{"id":49938,"date":"2025-07-09T13:38:59","date_gmt":"2025-07-09T13:38:59","guid":{"rendered":"https:\/\/my.legal500.com\/developments\/?post_type=legal_developments&p=49938"},"modified":"2025-07-09T13:38:59","modified_gmt":"2025-07-09T13:38:59","slug":"malta-transposes-nis-2-directive-into-national-law-through-ln-71-of-2025","status":"publish","type":"legal_developments","link":"https:\/\/my.legal500.com\/developments\/thought-leadership\/malta-transposes-nis-2-directive-into-national-law-through-ln-71-of-2025\/","title":{"rendered":"Malta Transposes NIS 2 Directive into National Law through LN 71 of 2025"},"content":{"rendered":"

The NIS 2 Directive, the European Union\u2019s latest legislative instrument aimed at enhancing cybersecurity resilience across the bloc, has officially been transposed into Maltese law. This was done through\u00a0Legal Notice 71 of 2025<\/a>, published on\u00a08 April 2025.<\/strong><\/p>\n

<\/p>\n

This landmark regulation significantly broadens the scope of cybersecurity obligations across a range of critical and high-impact sectors. These include\u00a0Energy, Transport, Health, Pharmaceuticals, Drinking Water manufacture, supply and distribution, Manufacturing, and Online Marketplaces<\/strong>, among others.<\/p>\n

The legislation introduces a stronger and more harmonised framework for the protection of network and information systems, reflecting the EU\u2019s strategic push to mitigate growing cyber threats in an increasingly digital and interconnected landscape.<\/p>\n

Snapshot of Key Obligations for Essential and Important Entities:<\/em><\/p>\n

Entities falling under the \u201cessential\u201d or \u201cimportant\u201d category as defined by the law are now subject to a set of stringent compliance requirements, including:<\/p>\n

    \n
  1. Registration\u00a0<\/strong>\u2013 Obligatory inclusion in the national registry of essential and important entities.<\/li>\n
  2. Governance\u00a0<\/strong>\u2013 Implementation of clear internal structures for cybersecurity oversight and accountability, including training.<\/li>\n
  3. Risk Management Measures<\/strong>\u00a0\u2013 Adoption of technical, operational and organisational measures to manage risks to their network and information systems, including policies on risk analysis, incident handling, supply chain security, network and information systems acquisition, development and maintenance, and human resources security, coupled with CSIRT services.<\/li>\n
  4. Incident Reporting<\/strong>\u00a0\u2013 Timely notification of significant cyber incidents to the competent national authority.<\/li>\n
  5. Appointment of a Qualified Auditor<\/strong>\u00a0to verify that the necessary measures have been implemented.<\/li>\n<\/ol>\n

    Entities operating within the affected sectors are advised to familiarise themselves with the new obligations and initiate compliance planning without delay.<\/p>\n

    For tailored advice or further information on how this law may impact your organisation, contact us on nis@ganado.com directly.<\/p>\n","protected":false},"featured_media":0,"template":"","class_list":["post-49938","legal_developments","type-legal_developments","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/my.legal500.com\/developments\/wp-json\/wp\/v2\/legal_developments\/49938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/my.legal500.com\/developments\/wp-json\/wp\/v2\/legal_developments"}],"about":[{"href":"https:\/\/my.legal500.com\/developments\/wp-json\/wp\/v2\/types\/legal_developments"}],"wp:attachment":[{"href":"https:\/\/my.legal500.com\/developments\/wp-json\/wp\/v2\/media?parent=49938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}