NIS2 · Malta

S.L. 460.41 — Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order

Free NIS2 requirements check

20 questions — you see at once which NIS2 requirements your company already meets and which it does not.

Start the free check

NIS2 Magic Button From your company's website address to a pre-filled NIS2 profile — you confirm only what is missing.

Start here if you do not know which NIS2 requirements your company has not yet met.

Measure 1 / 10 (art 21(2)(a))
Has your company assessed its IT risks within the last year (what could fail and what it would mean for the business)?
Do you have a written information security policy approved by management?
Measure 2 / 10 (art 21(2)(b))
Do you have a written procedure for acting on a cyber incident (e.g. phishing, ransomware, data leak)?
Do your employees know whom to notify immediately about an incident — including at night and on weekends?
Measure 3 / 10 (art 21(2)(c))
Are your critical data backed up regularly, and has restoring actually been tested?
Do you have a plan for keeping the business running if IT systems are down for several days (crisis management, fallback workflows)?
Measure 4 / 10 (art 21(2)(d))
Do you know which IT providers and suppliers are critical to your business, and have you assessed their security?
Do your contracts with key suppliers include security requirements (e.g. incident notification, data protection)?
Measure 5 / 10 (art 21(2)(e))
When choosing new software or an IT service, do you evaluate its security before adoption?
Are security updates applied regularly and known vulnerabilities fixed promptly?
Measure 6 / 10 (art 21(2)(f))
Does someone regularly (e.g. yearly) check whether your security measures actually work?
Do the results of those checks reach management, and are improvements made based on them?
Measure 7 / 10 (art 21(2)(g))
Have all employees received basic cybersecurity training (recognising phishing, passwords, device protection)?
Has management itself completed cybersecurity training? (NIS2 Article 20 requires this of the management body specifically.)
Measure 8 / 10 (art 21(2)(h))
Is sensitive data encrypted both at rest (laptops, servers) and in transit?
Have you agreed when and what encryption is used (a written policy, not ad-hoc practice)?
Measure 9 / 10 (art 21(2)(i))
Does each employee have access only to the systems they need, and are leavers' accounts closed immediately?
Do you have an inventory of your IT assets (devices, software, accounts) — who uses and owns what?
Measure 10 / 10 (art 21(2)(j))
Are key accounts (email, banking, admin access) protected with multi-factor authentication (MFA)?
Have you agreed on a secure communication channel for emergencies that works even when normal systems are down?

Loading questions…

Frequently asked questions

How does the free NIS2 requirements check work?

The check asks 20 questions about the ten mandatory measures of NIS2 Article 21(2) — two questions per measure, answered Yes, Partially or No. The result is shown as soon as you have answered: your readiness, the biggest gaps and a list of all ten measures with concrete next steps. It is free and indicative, not an audit or legal advice.

S.L. 460.41 lays down the NIS2 requirements; the supervisory authority is Critical Infrastructure Protection Department. The early warning of a significant incident must be submitted within twenty-four (24) hours. The maximum administrative fine is up to 10 000 000 EUR. nis2europe.eu prepares the compliance documentation required under this law; it can be ordered and paid for directly on this site.

AIPOS OÜ · Registry code 16966532 · Estonia

NIS2 compliance document platform in 24 EU countries.

The platform prepares compliance documentation and does not provide legal advice or audits.

The service can be ordered and paid for directly on nis2europe.eu. About us