Is NIS2 in force in Malta?

Yes. The Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, S.L. 460.41, was made as Legal Notice 71 of 2025, and every provision has applied since 23 January 2026, the date set by the Commencement Notice, Legal Notice 22 of 2026. Legal Notice 89 of 2026 amended it. The European Commission closed its infringement case against Malta on 8 October 2025.

Who supervises NIS2 entities in Malta?

The CIP Department, the national supervisory authority and single point of contact (art. 7(1)), except for digital infrastructure, digital providers and postal services, which the Malta Communications Authority supervises (First and Second Schedules). The CIP Department runs the national self-registration mechanism (art. 7(4)) and approves the qualified auditors (art. 14), and an Enforcement Committee decides on fines on its report (art. 33(1)).

Where does a Maltese entity notify a significant incident?

To the national CSIRT within the Malta Information Technology Agency, for every sector, 'immediately' (art. 8(1), art. 20(1)); the CSIRT informs the CIP Department and the sector's authority. The clock runs from becoming aware of the significant incident: an early warning within 24 hours, an incident notification within 72 hours, an intermediate report if the CSIRT asks and a final report one month after the notification, with a progress report if the incident is still ongoing then (art. 20(5)); trust service providers notify within 24 hours (art. 20(6)). The Order sets no reporting portal or address, and Reglyze names none until an official page does.

What does the Maltese Order require beyond the directive's measures?

Every essential and important entity receives CSIRT monitoring services from an internal or an outsourced ('autonomous') CSIRT and names it when registering (arts. 19(1)(d), 7(4)(b)); appoints a security liaison officer with the necessary expertise (art. 19(1)(c)); appoints a qualified auditor, independent and approved by the CIP Department, who verifies the measures (art. 14); and applies an eleventh measure, logging and traceability of network and information systems (art. 19(2)(k)).

Does a Maltese domain name registrar fall under the Order?

Yes, at any size (art. 3(5)), for the duties the Order gives registrars: registration on the CIP Department's self-registration mechanism (art. 7(4)), the Article 27 information (art. 24) and the domain registration data, with access requests answered within 72 hours (art. 25(5)). A registrar is not a type of either Schedule, and article 4 classifies it neither as essential nor as important.

← Back to Reglyze

Transposed & Enforced

NIS2 in Malta

Everything you need to know about the NIS2 directive in Malta: transposition law, competent authority, incident reporting, deadlines, and how Reglyze helps SMEs become compliant.

Malta transposed NIS2 with the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, S.L. 460.41, in force since 23 January 2026. The CIP Department supervises and runs the national self-registration mechanism, the Malta Communications Authority supervises digital infrastructure, and every significant incident goes 'immediately' to the national CSIRT within the Malta Information Technology Agency. The Order adds national duties that bind important entities as much as essential ones: CSIRT monitoring, a security liaison officer, a qualified auditor approved by the CIP Department and an eleventh measure, logging.

Key facts at a glance

Transposition Law

Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, S.L. 460.41 (Legal Notice 71 of 2025)

In force since: 2026-01-23

Competent Authority

Critical Infrastructure Protection Department (CIP Department)

https://legislation.mt/eli/sl/460.41/eng

Start now in Malta: nothing to redo later

Reglyze runs your Malta NIS2 compliance on the EU baseline today: scoping, the AI-guided assessment, AI-drafted documents and incident notification to the national CSIRT within the Malta Information Technology Agency (MITA).

Your national rules (Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, S.L. 460.41 (Legal Notice 71 of 2025)) layer national specifics on top of NIS2. When they apply to you, what you have built carries straight over: your scores, your documents and your evidence are kept, not reset. You simply add the national layer (registration with CIP Department and local incident notification) onto your existing work. You never start from scratch.

Priority sectors for NIS2 in Malta

NIS2 covers 18 sectors across Annex I (highly critical) and Annex II (other critical); the class depends on the annex and the size together, and an Annex II entity is never essential by its size alone. These are the sectors where Malta's transposition and CIP Department supervision focus most.

Digital infrastructure, digital providers and postal services

The Malta Communications Authority, not the CIP Department, supervises these sectors (First Schedule, point 8; Second Schedule, points 1 and 6). Public electronic communications providers are in scope at any size and essential from medium size (arts. 3(3)(a), 4(1)(c)); qualified trust service providers, TLD registries and DNS providers are essential at any size (art. 4(1)(b)). A trust service provider notifies a significant incident within 24 hours of becoming aware of it (art. 20(6)).

