NIS2 in Malta: who is in scope and what the law requires

Malta transposed NIS2 with Legal Notice 71 of 2025, the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order (S.L. 460.41), in force since 23 January 2026. It covers medium-sized and larger organisations in the directive's sectors, plus some entities of any size. The Critical Infrastructure Protection Department supervises, and the Order adds duties the directive does not set.

This guide is for IT managers, CISOs and compliance officers of organisations established in Malta, including Maltese subsidiaries of foreign groups. It follows the Maltese text as consolidated on legislation.mt and points to the matching articles of Directive (EU) 2022/2555.

The Maltese law, in short

• Instrument: Legal Notice 71 of 2025, made under the European Union Act (Cap. 460) and published in the Government Gazette on 8 April 2025. It is now Subsidiary Legislation 460.41, and it repealed the earlier Measures for High Common Level of Security of Network and Information Systems Order (S.L. 460.35).
• Commencement: the Order came into force only when the Minister set a date. Legal Notice 22 of 2026, a commencement notice, brought all its provisions into force on 23 January 2026.
• Amendment: Legal Notice 89 of 2026, published on 7 April 2026, moved the national CSIRT to the Malta Information Technology Agency (MITA), replaced the Advisory Board with an Enforcement Committee that imposes fines, and rewrote the schedules so that each sector names its competent authority.

Malta published the Order after 17 October 2024, the date by which Member States were due to adopt their transposing measures under Article 41 of the directive. For an organisation in scope today, the date that matters is 23 January 2026.

Who is in scope

Article 3 of the Order follows Article 2 of the directive. It applies to public or private entities of a type listed in the First or Second Schedule (the equivalent of Annexes I and II of the directive) that are medium-sized enterprises or larger under Commission Recommendation 2003/361/EC, and that provide services or carry out activities in the Union.

Under the Recommendation, an enterprise stops being small when it has at least 50 staff, or when both its annual turnover and its balance sheet total exceed EUR 10 million.

The First Schedule covers energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (managed service and managed security service providers), public administration and space. The Second Schedule covers postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery, vehicles, other transport equipment), digital providers and research organisations.

Some entities are in scope regardless of size: providers of public electronic communications networks or services, trust service providers, TLD name registries, DNS service providers and domain name registration services, central government entities, entities identified as critical entities under Directive (EU) 2022/2557, and entities that are the sole provider in Malta of an essential service or that the authority identifies on grounds of criticality.

Essential or important

Article 4 of the Order sorts entities into two categories, as Article 3 of the directive does. Essential entities include First Schedule entities that exceed the medium-sized ceilings (250 staff or more, or turnover above EUR 50 million together with a balance sheet above EUR 43 million), qualified trust service providers, TLD name registries and DNS service providers of any size, medium-sized telecoms providers, critical entities, and operators of essential services identified before 16 January 2023. Every other in-scope entity is important.

The category changes the supervision. Essential entities are subject to proactive supervision, including on-site inspections and regular audits; important entities are supervised after the fact, when there is evidence of non-compliance.

Group companies and size

A common mistake is to measure size on the Maltese company alone. Article 6 of the Annex to the Recommendation adds 100% of the data of linked enterprises, and a proportional share of partner enterprises. A Maltese subsidiary with 30 employees, controlled by a group that exceeds the ceilings, can therefore be in scope as a medium-sized or large entity.

Financial entities and DORA

Where a sector-specific EU act sets cybersecurity measures and incident reporting at least equivalent to those of the Order, those provisions of the Order do not apply (Article 3(16) of the Order, Article 4 of the directive). Recital 28 of the directive names Regulation (EU) 2022/2554, DORA, as that act for financial entities. A Maltese bank or financial market infrastructure covered by DORA works mainly under that framework: we explain it on the DORA compliance page.

Which country's law applies

Under Article 23 of the Order and Article 26 of the directive, an entity falls under the jurisdiction of the Member State where it is established. A group with companies in Malta and in other Member States therefore deals with more than one national law. There are three exceptions. Providers of public electronic communications networks or services fall under the Member State where they provide their services; public administration entities fall under the Member State that established them; and DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, and providers of online marketplaces, online search engines and social networking services platforms fall under the Member State of their main establishment in the Union, the one where decisions on cybersecurity risk-management measures are predominantly taken.

Who supervises

• Critical Infrastructure Protection Department (CIP Department): the national supervisory authority and single point of contact, responsible for most sectors in both schedules, including energy, transport, health and ICT service management.
• Malta Communications Authority (MCA): the competent authority named in the schedules for digital infrastructure, postal and courier services, and digital providers.
• National CSIRT: established within MITA since Legal Notice 89 of 2026. It receives incident notifications.
• Enforcement Committee: decides on administrative fines on request of the CIP Department or the competent authority. Its decisions can be appealed to the Administrative Review Tribunal within 20 days.

What the Order requires

The management body is accountable

Article 18 of the Order mirrors Article 20 of the directive: the management body approves the cybersecurity risk-management measures, oversees their implementation, and its members can be held liable for infringements. Members of the management body follow training. The Maltese text goes a step further than the directive on employees: entities offer similar training to their staff on a regular basis, where the directive only asks Member States to encourage it.

