NIS2 Malta

Use of multi-factor authentication for important data systems

Critical

High

Normal

Low

Defining and documenting accepted authentication methods

Critical

High

Normal

Low

Use and evaluation of password management system

Critical

High

Normal

Low

Using multi-factor authentication for admins

Critical

High

Normal

Low

Enabling multi-factor authentication for all users

Critical

High

Normal

Low

Personnel guidelines for safe data system and authentication info usage

Critical

High

Normal

Low

Data system management

Choosing and using network protection systems

Critical

High

Normal

Low

Virtualization

19.2.k: Information systems traceability and logging

Related tasks

Determine a strategy and guidelines for security monitoring

Critical

High

Normal

Low

Data system log review

Critical

High

Normal

Low

Collection of log data on the use of data systems

Critical

High

Normal

Low

Identifying and reacting to logging errors in protection systems logs

Critical

High

Normal

Low

Monitoring the use of the network and information systems to identify anomalies

Critical

High

Normal

Low

Determining the baseline for network and data system usage for monitoring purposes

Critical

High

Normal

Low

19.3: Supply chain and supplier security assessment

The CIP Department, or where appointed the competent authority, shall ensure that, when considering which measures referred to in sub-article (2)(d) are appropriate, entities are to take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. The CIP Department, or where appointed the competent authority, shall also ensure that, when considering which measures referred to in that sub-article are appropriate, entities are required to take into account the results of the coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1) of the Directive.

Related tasks

Monitoring suppliers' compliance with security requirements

Critical

High

Normal

Low

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Documentation of partner contract status

Critical

High

Normal

Low

Supply chain cyber security risk management

Critical

High

Normal

Low

Supplier security

19.4: Taking corrective action for non-compliance

The CIP Department, or where appointed the competent authority, shall ensure that where an essential or important entity finds that it does not comply with the measures provided for in sub-article (2), the entity concerned shall take, without undue delay, all necessary, appropriate and proportionate corrective measures referred to in article 29 for essential entities or in article 30 for important entities.

Related tasks

Treatment process and documentation of identified non-conformities

Critical

High

Normal

Low

Risk management

Continuous improvement and documentation

Critical

High

Normal

Low

20.1: Notification of significant incidents

Essential and important entities shall without delay notify the CSIRT of any incident that has a significant impact on the provision of their services in accordance with sub-article (6):

Provided that the mere act of notification shall not subject the notifying entity to increased liability:

Provided also that the CSIRT shall immediately notify in writing any competent authority or authorities appointed as the case may be, of any incident that has a significant impact on the provision of the services provided by an essential or important entity that such authority regulates.

Related tasks

Keeping contact with relevant authorities

Critical

High

Normal

Low

The step-by-step process of notification of incidents to the authorities

Critical

High

Normal

Low

Incident notifications for users of own services

Critical

High

Normal

Low

20.2: Information to service recipients about incidents

Where appropriate, essential and important entities shall notify, without undue delay, the recipients of their services of significant incidents that are likely to adversely affect the provision of those services.

Those entities shall report any information that enables the CSIRT to determine any cross-border impact of the incident.

Related tasks

Communication about information security threats and protective measures affecting users of the services

Critical

High

Normal

Low

20.3: Notification of cross-border incidents

In the event of a significant cross-border or cross-sectoral incident, the CIP Department shall be provided in a timely manner with the relevant information notified in accordance with sub-article (5).

Related tasks

The step-by-step process of notification of incidents to the authorities

Critical

High

Normal

Low

20.4: Communication of threats and countermeasures to service recipients

Where applicable, essential and important entities shall communicate, without undue delay, to the recipients of their services potentially affected by a significant cyber threat any measures or remedies that those recipients are able to take in response to that threat.

Where appropriate, the entities shall also inform those recipients of the significant cyber threat itself.

Related tasks

Communication about information security threats and protective measures affecting users of the services

Critical

High

Normal

Low

20.5: Timeline and procedure for reporting

For the purpose of the notification under sub-article (1), the entities concerned shall submit to the CSIRT:

(a) without undue delay and in any event within twenty-four (24) hours of becoming aware of the incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;

(b) without undue delay and in any event within seventy-two (72) hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in paragraph (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise;

(d) a final report no later than one (1) month after the submission of the incident notification under sub-article (5)(b) which shall include the following:

(i) a detailed description of the incident, including its severity and impact;

(ii) the type of threat or root cause that is likely to have triggered the incident;

(iii) applied and ongoing mitigation measures;

(iv) where applicable, the cross-border impact of the incident;

(e) in the event of an ongoing incident at the time of the submission of the final report referred to in paragraph (d), the entities concerned shall provide the CSIRT with a progress report at that time and a final report within one (1) month of their having handled the incident.