Government entities and local councils

Government entities established under national law are in scope at any size and essential (arts. 3(3)(f), 4(1)(d)); a local council comes in only if a risk assessment finds that the disruption of its services may have a significant impact (art. 3(3)(f)). The First Schedule adds a national public administration type: entities providing broadcasting and transmission services for essential and emergency services, including public safety alerts. Public administration entities in national security, public security, defence or law enforcement are outside the Order (art. 3(7)).

Former operators of essential services and critical entities

Operators of essential services identified before 16 January 2023 stay essential entities (art. 4(1)(g)), and critical entities identified under Directive (EU) 2022/2557 are in scope at any size (art. 3(4)) and essential (art. 4(1)). Like every entity in scope, they register naming the CSIRT that monitors them, appoint a security liaison officer and a qualified auditor approved by the CIP Department, and log and trace their network and information systems (arts. 7(4), 14, 19).

Key deadlines

2025-04-08

The Order was made as Legal Notice 71 of 2025, under article 4(2) of the European Union Act, leaving its commencement to a notice of the Minister responsible for critical infrastructure protection (art. 1(3)).

2025-10-08

The European Commission closed its NIS2 infringement case against Malta, INFR(2024)0286, opened by a formal notice of 27 November 2024.

2026-01-23

Every provision of the Order came into force, on the date set by the Commencement Notice, Legal Notice 22 of 2026. Legal Notice 89 of 2026 has amended it since.

Is your company in scope? Common Malta scenarios

Two worked examples of how NIS2 scoping plays out in Malta. Not sure where you land? Run the free NIS2 scope checker.

A 5-person Maltese DNS provider

Essential entity, whatever its size

DNS service providers are in scope and essential regardless of size (arts. 3(3)(a), 4(1)(b)). It registers on the CIP Department's self-registration mechanism, naming the CSIRT that monitors it and whether that CSIRT is internal or autonomous (art. 7(4)), files the Article 27 list (art. 24), appoints a security liaison officer and a qualified auditor approved by the CIP Department, and notifies significant incidents to the national CSIRT within 24 and 72 hours of becoming aware of them (art. 20(5)). The Malta Communications Authority supervises it.

A Maltese MSP with 20 staff and EUR 3 million turnover

Out of scope as a small enterprise

Managed service providers are a Scheduled type, but the size test applies: as a small enterprise under Recommendation 2003/361/EC it is outside the Order unless the CIP Department designates it on one of the grounds of art. 3(3)(b) to (e), such as being the sole provider in Malta of a service essential for critical societal or economic activities. Its customers in scope must still secure their supply chain, including their relationships with direct suppliers and service providers (art. 19(2)(d)).

What Malta businesses need to know

Malta transposed NIS2 with the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, S.L. 460.41, made as Legal Notice 71 of 2025 and in force since 23 January 2026 (Legal Notice 22 of 2026), and amended by Legal Notice 89 of 2026. The European Commission closed its infringement case INFR(2024)0286 on 8 October 2025.
The Critical Infrastructure Protection Department (CIP Department) is the national supervisory authority and single point of contact (art. 7(1)); the Malta Communications Authority supervises digital infrastructure, digital providers and postal services (First and Second Schedules).
Scope follows the directive: entities of the Scheduled types that are medium-sized or larger under Recommendation 2003/361/EC (art. 3(1)) and, at any size, public electronic communications providers, trust service providers, TLD registries and DNS providers (art. 3(3)(a)), government entities, critical entities (art. 3(4)) and domain name registration services (art. 3(5)). Local councils are in only if a risk assessment finds that the disruption of their services may have a significant impact (art. 3(3)(f)).
Essential entities are large First Schedule entities, qualified trust service providers, TLD registries and DNS providers of any size, electronic communications providers from medium size, government entities, entities designated as essential, critical entities and the operators of essential services identified before 16 January 2023 (art. 4(1)); every other Scheduled entity in scope is important (art. 4(2)).
Three national duties bind important entities as much as essential ones: CSIRT monitoring services from an internal or an outsourced ('autonomous') CSIRT, named at registration (arts. 19(1)(d), 7(4)); a security liaison officer who keeps the continuity plans, the risk assessments and the operator security plan and is the contact with the CIP Department (art. 19(1)(c)); and a qualified auditor, independent and approved by the CIP Department, who verifies the measures (art. 14). An eleventh measure, logging and traceability of network and information systems, sits next to the directive's ten (art. 19(2)(k)).
Essential and important entities, and domain name registration services, register on the CIP Department's national self-registration mechanism, naming the CSIRT that monitors them, and notify changes within two weeks (art. 7(4) and (5)); the digital types also file the Article 27 list, with changes within three months (art. 24).
Significant incidents go 'immediately' to the national CSIRT within the Malta Information Technology Agency, for every sector, and the CSIRT informs the CIP Department and the sector's authority (art. 8(1), art. 20(1)). The deadlines are the directive's, from becoming aware of the significant incident: an early warning within 24 hours, an incident notification within 72 hours, an intermediate report on the CSIRT's request and a final report one month after the notification (art. 20(5)); trust service providers notify within 24 hours (art. 20(6)). The Order sets no reporting portal or address, and none was found on an official page.
Management bodies approve the measures and oversee their implementation (art. 18(1)); their members 'are required to follow training in order to carry out their tasks', with no interval set, and employees are offered similar training on a regular basis (art. 18(3) and (4)).

