Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
Legal Notice 71 of 2025 is a Maltese law that implements the NIS2 Directive, enhancing cybersecurity resilience across essential and important sectors by setting stringent requirements for risk management, incident reporting, and governance.
Legal Notice 71 of 2025, officially titled "Measures for a High Common Level of Cybersecurity Across the European Union (Malta) Order, 2025," is a Maltese law that transposes the EU's NIS2 Directive into national law. This legal instrument, also known as Subsidiary Legislation 460.41, broadens the scope of cybersecurity obligations across critical sectors, including energy, transport, health, manufacturing, and digital services.
It establishes a framework for the protection of network and information systems, emphasizing risk management, incident reporting, and governance. The law introduces stringent compliance requirements for essential and important entities, including registration, implementation of cybersecurity measures, and timely notification of cyber incidents. It also establishes a national CSIRT within the CIP Department to monitor cyber threats and vulnerabilities.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
The CIP Department, or where appointed the competent authority shall ensure that the management bodies of such essential and important entities approve the cybersecurity risk-management measures taken by those entities in accordance with article 19 and oversee their implementation. The natural persons making up the management bodies may be held liable for the breach by the entities referred to in the said article in accordance with articles 31(10)(b) and 33.
























Members of the management body of essential and important entities are required to follow training in order to carry out their tasks.
















Essential and important entities shall offer similar training to their employees on a regular basis, in order to acquire sufficient knowledge and skills to be able to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.












The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: policies on risk analysis and information system security.




























The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: incident handling.
























The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: incident handling.




































The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: business continuity, such as backup management and disaster recovery, and crisis management.
































The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.
































The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.








































The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
























The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: basic cyber hygiene practices and cybersecurity training.




























The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: policies and procedures regarding the use of cryptography and, where appropriate, encryption.
























The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: asset management.




























The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: access control policies.
































The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: human resources security.
























The measures referred to in sub-article (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: the policy on insider risk management.




























Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
