ITER/MTMalta
What the record establishes for Malta: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Office of the Information and Data Protection Commissioner reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | CSIRTMalta, in the order as drafted provisional | Not set by the order, and not established. The Department's own page on CSIRTMalta is behind a firewall that refuses the tool, a browser with an ordinary user agent and a headless browser alike. Addresses for the team circulate in third-party directories; this record does not take a channel from those. | mt cybersecurity order draft |
| Financial supervisorDORA, article 19 | Malta Financial Services Authority reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Awtorita' ghas-Servizzi Finanzjari ta' Malta (MFSA) reported | — | esma mar nca |
Transposition of NIS2 unresolved
| Act | Measures for a High Common Level of Cybersecurity Across the European Union (Malta) Order, 2024 |
|---|---|
| In force | Not fixed. Article 1(3) leaves it to *«such a date as the Prime Minister may by notice in the Gazette establish»*, and different dates may be set for different provisions. |
| Recipient | CSIRTMalta, in the order as drafted |
| Moves a term | No. The draft moves nothing. Sub-article (6) reproduces the cascade exactly: the early warning «within twenty-four (24) hours of becoming aware of the significant incident», the incident notification «within seventy-two (72) hours of becoming aware», an intermediate report on request, the final report «not later than one (1) month after the submission of the incident notification», and where the incident is still running, a progress report then and a final report within one month of its handling. Trust service providers get twenty-four hours. CSIRTMalta owes a response within twenty-four hours of the early warning. What is unsettled is not the content but the standing: every page of the document read carries the footer Public Consultation, and the citation reads «L.N. of 2024» with no number. |
| Standing | Read in a public consultation draft, not as a made Legal Notice. A consultation draft, published by the Ministry responsible. Whether the order has since been made, and on what date it was brought into force, is not established by this source. The terms are recorded because they were read; the instrument is not recorded as binding, because this document does not show that it is. |
| Source | mt cybersecurity order draft |
An event in Malta
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.