National Annex — Malta
Status as of October 2026: In force. Community-maintained orientation. This is not legal advice; verify against the official gazette and authority guidance before relying on it. Corrections welcome, see contributing.
| Review | Status |
|---|---|
| Confidence | Needs verification |
| Checked line by line against the legal text | No |
| Reviewed by a lawyer | No |
| Last reviewed | October 2026 |
| Reviewed by | Frederik B. Krogsgaard, maintainer |
| Second reviewer | Wanted, see CONTRIBUTING |
| Next review due | April 2027 |
NIS2 implementation
| Field | Value |
|---|---|
| Implementing law | Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, S.L. 460.41, Legal Notice 71 of 2025, amended by Legal Notice 89 of 2026 |
| Competent authority | Critical Infrastructure Protection Department, competent authority and single point of contact; the Malta Communications Authority for certain digital entities |
| National CSIRT / reporting | The national CSIRT within the Critical Infrastructure Protection Department; confirm the reporting channel |
| Official starting point | https://legislation.mt/eli/sl/460.41/eng |
Country notes for your CDC
Small jurisdiction with a single point of contact, the Critical Infrastructure Protection Department, which also hosts the national CSIRT under S.L. 460.41. The CSIRTMalta website was unavailable at the last review, and secondary sources describe the reporting arrangements differently, so confirm the registration and reporting channel with the department before relying on it.
Standard checklist for all countries
- GOVERN: applicability determined per legal entity and sector, and recorded in the regulatory applicability register
- Entity registration completed with the national authority where required
- RESPOND: incident-reporting procedure drilled against the national channel and the 24 h early-warning clock
- Contact established with the national CSIRT before the first incident
- Data protection authority contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
- National guidance and frameworks mapped to your control evidence, per the note above
Selector tag
Tick "Malta" in tools/regulatory-profile.html to include this country's references under the mt-nat tag.
Open CDC Framework, licensed CC BY 4.0.