S.L. 460.35 Art. 13Security requirements and incident notification.

(1) Digital service providers shall identify and take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which they use in the context of offering services within Malta referred to in the Third Schedule. Having regard to the state of the art, those measures shall ensure a level of security of network and information systems appropriate to the risk posed, and shall take into account the following elements:

(a) the security of systems and facilities;

(b) incident handling;

(c) business continuity management;

(d) monitoring, auditing and testing;

(e) compliance with international standards.

(2) Digital service providers shall take measures to prevent and minimise the impact of incidents affecting the security of their network and information systems on the services referred to in the Third Schedule that are offered within Malta, with a view to ensuring the continuity of those services.

(3) Digital service providers shall without undue delay, notify the CIIP Unit of any incident having a substantial impact on the provision of a service as referenced in the Third Schedule that they offer within Malta. Notifications shall include information to enable the CIIP Unit to determine the significance of any local and cross-border impact. Notification shall not make the notifying party subject to increased liability.

(4) In order to determine whether the impact of an incident is substantial, the following parameters in particular shall be taken into account:

(a) the number of users affected by the incident, in particular users relying on the service for the provision of their own services;

(b) the duration of the incident;

(c) the geographical spread with regard to the area affected by the incident;

(d) the extent of the disruption of the functioning of the service;

(e) the extent of the impact on economic and societal activities;

(f) the importance of the entity for maintaining a sufficient level of the service, taking into account the availability of alternative means for the provision of that service;

(g) the dependency of a critical infrastructure, critical information infrastructure, or both, on the service provided by that entity.

The obligation to notify an incident shall only apply where the digital service provider has access to the information needed to assess the impact of an incident against the parameters referred to in the first paragraph.

(5) Where an operator of essential services relies on a third-party digital service provider for the provision of a service which is OF NETWORK AND INFORMATION SYSTEMS

essential for the maintenance of critical societal and economic activities, any significant impact on the continuity of the essential services due to an incident affecting the digital service provider shall be notified in writing and without undue delay by that operator.

(6) Where appropriate, and in particular if the incident referred to in sub-article (3) concerns two or more Member States, the CIIP Unit shall inform the competent authority or CSIRT of the other affected Member States. In so doing, the CIIP Unit shall, in accordance with the law, preserve the digital service provider’s security and commercial interests as well as the confidentiality of the information provided.

(7) After consulting the digital service provider concerned, the CIIP Unit, where appropriate, may inform the public about individual incidents or require the digital service provider to do so, where public awareness is necessary in order to prevent an incident or to deal with an ongoing incident, or where disclosure of the incident is otherwise in the public interest.

(8) Without prejudice to article 3(4), the CIIP Unit shall not impose any further security or notification requirements on digital service providers.

(9) Part V shall not apply to micro and small enterprises as defined in Commission Recommendation 2003/361/EC.

(10) Any digital service provider which fails to comply with the obligations set out in this article shall be liable to the imposition of an administrative fine in accordance with the procedure under article 19.