Malta NIS2 Transposition

NIS2 implementation supervised by Malta Information Technology Agency and Malta Communications Authority. Priority focus on maritime cybersecurity given Malta flag state responsibilities.

JurisdictionMalta
CategoryCybersecurity
StatusActive
Latest development

Analysis

Malta has transposed NIS2 into national law via Legal Notice 71 of 2025 (Subsidiary Legislation 460.41 – Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025), with supervision led by the Critical Infrastructure Protection Department / CIIP Unit, and sectoral competent authorities expected for areas including maritime and communications.Malta - EU NIS2 Directive – Eversheds SutherlandAdoption of NIS2 in Malta – DeloitteNIS2 status Malta – nisd2.euNIS2 Directive – European Commission Malta page

Below is a structured, source‑linked analysis tailored to Malta’s NIS2 transposition and maritime cybersecurity focus.

Key Requirements

1. Scope and Entity Classification (Essential vs Important)

2. Cybersecurity Risk Management Measures (Article 21)

  • Entities must implement comprehensive technical and organisational cybersecurity measures aligned with NIS2 Article 21.
  • The Directive requires measures including risk analysis, incident handling, business continuity, supply‑chain security, security in network and information systems, MFA, and encryption.NIS2 Directive (EU) 2022/2555 – EUR‑Lex
  • A Malta‑focused guide outlines these Article 21 measures: risk analysis and security policies, incident management, business continuity and crisis management, supply chain security, use of secure communications, and MFA/encryption, applied to Maltese entities.NIS2 Directive in Malta – Resguard Solutions
  • The Maltese Draft Order (consultation text) closely follows NIS2 Article 21 and emphasises supply chain security and CSIRTMalta’s role in incident coordination.Malta’s NIS2 Public Consultation – GTGCSIRTMalta – Government of Malta

3. Incident Reporting Obligations and Timelines

4. Governance and Management Accountability

5. Registration and Supervisory Authority

6. Enforcement and Penalties

Compliance Challenges

1. Identifying In‑Scope Maritime and Communications Entities

  • Challenge: determining whether shipping companies, maritime service providers, ports, and communications operators meet the “essential” or “important” thresholds under Malta’s NIS2 transposition.
  • NIS2 Annex I/II designate transport (including maritime) and digital infrastructure/communications as key sectors.NIS2 Directive (EU) 2022/2555 – EUR‑Lex
  • Maltese guidance stresses the need for organisations to run applicability checks against NIS2 sector and size criteria, which can be complex for maritime groups with cross‑border operations.NIS2 status Malta – nisd2.euNIS2 Directive in Malta – Resguard Solutions

2. Integrating NIS2 with Existing Maritime Cyber Requirements

3. Incident Reporting Readiness

4. Supply Chain Security in Maritime and Communications

5. Real‑World Examples of Challenges

Implementation Best Practices

1. Conduct a Structured NIS2 Gap Assessment

2. Establish Governance and Board Oversight

3. Build Incident Response and Reporting Workflows

4. Strengthen Supply‑Chain Security

5. Use Recognised Frameworks and Tools

  • Frameworks:
  • ENISA NIS2 Implementation Guidance offers EU‑level best practices for operationalising NIS2 controls.ENISA NIS2 info page
  • ISO/IEC 27001 and ISO/IEC 27019 are frequently used to structure NIS2‑compliant ISMS, including in maritime and critical infrastructure contexts.ISO/IEC 27001 – ISO[ENISA Maritime Cybersecurity report](https://www.enisa.europa.eu/publications/maritime-cy

Recent developments

  • — Legal Notice 89 of 2026 updates Malta’s NIS2 transposition framework, creating an Enforcement Committee for administrative penalties, repositioning the national CSIRT under MITA, clarifying roles between the CIP Department and MCA (including expanded MCA responsibility for digital infrastructure), strengthening auditor independence, and updating the National Cyber Security Steering Committee.[8] (source)
  • — PwC reports that Malta’s NIS2 cybersecurity regulatory framework has formally come into force via a Legal Notice, with 23 January 2026 designated as the commencement date for all provisions under the Order; entities in scope are now fully subject to the enhanced NIS2 obligations, including incident reporting and governance requirements.[3] (source)
  • — The European Commission’s NIS2 transposition update of 7 May 2025 lists 19 Member States receiving reasoned opinions for failing to notify full NIS2 transposition, and Malta is notably absent from this list, indicating it had already notified its transposition measures and thereby avoided escalation to Court of Justice proceedings.[6][7] (source)
  • — NISD2.eu notes that Malta transposed NIS2 through Legal Notice 71 of 2025 (Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, S.L. 460.41), published in the Government Gazette on 8 April 2025, after missing the 17 October 2024 deadline but before the Commission’s May 2025 reasoned opinions against other Member States.[7] (source)
  • — GVZH Advocates explain that Legal Notice 71 of 2025 transposes the NIS2 Directive into Maltese law as S.L. 460.41, designates the Critical Infrastructure Protection Department as single point of contact and supervisory authority, and sets up a national register of essential and important entities to be established by 30 October 2025, with extensive supervisory and enforcement powers including high administrative fines.[9] (source)
  • — Mamo TCV provides analysis of Malta’s NIS2 transposition via Legal Notice 71 of 2025, outlining its sectoral scope (including energy, transport, banking, health, digital infrastructure, public administration, and space), incident reporting timelines (early warning within 24 hours, notification within 72 hours), and the roles of the Critical Infrastructure Protection Department and Malta Communications Authority as competent authorities.[5] (source)
  • — The European Commission’s country page for Malta confirms NIS2 implementation details, identifying the Critical Information Infrastructure Protection Unit as the single point of contact and CSIRTMalta as the national CSIRT, which together underpin Malta’s operational NIS2 governance and cross‑border coordination framework.[4][7] (source)
  • — NISD2.eu outlines the practical compliance sequence for entities in Malta under NIS2—running applicability checks, registering with the competent authority, and maintaining ongoing duties on incident reporting, supply chain risk, and management body oversight—emphasizing that significant incidents require early warning within 24 hours, notification within 72 hours, and a final report within one month.[7] (source)
  • — GVZH notes that Malta’s NIS2 regime mirrors the Directive’s maximum administrative penalties (up to €10 million or 2% of global turnover for essential entities, and up to €7 million or 1.4% for important entities), with CIP Department enforcement tools such as warnings, binding instructions, cease‑and‑desist orders, and mandated CSIRT monitoring services, which the industry views as a materially stricter enforcement landscape.[9] (source)
  • — A NIS2 transposition tracker reports that on 28 November 2024 the Commission opened infringement procedures against 23 Member States, including Malta, for failing to fully transpose NIS2 by the 17 October 2024 deadline, sending letters of formal notice and highlighting Malta’s initial delay in meeting its obligations.[2] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates