S.L. 460.35 Art. 2Interpretation. 

In this order unless the context otherwise requires:

"autonomous CSIRT" means a self-organised CSIRT which provides a monitoring function of CSIRT services and alerts to its own business or other agencies, operators of essential services or digital service providers;

"CIIP Unit" means the Critical Information Infrastructure Protection Unit as established under article 5(1);

"cloud computing service" means a digital service that enables access to a scalable and elastic pool of shareable computing resources;

"consumer" means any natural person who is acting for purposes which are outside his trade, business, craft or profession;

"critical information infrastructure" or "CII" means an information and communication technology asset, system, network or part thereof which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in Malta as a result of the failure to maintain those functions;

"critical infrastructure" or "CI" has the same meaning assigned to it by article 2 of the Critical Infrastructures and European Critical

Infrastructures (Identification, Designation and Protection) Order;

*These regulations have been repealed by Legal Notice 71 of 2025. OF NETWORK AND INFORMATION SYSTEMS

"CSIRT" means computer security incident response team;

"Data Protection Commissioner" means the Information and

Data Protection Commissioner as appointed under article 11 of the

Data Protection Act.

"Department" means the Critical Infrastructure Protection

Department established by article 3 of the Critical Infrastructures and

European Critical Infrastructures (Identification, Designation and

Protection) Order;

"digital service" means a service within the meaning of regulation 2 of the Notification Procedure Regulations which is of a type listed in the Third Schedule;

"DNS service provider" means an entity which provides DNS services on the internet;

"digital service provider" means any legal person that provides a digital service;

"domain name system" or "DNS" means a hierarchical distributed naming system in a network which refers queries for domain names;

"incident" means any event having an effect on the security of network and information systems;

"incident handling" means all procedures supporting the detection, analysis and containment of an incident and the response thereto;

"internet exchange point" or "IXP" means a network facility which enables the interconnection of more than two independent autonomous systems, primarily for the purpose of facilitating the exchange of internet traffic; an IXP provides interconnection only for autonomous systems; an IXP does not require the internet traffic passing between any pair of participating autonomous systems to pass through any third autonomous system, nor does it alter or otherwise interfere with such traffic;

"Malta Communications Authority" means the authority established under article 3 of the Malta Communications Authority Act;

"Member States" means the Member States of the European Union;

"Minister" means the Minister responsible for the protection of critical infrastructure and critical information infrastructure protection; "national strategy on the security of network and information systems" means a framework providing strategic objectives and priorities on the security of network and information systems at national level;

"network and information system" means:

(a) an electronic communications network within the meaning of article 2 of the Electronic Communications (Regulation) Act;

(b) any device or group of interconnected or related devices, one or more of which, pursuant to a program, perform automatic processing of digital data; or

(c) digital data stored, processed, retrieved or transmitted by elements covered under paragraphs (a) and (b) for the purposes of their operation, use, protection and maintenance.

"online marketplace" means a digital service that allows consumers, traders or both as respectively defined in paragraph (a) and in paragraph (b) of Article 4(1) of Directive 2013/11/EU of the European Parliament and of the Council to conclude online sales or services contracts with traders either on the online marketplace’s website or on a trader's website that uses computing services provided by the online marketplace;

"online search engine" means a digital service that allows users to perform searches of, in principle, all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword, phrase or other input, and returns links in which information related to the requested content can be found;

"operator of essential services" means a public or private entity of a type referred to in the Second Schedule, which meets the criteria laid down in article 9(2);

"operator security plan" or "business continuity management" is the overall procedure identifying the assets, systems, networks or part thereof within critical information infrastructures, operator of essential services and, or digital service providers, identifying the security solutions and technical measures that exist or are being implemented for their protection and the identification, selection and prioritization of counter measures and procedures;

"representative" means any natural or legal person established in the Union explicitly designated to act on behalf of a digital service provider not established in the Union, which may be addressed by a national competent authority or a CSIRT instead of the digital service provider with regard to the obligations of that digital service provider OF NETWORK AND INFORMATION SYSTEMS

under this order;

"risk" means any reasonably identifiable circumstance or event having a potential effect on the security of network and information systems and leading to uncertainty on the objectives of an asset, system, network or part thereof. An effect is a deviation from the expected objectives, objectives may have different aspects and may apply at different levels, positive or negative. Objectives can have different aspects (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process). Risk is often characterized by reference to potential events and consequences, or a combination of these. Risk is often expressed in terms of a combination of the consequences of an event, including changes in circumstances, and the associated likelihood of occurrence;

"risk assessment" is the overall process of risk identification, risk analysis and risk evaluation, incorporating the identification of risk sources, events, their causes and their potential consequences, comprehending the nature of risk and determining the level of risk, with the ultimate objective of comparing the results of the risk analysis with the risk criteria in order to determine whether the risk and, or its magnitude is acceptable or tolerable;

"security of network and information systems" means the ability of network and information systems to resist, at a given level of confidence, any action that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via those network and information systems;

"standard" means a standard within the meaning of paragraph (1) of Article 2 of Regulation (EU) No 1025/2012 of the European Parliament and of the Council;

"specification" means a technical specification within the meaning of paragraph (4) of Article 2 of Regulation (EU) No 1025/ 2012 of the European Parliament and of the Council;

"top-level domain name registry" means an entity which administers and operates the registration of internet domain names under a specific top-level domain;

"trader" means any natural persons, or any legal person irrespective of whether privately or publicly owned, who is acting, including through any person acting in his name or on his behalf, for purposes relating to his trade, business, craft or profession;

"Treaty" shall have the same meaning as in article 2 of the

European Union Act.