NIS2 in Malta: Are You an Essential or Important Entity?

How Malta Transposed NIS2

Malta has transposed the EU NIS2 Directive through the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order (S.L. 460.41). This national order sets out who falls within scope, what cybersecurity obligations apply, and which authority supervises compliance.

The Critical Infrastructure Protection Department (CIP Department) is the national supervisory authority responsible for monitoring implementation at national level and ensuring compliance (article 7). For certain sectors and sub-sectors, a designated competent authority may act under the CIP Department's supervision.

Under the order, organisations are split into two categories: essential entity and important entity. Which category you fall into determines the intensity of supervision and the potential penalties — so identifying your status is the first practical step to compliance.

The Two Categories: Essential vs Important Entity

The classification is defined in article 4 of S.L. 460.41.

Essential entities (article 4(1)) include, among others:

• Entities of a type listed in the First Schedule that exceed the ceilings for medium-sized enterprises provided for in accordance with Article 2(1) of the Annex to Commission Recommendation 2003/361/EC;
• Qualified trust service providers, top-level domain name registries and DNS service providers — regardless of their size;
• Providers of public electronic communications networks or publicly available electronic communications services that qualify as medium-sized enterprises under Article 2 of the Annex to Commission Recommendation 2003/361/EC;
• Certain public administration entities (as referred to in article 3(3)(f)(i));
• Entities identified as critical entities under the Resilience of Critical Entities and Infrastructures Order (article 3(4));
• Entities identified before 16 January 2023 as operators of essential services under Directive (EU) 2022/2555 or national law.

Important entities (article 4(2)): entities of a type referred to in the First or Second Schedule that do not qualify as essential entities under article 4(1) are considered important entities. This also includes entities designated as important by the CIP Department or the designated competent authority under articles 3(3)(b) to (e).

In short: the schedules and the size thresholds determine your type, while certain categories (such as qualified trust service providers, TLD registries and DNS providers) are in scope regardless of size.

Sectors and Size: How to Self-Identify

Two questions help you assess whether you are in scope:

1. Are you in a covered sector? The First and Second Schedules to S.L. 460.41 list the sectors, sub-sectors and types of entities covered by the order (article 7(1)). The First Schedule broadly maps to the higher-criticality sectors, while the Second Schedule captures further sectors. The schedules also designate the competent authority for each sector or sub-sector.

2. Do you meet the size threshold? The size test refers to the ceilings for medium-sized enterprises under Article 2(1) of the Annex to Commission Recommendation 2003/361/EC:

• Entities in a First Schedule type that exceed the medium-sized ceilings tend to be essential entities.
• Entities in a First or Second Schedule type that do not qualify as essential are treated as important entities.
• Some entity types (qualified trust service providers, TLD name registries, DNS service providers) are in scope irrespective of size.

The exact sector and sub-sector mapping in the First and Second Schedules should be checked against your specific activities. [TÄPSUSTAB PARTNER-JURIST] where a borderline sector classification or size calculation needs a formal determination.

Registration: Essential and important entities providing services in Malta, as well as entities providing domain name registration services in Malta, must register on the national self-registration mechanism established by the CIP Department and provide the details set out in article 7(4). Any changes to these details must be notified without delay and, in any event, within two (2) weeks of the change (article 7(5)).

What Being In Scope Means for You

Once you are classified, the core obligations apply to both essential and important entities.

Cybersecurity risk-management measures (article 19) — an all-hazards approach including at least:

• Policies on risk analysis and information system security;
• Incident handling;
• Business continuity, backup management, disaster recovery and crisis management;
• Supply chain security;
• Security in acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure;
• Basic cyber hygiene practices and cybersecurity training;
• Cryptography and, where appropriate, encryption;
• Access control, asset management and multi-factor authentication where appropriate.

Governance (article 18) — management bodies must approve the cybersecurity risk-management measures and oversee their implementation, and members must follow training.

Incident reporting (article 20) — for a significant incident, entities notify the national CSIRT with:

• an early warning within 24 hours;
• an incident notification within 72 hours;
• a final report within one (1) month of the incident notification.

Supervision and penalties differ by category. Essential entities are subject to proactive supervision (article 29), while important entities are subject mainly to ex post supervision (article 30). Administrative penalties (article 32) for infringing articles 19 or 20 reach a maximum of €10 000 000 or 2% of total worldwide annual turnover (whichever is higher) for essential entities, and €7 000 000 or 1.4% for important entities.

Given these stakes, confirming your classification early is worthwhile. A free scoping and gap check can help you map your sector to the First and Second Schedules, test the size thresholds and identify where you stand before the CIP Department engages.