How NIS2Europe generates and validates your documents

1. The statutory source: S.L. 460.41

For a company operating in Malta, the binding text is the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order (S.L. 460.41). The Directive (EU) 2022/2555 explains the European intent, but the sentences a Maltese supervisor reads are the articles of the Order.

The provision that decides what the documentation must contain is article 19. Article 19(1) requires appropriate and proportionate technical, operational and organisational measures, a level of security appropriate to the risks posed, the appointment of a security liaison officer, and CSIRT monitoring services from an internal CSIRT or an autonomous CSIRT. Article 19(2) then lists the minimum content that the measures must include, from policies on risk analysis and information system security through to logging and traceability of network and information systems.

Governance sits in article 18: management bodies approve the measures and oversee their implementation, and the Order states plainly:

> "Members of the management bodies of essential and important entities are required to follow training in order to carry out their tasks." — S.L. 460.41 article 18(3)

A documentation set that never names article 19 or article 18 is describing an idea of NIS2 rather than the law that applies in Malta.

2. The competent authority and the reporting deadlines

The Critical Infrastructure Protection Department (CIP Department) is the national supervisory authority responsible for monitoring the implementation of the Order at national level and ensuring compliance therewith (article 7(1)). The First and Second Schedules designate the competent authority for each sector or sub-sector; those designated authorities cooperate under the supervision of the CIP Department (article 7(2)).

Reporting runs through the national CSIRT. Article 20(1) states:

> "Essential and important entities shall immediately notify the national CSIRT, of any incident that has a significant impact on the provision of their services" — S.L. 460.41 article 20(1)

The national CSIRT then immediately notifies the CIP Department in writing. Article 20(5) sets out what is submitted, and each deadline should appear in the documentation as its own separate line:

• an early warning, without undue delay and in any event within twenty-four (24) hours of becoming aware of the significant incident;
• an incident notification, without undue delay and in any event within seventy-two (72) hours of becoming aware of the significant incident;
• an intermediate report on relevant status updates, upon the request of the national CSIRT;
• a final report not later than one (1) month after the submission of the incident notification.

A trust service provider notifies within twenty-four (24) hours of becoming aware of the significant incident where the incident affects the provision of its trust services (article 20(6)). The exact electronic notification or registration channel should be verified against the published guidance of the Critical Infrastructure Protection Department as the official source.

3. What the company's own profile decides

Two organisations in Malta rarely need identical documentation, because article 4 distributes obligations by profile.

Sector. The First Schedule covers sectors of high criticality — energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space. The Second Schedule covers other critical sectors, including postal and courier services, waste management, chemicals, food, several manufacturing sub-sectors, digital providers and research organisations.

Size. Article 4(1)(a) treats entities of a type in the First Schedule that exceed the ceilings for medium-sized enterprises under Article 2(1) of the Annex to Commission Recommendation 2003/361/EC as essential entity cases. Some types are covered regardless of size, such as qualified trust service providers, top-level domain name registries and DNS service providers (article 4(1)(b)).

Classification. Entities of a type in the First or Second Schedule that do not qualify under article 4(1) are important entity cases (article 4(2)). The CIP Department, or where designated the competent authority, may also identify entities under articles 3(3)(b) to (e).

The classification is not cosmetic. It steers the supervisory regime (article 29 for an essential entity, article 30 for an important entity) and the penalty ceilings in article 32. A self-assessment of sector, size and classification is therefore the first input to the documentation, not an afterthought.

4. Checking every requirement back against the statutory text

Production is only half of the method. The second half is a sentence-by-sentence comparison.

The working rule is simple: every statement of obligation in the draft is placed next to the provision it claims to implement, and the two are read together. If the draft says the management body approves the measures, the reviewer opens article 18(1) and confirms the wording. If the draft describes supplier controls, the reviewer opens article 19(2)(d) and article 19(3), which require entities to take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of their products and cybersecurity practices.

Three failure patterns show up repeatedly and are corrected before the document is used:

• Unsupported statements — a duty that no provision of the Order imposes. It is removed or rewritten.
• Merged deadlines — the twenty-four (24) hour and seventy-two (72) hour submissions collapsed into a single line, which hides that they are two separate obligations under article 20(5)(a) and article 20(5)(b).
• Directive wording used as national wording — text lifted from Directive (EU) 2022/2555 where the Maltese article differs. Article 19(1)(c) and 19(1)(d), for example, add the security liaison officer and CSIRT monitoring services.

Where the Order does not settle a practical detail, the honest response in the document is a pointer to the published guidance of the Critical Infrastructure Protection Department, not an invented figure.

Article 19(4) makes the corrective habit part of the law itself: where an entity finds that it does not meet the measures in article 19(2), it must take, without undue delay, all necessary, appropriate and proportionate corrective measures.

5. What stays verifiable afterwards

The lasting value of the method is that each requirement carries its own citation — the exact act name, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order (S.L. 460.41), and the exact provision, such as article 18(1), article 19(2)(g) or article 20(5)(d).

That matters because the Order gives supervisors documentary powers. Under article 29(2), the CIP Department, or where designated the competent authority, may request information necessary to assess the cybersecurity risk-management measures adopted, including documented cybersecurity policies; request access to data, documents and information; request evidence of implementation of cybersecurity policies, such as the results of security audits and the respective underlying evidence; and request evidence of operator security plans, business continuity plans and where necessary termination plans. Article 30(2) sets out equivalent ex post powers for an important entity.

The same traceability serves an internal auditor and a procuring customer performing supplier due diligence: any single claim can be read against the official text rather than taken on trust. Malta's consolidated legislation is published by the state, and the official text of the Order is the binding version.

None of this is a statement about outcomes. Documentation that cites its source accurately is documentation that can be checked — that is the claim, and it is the only one worth making.