Is your NIS2 document legally sound in Malta — and how to check it

1. Traceability: every obligation must point to a provision you can open

Many companies already own a NIS2 policy pack — bought, inherited from a group parent, or drafted internally. The question that matters is not whether it looks thorough, but whether a reader can verify each statement in it against the law that actually applies in Malta.

In Malta, that law is the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order (S.L. 460.41). A document that cites only Directive (EU) 2022/2555 — or cites nothing at all — cannot be checked, because the obligations that a Maltese authority applies are the articles of the Order, not the directive text.

A checkable reference looks like this. Here is a sentence copied word for word from the Order:

"The CIP Department, or where designated the competent authority, shall ensure that management bodies of such essential and important entities approve the cybersecurity risk- management measures in accordance with article 19 and oversee their implementation." — S.L. 460.41, article 18(1)

Anyone can now open article 18(1) and confirm that the sentence is there. Run the same test on your own document:

• Pick five obligations at random from it.
• For each, look for a reference naming the Order and an article number (for example article 19, article 20, article 29).
• Open that article and read it.

If a claim has no article number behind it, treat it as an unverified assertion, not as a legal requirement.

2. Coverage: the measure areas listed in article 19

Article 19(2) of S.L. 460.41 sets out the minimum content of cybersecurity risk-management measures, based on an all-hazards approach. Your document should visibly address each of the following, and each should be findable — a heading, a section number, a cross-reference:

• (a) policies on risk analysis and information system security;
• (b) incident handling;
• (c) business continuity, such as backup management and disaster recovery, and crisis management;
• (d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;
• (e) security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;
• (f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures;
• (g) basic cyber hygiene practices and cybersecurity training;
• (h) policies and procedures regarding the use of cryptography and, where appropriate, encryption;
• (i) human resources security, insider risk management policy, access control policies and asset management;
• (j) the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate;
• (k) logging and traceability of network and information systems.

Note points (i) and (k): the Maltese wording is not identical to the directive list, since it adds insider risk management policy and a separate point on logging and traceability. A pack written from the directive alone will often be missing exactly those.

Article 19(1)(c) also requires the appointment of a security liaison officer with defined tasks, and article 19(1)(d) requires the entity to receive CSIRT monitoring services from an internal CSIRT or an autonomous CSIRT. Check whether your document mentions both — documents built on generic EU templates frequently do not.

3. Wording: paraphrase is where documents drift

An obligation should read close to the statutory text. Loose paraphrase quietly changes scope — and once it does, the internal procedure and the legal duty no longer match.

A simple comparison method for one sentence:

1. Take a sentence from your document that states a duty ("we will…", "the entity shall…").
2. Find the article of S.L. 460.41 it is meant to reflect.
3. Put the two side by side and look at four things: who the duty falls on, what must be done, when, and any qualifier such as appropriate, proportionate, without undue delay, where appropriate.

Common drift to look for:

• A qualifier dropped. Article 19(1)(b) requires the level of security to be appropriate to the risks posed, taking into account the state-of-the-art, relevant European and international standards, and the cost of implementation. A document that states a flat rule without that proportionality test is not describing article 19.
• Deadlines compressed. Article 20(5) sets out separate submissions: an early warning within twenty-four (24) hours of becoming aware of the significant incident, an incident notification within seventy-two (72) hours, an intermediate report upon request of the national CSIRT, and a final report not later than one (1) month after the incident notification. Each is its own step; a document that merges them has changed the obligation.
• The recipient swapped. Under article 20(1) the notification goes to the national CSIRT, which then notifies the CIP Department in writing.

Where your document goes beyond what the Order says, that is fine — but it should be labelled as an internal decision, not presented as a statutory requirement.

4. Management approval: an unapproved document is unfinished

Article 18(1), quoted above, places the approval of the cybersecurity risk-management measures with the management body, together with oversight of their implementation. It also records that the natural persons composing management bodies may be held liable for infringements of article 19, in accordance with articles 31(10)(b) and 33.

So a document sitting in a shared drive, never tabled and never approved, does not reflect what article 18(1) describes. Practical checks:

• Is there a dated record of approval by the management body — a minute, a resolution, a signed cover page?
• Does the record identify which version was approved?
• Is there evidence of ongoing oversight of implementation, not just a one-off sign-off?
• Article 18(3) requires members of management bodies to follow training in order to carry out their tasks, and article 18(4) requires entities to offer similar training to employees on a regular basis. Is that training documented?

Delegating drafting to an IT team or an external supplier does not move the approval duty; article 18(1) keeps it with the management body.

5. What a supervisor — or a customer — actually asks to see

Article 7(1) designates the CIP Department as the national supervisory authority responsible for monitoring implementation of the Order at national level. Articles 29 and 30 set out what it may ask for.

For essential entities, article 29(2) lists supervisory measures including on-site inspections and off-site supervision, regular and targeted security audits, ad hoc audits, security scans, requests for information necessary to assess the cybersecurity risk-management measures adopted — including documented cybersecurity policies — requests to access data, documents and information, requests for evidence of implementation of cybersecurity policies such as the results of security audits and the underlying evidence, requests for evidence of CSIRT monitoring services under article 19(1)(d), and requests for evidence of operator security plans, business continuity plans and where necessary termination plans.

For important entities, article 30(1) frames supervision as ex post — triggered by evidence, indication or information of non-observance — with a comparable list of measures in article 30(2). Under article 29(5) and article 30(5), a request must state its purpose and specify the information requested.

Customers apply a narrower version of the same logic. Article 19(2)(d) makes supply chain security a statutory measure area, and article 19(3) requires entities to take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of their products and cybersecurity practices, including secure development procedures. That is why suppliers who are not themselves in scope still receive security questionnaires: their customer is discharging its own article 19 duty.

Both audiences ask the same underlying thing — show the document, show the article it rests on, show that it was approved, show that it is being implemented. Article 19(4) adds the follow-through: where an entity finds that it does not meet the measures in article 19(2), it must take, without undue delay, all necessary, appropriate and proportionate corrective measures.

For practical details the Order does not spell out — such as the exact notification and registration channels — consult the published guidance of the Critical Infrastructure Protection Department as the official source.