How CIP Department enforces NIS2 in Malta

The CIP Department is the national supervisory authority (art. 7(1)) and the Malta Communications Authority supervises digital infrastructure, digital providers and postal services. Administrative fines are imposed not by the CIP Department but by an Enforcement Committee, on the entities the CIP Department reports to it (art. 33(1)), and a decision can be appealed to the Administrative Review Tribunal within 20 days of its service (art. 41(1)). In an essential entity, a person discharging managerial responsibilities as chief executive or legal representative can be temporarily prohibited from exercising managerial functions (art. 31(10)(b)), and the legal representative of an essential or important entity is liable for breach of his duties when the entity does not comply (art. 37(1)). The measures themselves are verified by the qualified auditor each entity appoints, independent and approved by the CIP Department (art. 14).

NIS2 in Malta: frequently asked questions

Is NIS2 in force in Malta?: Yes. The Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, S.L. 460.41, was made as Legal Notice 71 of 2025, and every provision has applied since 23 January 2026, the date set by the Commencement Notice, Legal Notice 22 of 2026. Legal Notice 89 of 2026 amended it. The European Commission closed its infringement case against Malta on 8 October 2025.
Who supervises NIS2 entities in Malta?: The CIP Department, the national supervisory authority and single point of contact (art. 7(1)), except for digital infrastructure, digital providers and postal services, which the Malta Communications Authority supervises (First and Second Schedules). The CIP Department runs the national self-registration mechanism (art. 7(4)) and approves the qualified auditors (art. 14), and an Enforcement Committee decides on fines on its report (art. 33(1)).
Where does a Maltese entity notify a significant incident?: To the national CSIRT within the Malta Information Technology Agency, for every sector, 'immediately' (art. 8(1), art. 20(1)); the CSIRT informs the CIP Department and the sector's authority. The clock runs from becoming aware of the significant incident: an early warning within 24 hours, an incident notification within 72 hours, an intermediate report if the CSIRT asks and a final report one month after the notification, with a progress report if the incident is still ongoing then (art. 20(5)); trust service providers notify within 24 hours (art. 20(6)). The Order sets no reporting portal or address, and Reglyze names none until an official page does.
What does the Maltese Order require beyond the directive's measures?: Every essential and important entity receives CSIRT monitoring services from an internal or an outsourced ('autonomous') CSIRT and names it when registering (arts. 19(1)(d), 7(4)(b)); appoints a security liaison officer with the necessary expertise (art. 19(1)(c)); appoints a qualified auditor, independent and approved by the CIP Department, who verifies the measures (art. 14); and applies an eleventh measure, logging and traceability of network and information systems (art. 19(2)(k)).
Does a Maltese domain name registrar fall under the Order?: Yes, at any size (art. 3(5)), for the duties the Order gives registrars: registration on the CIP Department's self-registration mechanism (art. 7(4)), the Article 27 information (art. 24) and the domain registration data, with access requests answered within 72 hours (art. 25(5)). A registrar is not a type of either Schedule, and article 4 classifies it neither as essential nor as important.

Official sources

Primary references for NIS2 in Malta. Verify the latest text and deadlines directly with the authority.

Ready to become NIS2 compliant in Malta?

Reglyze is the AI-powered NIS2 compliance platform built for European SMEs. Start free: scoping, gap assessment, and policy generation tailored to CIP Department requirements.