and incidents, as well as on non-cyber risks, threats and incidents and the exercise of supervisory tasks, as appropriate; and

(h) a plan, including necessary measures, to enhance the general level of cybersecurity awareness among citizens.

(3) The national cybersecurity strategy shall include the following policies:

(a) addressing cybersecurity in the supply chain for ICT products and ICT services used by entities for the provision of their services;

(b) on the inclusion and specification of cybersecurity-related requirements for ICT products and ICT services in public procurement, including in relation to cybersecurity certification, encryption and the use of open-source cybersecurity products;

(c) managing vulnerabilities, encompassing the promotion and facilitation of coordinated vulnerability disclosure in accordance with article 13(1);

(d) related to sustaining the general availability, integrity and confidentiality of the public core of the open internet, including, where relevant, the cybersecurity of undersea communications cables;

(e) promoting the development and integration of relevant advanced technologies aiming to implement state-of-the-art cybersecurity risk-management measures;

(f) promoting and developing education and training on cybersecurity, cybersecurity skills, awareness raising and research and development initiatives, as well as guidance on good cyber hygiene practices and controls, aimed at citizens, stakeholders and entities;

(g) supporting academic and research institutions to develop, enhance and promote the deployment of cybersecurity CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

tools and secure network infrastructure;

(h) including relevant procedures and appropriate information-sharing tools to support voluntary cybersecurity information sharing between entities in conformity with Union law;

(i) strengthening the cyber resilience and the cyber hygiene baseline of small and medium-sized enterprises, in particular those excluded from the scope of this order, by providing easily accessible guidance and assistance for their specific needs; and

(j) promoting active cyber protection.

(4) The national cybersecurity strategy shall be assessed on a regular basis and at least every five (5) years on the basis of key performance indicators and, where necessary, be updated.