NIS2 obligations in Malta

Competent authority & CSIRT Legal ref: Art. 5, 7, 12

• Critical Infrastructure Protection Advisory Board. ecs-org.eu · 28 Oct 2026 · secondary source
• Critical Infrastructure Protection Department. ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT Malta. ecs-org.eu · 28 Oct 2026 · secondary source
• The Malta Communications Authority and the Malta Financial Services Authority are sectoral authorities. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 3,4; Annex I, II

• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Part 2, Article 24

• Entities in scope are required to register through the national self-registration mechanism, submitting the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification. ecs-org.eu · 28 Oct 2026 · secondary source
• Address the entity’s main establishment and other legal establishments in the EU or, if not established in the EU, of its designated representative. ecs-org.eu · 28 Oct 2026 · secondary source
• Up-to-date contact details, including email addresses and telephone numbers of the entity and, where applicable, its representative. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• IP ranges. ecs-org.eu · 28 Oct 2026 · secondary source
• List of used computer, network and operational technology resources. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 20

• Entities shall inform the competent CSIRT of significant incidents. ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours, plus an initial impact assessment, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report, and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident reporting obligations will be valid after 9 months from informing the entities about their inclusion in the list of essential and important entities provided by the national authority. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 32

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 21

• Malta recognises the Belgian Cyber Fundamentals Framework, being part of the Cyber Fundamentals Scheme Owner Group together with Belgium, Ireland, and Romania. ecs-org.eu · 28 Oct 2026 · secondary source
• Reference to international and European standards. ecs-org.eu · 28 Oct 2026 · secondary source
• Malta’s NIS2 transposition requires a documented, living risk analysis process covering governance, supply chain, technical, operational, and organisational measures. The framework must be approved by management, exercised, continuously updated, and audit-ready. Malta’s Supervisory Authority (CIPD) can audit risk analysis results. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

No dated changes recorded.