Related tasks

The step-by-step process of notification of incidents to the authorities

Critical

High

Normal

Low

21.1: The use of certified products, services and processes

In implementing article 19, the CIP Department shall without imposing or discriminating in favour of the use of any particular type of technology, encourage the use of ICT products, ICT services and ICT processes, developed by the essential or important entity or procured from third parties, that are certified under European cybersecurity certification schemes adopted pursuant to Article 49 of Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (the Cybersecurity Act):

Provided that the CIP Department, or where appointed the competent authority, shall require, where applicable, that essential and important entities use such ICT products, ICT services and ICT processes:

Provided also that specific categories of essential and important entities listed in the Commission's delegated acts, shall use certain certified ICT products, ICT services and ICT processes or obtain a certificate under a European cybersecurity certification scheme adopted pursuant to Article 49 of Regulation (EU) 2019/881.

Related tasks

Use of certified ICT products, services and processes

Critical

High

Normal

Low

Data system management

26.1: Arrangements for sharing cybersecurity information.

The CSIRT shall ensure that entities falling within the scope of this order and, where relevant, other CSIRTs of entities not falling within the scope of this order, are able to exchange among themselves on a voluntary basis relevant cybersecurity information, including information relating to cyber threats, near misses, vulnerabilities, techniques and procedures, indicators of compromise, adversarial tactics, threat-actor-specific information, cybersecurity alerts and recommendations regarding the configuration of cybersecurity tools to detect cyberattacks, where this information sharing:

(a) aims to prevent, detect, respond to, or recover from incidents or mitigate their impact;

(b) enhances the level of cybersecurity, in particular by raising awareness of cyber threats, limiting or impeding the propensity of such threats to spread, supporting a range of defensive capabilities, vulnerability remediation and disclosure, threat detection, containment and prevention techniques, mitigation strategies, or response and recovery stages, or promoting collaborative cyber threat research between public and private entities:

Provided that the arrangement for sharing cybersecurity information shall be without prejudice to the security plan of the operators of the entities falling within the scope of this order, in accordance with article 19(1)(c)(iii).

Related tasks

Contact with industry-specific interest groups

Critical

High

Normal

Low

Technical vulnerability management

The goals of threat intelligence and the collection of information related to information security threats

Critical

High

Normal

Low

Sharing threat intelligence

Critical

High

Normal

Low

Technical vulnerability management

Internal communication about the organization's risk situation

Critical

High

Normal

Low

26.4: Notification of participation in information-sharing arrangements

Essential and important entities shall notify the CIP Department of their participation in the cybersecurity information-sharing arrangements provided for in sub-article (2), upon entering into such arrangements, or as applicable, of their withdrawal from such arrangements, once the withdrawal takes effect.

Related tasks

Definition of information sharing agreements and notification obligations

Critical

High

Normal

Low

27.1: Voluntary notification of relevant information

In addition to the notification obligation as provided for in article 20, notifications may be submitted to the CSIRT on a voluntary basis, by:

(a) essential and important entities with regard to incidents, cyber threats and near misses;

(b) other entities not referred to in sub-article (1)(a), irrespective of whether they fall within the scope of this order, with regard to significant incidents, cyber threats and near misses.

Related tasks

Voluntary notifications of security incidents

Critical

High

Normal

Low

14.1: Appointment and approval of a qualified auditor for the verification of cybersecurity measures

An essential or important entity shall appoint a qualified auditor who shall verify whether the entity has implemented the cybersecurity risk management measures in accordance with article 19:

Provided that the qualified auditor shall satisfy the requirements listed in sub-article (4) before being appointed:

Provided also that if the qualified auditor satisfies the requirements listed in sub-article (4), the appointment shall be approved by the CIP Department, or where appointed the competent authority.

Related tasks

Appointing a qualified cybersecurity auditor (Malta)

Critical

High

Normal

Low

Executing and documenting internal audits

Critical

High

Normal

Low

Internal audit procedure -report publishing and maintenance

Critical

High

Normal

Low