ITER/MTMalta
What the record establishes for Malta: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Office of the Information and Data Protection Commissioner reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | CSIRTMalta, in the order as drafted provisional | Not set by the order, and not established. The Department's own page on CSIRTMalta is behind a firewall that refuses the tool, a browser with an ordinary user agent and a headless browser alike. Addresses for the team circulate in third-party directories; this record does not take a channel from those. | mt cybersecurity order draft |
| Financial supervisorDORA, article 19 | Malta Financial Services Authority reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Awtorita' ghas-Servizzi Finanzjari ta' Malta (MFSA) reported | — | esma mar nca |
Transposition of NIS2 provisional
| Act | Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025, L.N. 71 of 2025, S.L. 460.41 |
|---|---|
| In force | 23 January 2026, for all provisions, by L.N. 22 of 2026, a commencement notice under article 1(3) |
| Recipient | CSIRT, as the Order names it, which is CSIRTMalta |
| Moves a term | No. None. Sub-article (5) keeps the cascade: the early warning «within twenty-four (24) hours of becoming aware of the significant incident», the incident notification «within seventy-two (72) hours of becoming aware», an intermediate report on request, and the final report within one month of the incident notification; a progress report where the incident is still running, with the final report within one month of its handling. |
| Standing | Read in the made Order and in its commencement notice. The Order's text was read in ENISA's copy of the subsidiary legislation, not on legislation.mt. The Department's page on CSIRTMalta still refuses an automated reader. |
| Source | mt cybersecurity order draft |
An event in Malta
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.