S.L. 460.35 Art. 5The CIIP Unit. 

(1) There shall be a Critical Information

Infrastructure Protection Unit within the Department, herein referred to as the ‘CIIP Unit’.

(2) The CIIP Unit shall be responsible for monitoring the application of this order and shall be the national competent authority OF NETWORK AND INFORMATION SYSTEMS

covering the sectors referred to in the Second Schedule and the services referred to in the Third Schedule.

(3) The CIIP Unit shall be responsible for:

(a) establishing the criteria for the identification and designation of operators of essential services and digital service providers;

(b) identifying and designating operators of essential services within Malta pursuant to article 9;

(c) identifying the services provided by operators of essential services and digital service providers;

(d) ensuring that a risk assessment is carried out by operators of essential services and digital service providers;

(e) ensuring that operators of essential services and digital service providers draw up and maintain an operator security plan;

(f) instigating simulated runs of operator security plans by operators of essential services and digital service providers.

(g) without prejudice to article 3(3), building partnerships with operators of Critical Information Infrastructures (CIIs) for information sharing;

(h) maintaining a register of CSIRTs, operators of essential services and digital service providers providing services in Malta;

(i) exercising a liaison function to ensure cross-border cooperation with the relevant authorities in other Member States and with the Cooperation Group and the CSIRTs network;

(j) adopting a national strategy on the security of network and information systems pursuant to article 8;

(k) monitoring security measures taken by operators of essential services pursuant to article 11.

(4) The CIIP Unit shall also perform such related and consequential duties as the Minister may delegate from time to time.

(5) The CIIP Unit shall, whenever appropriate and in accordance with law, consult and cooperate with the relevant national law enforcement authorities and the Data Protection Commissioner.