L.S. 460.24(R) Ordni dwar Infrastruttura Kritika u Infrastruttura Kritika Ewropea (Identifikazzjoni,Indikazzjoni u Protezzjoni) Imħassar bl-Avviż Leg

(1)The title of this order is the Critical Infrastructures and European Critical Infrastructures (Identification, Designation and Protection) Order. Citation and scope.

(2)The purpose of this Order is the transposition of Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.

1. In this Order: "critical infrastructure" or "CI" means an asset, system or part thereof located in Malta which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions; "Department" means the Critical Infrastructure Protection Department established by article 3; "the Directive" means Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection, as may be amended from time to time; "European critical infrastructure" or "ECI" means critical infrastructure located in Malta the disruption or destruction of which would have a significant impact on at least two Member States. The significance of the impact shall be assessed in terms of cross-cutting criteria which shall include effects resulting from cross-sector dependencies on other types of infrastructure; "Member State" means a Member State of the European Union; "owners or operators of CIs" means those entities responsible for investments in, and, or day-to-day operation of, a particular asset, system or part thereof designated as a CI or an ECI under this Order; "protection" means all activities aimed at ensuring the functionality, continuity and integrity of critical infrastructures in order to deter, mitigate and neutralise a threat, risk or vulnerability; *These regulations have been repealed by Legal Notice 5 of
2. Interpretation. Amended by: L.N. 306 of
3. 2 CRITICAL INFRASTRUCTURES AND EUROPEAN CRITICAL INFRASTRUCTURES (IDENTIFICATION, DESIGNATION AND PROTECTION) [ S.L.460.24 "risk analysis" means consideration of relevant threat scenarios in order to assess the vulnerability and the potential impact of disruption or destruction of critical infrastructure; "sensitive critical infrastructure protection related information" means facts about a critical infrastructure, which if disclosed could be used to plan and act with a view to causing disruption or destruction of critical infrastructure installations; Critical Infrastructure Protection Department. Amended by: L.N. 411 of 2017; L.N. 306 of
4. 3.

(1)There shall be a Government department to be known as the Critical Infrastructure Protection Department which shall have such functions as are assigned to it by law, including those set out in this order.

(2)The Department shall be entrusted with the powers and duties provided for in this Order.

(3)The Department shall, inter alia, be responsible for (

1. a)establishing the criteria for the identification and designation of CIs; (
2. b)identifying critical assets and maintaining a national inventory for CIs; (
3. c)ensuring that a risk assessment is carried out by all owners or operators of CIs; (
4. d)ensuring that each owner or operator of a CI draws up and maintains an Operator Security Plan; (
5. e)collating a national critical infrastructure plan; (
6. f)instigating simulated runs of sectoral emergency plans; (
7. g)collaborating with the European international partners on CIP; and Union and (
8. h)building partnerships with operators of CIs for information-sharing.

(4)The Department shall furthermore act as the European critical infrastructure protection contact point ("ECIP contact point") in Malta, and shall coordinate European critical infrastructure protection issues within Malta, with other Member States, and with the European Commission: Provided that the provisions of this sub-article shall not p re c lu de o th e r na t i on a l a u th o ri ti e s f ro m b e i ng i n vo lv e d i n European critical infrastructure protection issues. Amended by: L.N. 411 of 2017.

(5)The Department shall also perform such related and consequential duties as the Minister responsible for Home Affairs may delegate from time to time. Identification of ECIs. 4.

(1)The Department shall, in accordance with the procedure set out in the Schedule, identify potential European Critical Infrastructures in Malta which (

1. a)satisfy the cross-cutting and sectoral criteria set out in this article; and CRITICAL INFRASTRUCTURES AND EUROPEAN CRITICAL INFRASTRUCTURES (IDENTIFICATION, DESIGNATION AND PROTECTION) [ S.L.460.24 (
2. b)meet the definitions of the terms "critical infrastructure" and "European critical infrastructure" in article 2.

(2)The cross-cutting criteria referred to in sub-article

(1)shall comprise the following: (

1. a)casualties criterion, assessed in terms of the potential number of fatalities or injuries; (
2. b)economic effects criterion, assessed in terms of the significance of economic loss and, or degradation of products or services, including potential environmental effects; (
3. c)public effects criterion, assessed in terms of the impact on public confidence, physical suffering and disruption of daily life, including the loss of essential services.

