NIS2 Malta: Compliance, Authorities & Key Requirements
Understand how Malta implements the NIS2 Directive (EU) 2022/2555, which entities are in scope, how registration works, who supervises compliance, and the key steps to get ready.
Introduction: NIS2 Directive & the Maltese context
The NIS2 Directive strengthens cybersecurity across the EU. Malta has transposed NIS2 via Legal Notice 71 of 2025 — Measures for a High Common Level of Cybersecurity Across the European Union (Malta) Order (S.L. 460.41), effective 8 April 2025. If you operate in Malta (or offer services there), assess whether you are an essential or important entity and prepare accordingly.
NIS2 Directive implementation in Malta
Malta transposed NIS2 through Legal Notice 71 of 2025 (S.L. 460.41), in force since 8 April 2025.
Status
Transposed; in force since 8 April 2025.
Legal instrument
Measures for a High Common Level of Cybersecurity Across the EU (Malta) Order — Legal Notice 71 of 2025.
Registration
Register operated by the Critical Infrastructure Protection Department (CIP Department). Target operational by 30 October 2025.
| Category | Notes |
|---|---|
| Essential sectors | Energy, transport, banking & FMIs, health, drinking & wastewater, digital infrastructure, public administration. |
| Important sectors | Postal & courier, waste management, food, manufacturing, chemicals, digital providers, research. |
| Size criteria | Typical NIS2 baselines: Essential ≥250 employees or >€50m turnover (or >€43m balance sheet). Important ≥50 employees or >€10m turnover. |
| Exclusions | Certain bodies relating to national security, defence, and law enforcement are excluded. |
NIS2 Malta: what you need to know about compliance & certification
Malta follows NIS2’s two-tier model (Essential / Important) and applies EU size criteria in line with the directive.
Obligations
- Risk management & security policy across IT/OT
- Incident handling & reporting (24h early warning, 72h initial, 1-month final)
- Business continuity & crisis management
- Supply-chain security & vendor risk
- Vulnerability disclosure (VDP) & secure development
- Executive/board accountability & training
Standards & alignment
No single certification mandated. Alignment with ISO/IEC 27001:2023, NIST CSF 2.0, and relevant sector standards (e.g., IEC 62443) is recommended.
Evidence & audits
Maintain policies, risk registers, supplier due diligence, incident logs, and training records to demonstrate compliance during supervisory checks.
National NIS2 timeline & key dates
Sector-specific notes (Malta)
- Public administration: most administrative bodies are covered; exclusions apply for defence, law enforcement, and national security bodies.
- Digital infrastructure & providers: DNS, TLD, cloud, data centres, CDNs — typically in scope, often irrespective of size.
- Finance/health/energy: expect alignment with parallel EU regimes (e.g., DORA in finance) and sectoral guidance.
Penalties for non-compliance
In line with NIS2, Malta provides turnover-based fines:
- Essential entities: up to €10m or 2% of global turnover (whichever higher).
- Important entities: up to €7m or 1.4% of global turnover (whichever higher).
Supervisory powers include audits, binding orders, and, in serious cases, service restrictions.
How to prepare for NIS2 in Malta
- Determine scope: confirm Annex I/II services and size thresholds; classify EE/IE.
- Prepare for registration: compile entity details to register with the CIP Department once the portal opens.
- Governance: secure board-level accountability and budget for cybersecurity.
- Risk management: map and implement controls aligned to Article 21 (IT/OT, VDP, BC/DR).
- Supply chain: assess MSPs/MSSPs and critical suppliers; add contractual security requirements.
- Incident readiness: implement detection, escalation and 24/7 reporting workflow to CSIRT-Malta (24h/72h/1-month).
- Train & evidence: leadership training, staff awareness, and auditable records.