S.L. 460.35 Art. 9Identification of operators of essential services.

(1) The CIIP Unit shall for each sector and subsector referred to in the Second Schedule identify operators of essential services within Malta.

(2) In identifying operators of essential services pursuant to sub-article (1) the CIIP unit shall take into account that:

(a) the entity provides a service which is essential for the maintenance of critical societal, economic activities or both;

(b) the provision of that service depends on network and information systems; and

(c) an incident would have significant disruptive effects on the provision of that service.

(3) For the purposes of sub-article (1), the CIIP Unit shall establish a list of the services referred to in paragraph (a) of sub-article (2).

(4) Upon a request in writing by the CIIP Unit, a potential operator of essential services in Malta shall within twenty (20) days provide a list of essential services it provides.

(5) The CIIP Unit shall review the list provided pursuant to sub-article (4), and inform the potential operator of essential services whether it has been designated as an operator of essential services pursuant to this article within reasonable time.

(6) A designated operator of essential services shall comply with the designation notification referred to in sub-article (5) within a stipulated time as may be directed by the CIIP Unit.

(7) Any undertaking which fails to comply with the CIIP Unit’s request pursuant to sub-article (4) shall be liable to an administrative fine in accordance with the procedure under article 19.

(8) The CIIP Unit shall on a regular basis, and at least every two years after 9 May 2018, review and, where appropriate, update the list of identified operators of essential services.