(3)The thresholds applicable to the cross-cutting criteria shall be determined on a case-by-case basis by the Department, and shall be based on the severi ty of the impact of the disrupt ion or destruction of a particular critical infrastructure.

(4)The Department shall inform the European Commission on an annual basis of the number of infrastructures per sector for which discussions were held concerning the cross-cutting criteria thresholds.

(5)The sectoral criteria referred to in sub-article

(1)shall (

1. a)take into account the characteristics of individual ECI sectors; and (
2. b)be classified.

(6)In applying the cross-cutting and sectoral criteria with a view to identifying ECIs, the Department may use such guidelines and thresholds as are developed by the European Commission together with the Member States pursuant to Article 3 of the Directive.

(7)The following sectors and subsectors shall be subject to this Order: (

1. a)the energy sector which is divided into the following subsectors: (
2. i)electricity, comprising infrastructures and facilities for generation and transmission of electricity in respect of supply of electricity, (
3. ii)oil, comprising oil production, refining, treatment, storage and transmission by pipelines, (iii) gas, comprising gas production, refining, treatment, storage and transmission by pipelines, and LNG terminals; and (
4. b)the transport sector which is divided into the following subsectors: 3 4 CRITICAL INFRASTRUCTURES AND EUROPEAN CRITICAL INFRASTRUCTURES (IDENTIFICATION, DESIGNATION AND PROTECTION) [ S.L.460.24 (
5. i)(
6. ii)(iii) (
7. iv)Designation of ECIs. road transport, air transport, ocean and short-sea shipping, and ports. 5.

(1)The Department shall inform the relevant authorities in other Member States which may be significantly affected by a potential ECI about its identity and the reasons for its designation as a potential ECI.

(2)A potential ECI located in Malta, which has passed through the procedure set out in the Schedule shall only be communicated to the Member States which may be significantly affected by that potential ECI.

(3)Where a potential ECI is located in Malta, the Department shall (

1. a)engage in discussions with the relevant authorities in other Member States which may be significantly affected by the potential ECI; and (
2. b)designate it as an ECI following an agreement between the Government of Malta and the Member States which may be significantly affected.

(4)Where a designated ECI is located in Malta, the Department shall inform the European Commission on an annual basis of the number of designated ECIs per sector and of the number of Member States dependent on each designated ECI, and only the Member States which may be significantly affected by an ECI shall know its identity.

(5)Where an ECI is located in Malta, the Department shall inform the owner or operator of the infrastructure concerning its designation as an ECI and such information shall be classified at an appropriate level.

(6)The process of identifying and designating ECIs under this Order shall be reviewed on a regular basis. Operator security plans. 6.

(1)The operator security plan ("OSP") procedure shall - (

1. a)identify the CI and ECI assets located in Malta; (
2. b)identify the security solutions that exist or are being implemented for their protection; and (
3. c)cover, as a minimum, the information set out in article 7.

(2)The Department shall assess whether each designated CI and ECI located in Malta possesses an OSP or has in place equivalent measures addressing the issues identified in article 7.

(3)If the Department finds that an OSP or equivalent measures have not been prepared, it shall ensure, by any measures deemed appropriate, that the OSP or equivalent measures are prepared addressing the issues identified in article 7: CRITICAL INFRASTRUCTURES AND EUROPEAN CRITICAL INFRASTRUCTURES (IDENTIFICATION, DESIGNATION AND PROTECTION) [ S.L.460.24 Provided that, where supervisory or oversight arrangements already exist in relation to a CI or an ECI located in Malta, such arrangements are not affected by the provisions of this article and the Department shall be the supervisor under those existing arrangements: Provided further that compliance with any measure, including a European Union measure, which in a particular sector requires, or refers to a need to have, a plan similar or equivalent to an OSP and oversight by the Department of such a plan, shall be deemed to satisfy all the requirements under this article.

(4)The Department shall ensure that the OSP or equivalent measures pursuant to this article are in place and are reviewed regularly within one year following designation of each CI and each ECI: Provided that the said period may be extended in exceptional circumstances, and the Department shall notify the European Commission of any extension granted in relation to an ECI pursuant to this sub-article. 7.

(1)The ECI OSP procedure referred to in article 6 shall cover at least the following matters: (

1. a)the identification of important assets; (
2. b)the conduct of a risk analysis based on major threat scenarios, vulnerability of each asset, and potential impact; and (
3. c)the identification, selection and prioritisation of counter-measures and procedures with a distinction between (
4. i)permanent security measures, which identify indispensable security investments and means which are relevant to be employed at all times. These shall include the information set out in sub-article

(2); and (ii) graduated security measures, which can be activated according to varying risk and threat levels.

(2)The information referred to in sub-article

(1)(c)(

1. i)is information concerning: (
2. a)general measures such as technical measures, including installation of detection, access control, protection and prevention means; (
3. b)organisational measures, including procedures for alerts and crisis management; (
4. c)control and verification measures; (
5. d)communication; (
6. e)awareness raising and training; and (
7. f)security of information systems. ECI OSP Procedure. 5 6 [ S.L.460.24 Security Liaison Officers. CRITICAL INFRASTRUCTURES AND EUROPEAN CRITICAL INFRASTRUCTURES (IDENTIFICATION, DESIGNATION AND PROTECTION) 8.

(1)The Department shall assess whether each designated ECI located in Malta possesses a Security Liaison Officer or equivalent, who shall act as the point of contact for security related issues between the owner or operator of the ECI and the Department.

(2)If the Department finds that a Security Liaison Officer or equivalent does not exist in relation to a designated ECI it shall ensure, by any measures deemed appropriate, that such a Security Liaison Officer or equivalent is designated: Provided that compliance with any measure, including a European Union measure, which in a particular sector requires, or refers to a need to have, a Security Liaison Officer or equivalent shall be deemed to satisfy all the requirements under this article.

(3)The Department shall implement an appropriate communication mechanism between itself and each Security Liaison Officer or equivalent, with the objective of exchanging relevant information concerning identified risks and threats in relation to the ECI concerned. This communication mechanism shall be without prejudice to the requirements concerning access to sensitive and classified information laid down by any other law. Reporting. 9.

(1)The Department shall conduct a threat assessment in relation to CI and ECI subsectors within one year following the designation of critical infrastructure in Malta as a CI or an ECI within those subsectors.

(2)Every two years the Department shall submit to the European Commission a classified report containing generic data on a summary basis on the types of risks, threats and vulnerabilities encountered per ECI sector in which an ECI has been designated under article 5. Sensitive critical infrastructure protection-related information. 10.

(1)Any person handling classified information pursuant to this Order on behalf of the Department or the Government of Malta shall have an appropriate level of security vetting to be determined by the Department.

(2)The Department shall ensure that sensitive critical infrastructure protection-related information submitted to it is not used for any purpose other than the protection of critical infrastructures.

(3)The provisions of this article shall also apply to non-written information exchanged during meetings at which sensitive subjects are discussed. CRITICAL INFRASTRUCTURES AND EUROPEAN CRITICAL INFRASTRUCTURES (IDENTIFICATION, DESIGNATION AND PROTECTION) [ S.L.460.24 7 SCHEDULE [Article 4] Procedure for the identification of critical infrastructures which may be designated as an ECI. In identifying critical infrastructures which may be designated as an ECI pursuant to article 4, the Department shall apply the following consecutive steps:

(1)In Step 1, the sectoral criteria referred to in article 4

(7)shall be applied in order to make a first selection of critical infrastructures within each sector.

(2)In Step 2, the definition of the term "critical infrastructure" in article 2 shall be applied to the potential ECI identified under Step 1. The significance of the impact shall be determined by using national methods for identifying critical infrastructures or with reference to the cross-cutting criteria set out in article 4

(2). For infrastructure providing an essential service, the availability of alternatives and the duration of disruption or recovery or both shall be taken into account.

(3)In Step 3, the trans-boundary element of the definition of "ECI" in article 2 shall be applied to the potential ECI that has passed the first two steps of this procedure. A potential ECI which does satisfy the definition shall follow the next step of the procedure. For infrastructure providing an essential service, the availability of alternatives and the duration of disruption or recovery or both shall be taken into account.

(4)In Step 4, the cross-cutting criteria set out in article 4

(2)shall be applied to the remaining potential ECIs. Such cross-cutting criteria shall take into account (

1. a)the severity of impact; (
2. b)for infrastructure providing an essential service, the availability of alternatives; and (
3. c)the duration of disruption or recovery or both. A potential ECI which does not satisfy the cross-cutting criteria shall not be considered to be an ECI.