Eleven risk-management measures

Article 19(2) of the Order takes the ten measures of Article 21(2) of the directive and adds an eleventh. The measures follow an all-hazards approach and include at least:

1. policies on risk analysis and information system security;
2. incident handling;
3. business continuity, such as backup management and disaster recovery, and crisis management;
4. supply chain security, including the relationship with direct suppliers and service providers;
5. security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure;
6. policies and procedures to assess the effectiveness of the measures;
7. basic cyber hygiene practices and cybersecurity training;
8. policies on cryptography and, where appropriate, encryption;
9. human resources security, access control, asset management and, in the Maltese text, an insider risk management policy;
10. multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communications, where appropriate;
11. logging and traceability of network and information systems, which the directive does not list.

Duties specific to Malta

Beyond the directive, the Maltese Order asks essential and important entities to:

• Appoint a security liaison officer (Article 19(1)(c)) with the necessary expertise, who supports business continuity plans, keeps risk assessments and the operator security plan up to date, and acts as the point of contact with the CIP Department or competent authority.
• Receive CSIRT monitoring services (Article 19(1)(d)) from an internal CSIRT or an autonomous, that is outsourced, CSIRT. Either one meets the requirements of Article 9(1), such as continuous availability, redundant systems and trained staff, and carries out the tasks of Article 10: real-time or near real-time monitoring, early warnings, incident response, forensic analysis and proactive vulnerability scanning.
• Appoint a qualified auditor (Article 14) who verifies whether the measures of Article 19 are in place. The CIP Department or competent authority approves the appointment: the auditor demonstrates independence, a background check, a recognised cybersecurity certification and experience. For essential entities, audit results are among the evidence the authority can request.
• Maintain an operator security plan and business continuity plans, which the CIP Department can ask to see and to test through simulated runs.

Registration

Essential and important entities providing services in Malta register on the national self-registration mechanism of the CIP Department (Article 7(4)). They provide their name, the CSIRT that monitors them and whether it is internal or autonomous, address and contact details including IP ranges, sector and sub-sector, and the Member States where they provide services. Changes are notified within two weeks. Digital providers such as cloud and managed service providers submit additional information under Article 24, and notify changes within three months.

Incident reporting

Article 20 of the Order follows Article 23 of the directive. Notifications of significant incidents go to the national CSIRT, which informs the CIP Department and the competent authority. An incident is significant when it has caused, or can cause, severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others.

• Within 24 hours of becoming aware: an early warning, indicating whether the incident may be caused by unlawful or malicious acts or have a cross-border impact.
• Within 72 hours: an incident notification with an initial assessment of severity and impact and, where available, indicators of compromise.
• On request: an intermediate report on status updates.
• Within one month of the notification: a final report with description, root cause, mitigation measures and any cross-border impact, or a progress report if the incident is still ongoing.

Trust service providers notify within 24 hours for incidents affecting their trust services. The 24-hour clock runs from awareness, so it depends on detection: this is where CSIRT monitoring and reporting meet.

Fines and enforcement

For infringements of Articles 19 or 20, Article 32 of the Order sets fines of up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, for essential entities, and up to EUR 7 million or 1.4% for important entities: Article 34 of the directive requires maximum fines of at least these amounts. The Enforcement Committee can add a daily penalty of EUR 100 for each breach that continues after a prior decision.

Towards essential entities the authority also has non-financial powers (Articles 29(6) and 31(10)): binding instructions, orders to register or to receive CSIRT monitoring services, a monitoring officer and, for essential entities, a request to temporarily prohibit the person discharging the responsibilities of chief executive officer or legal representative from exercising managerial functions until the deficiencies are remedied.

Where to start

1. Check scope and category with group data, not only the Maltese company's figures, and decide which national law applies to each company.
2. Register on the CIP Department's self-registration mechanism and keep the details current.
3. Appoint the security liaison officer and decide how you will receive CSIRT monitoring services, internally or through an autonomous CSIRT.
4. Run a gap analysis against the eleven measures of Article 19(2), including logging and insider risk, and take the plan to the management body for approval.
5. Write the incident procedure around the 24 hours, 72 hours and one month, with the national CSIRT as recipient.
6. Select a qualified auditor and prepare the evidence: operator security plan, business continuity plans, policies, training records.

We work with mid-market organisations on each of these steps, from the applicability check to 24/7 detection and response. How we approach the directive is described on our NIS2 consulting page. If you want to understand where your Maltese entity stands, talk to us.

In short: NIS2 has applied in Malta since 23 January 2026 through S.L. 460.41. It covers medium-sized and larger entities in the scheduled sectors, measured with group data, plus some entities of any size. The CIP Department supervises, MITA hosts the national CSIRT, and the Maltese text adds a security liaison officer, CSIRT monitoring services, an approved qualified auditor and an eleventh measure on logging, on top of the directive's governance, risk-management and 24/72-hour reporting duties.