Cyber Reporting Updates

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Cyber Reporting Updates This Circular is an update to Circular titled Cyber Reporting Management System (CRMS) published by the Authority in January 2025. As outlined by the latter circular, Authorised Persons within scope (see Article 2 of the DORA Regulation) of Regulation (EU) 2022/2554 (the ‘DORA Regulation’): 1) shall report Major ICT-Related Incidents, 2) are to notify Significant Cyber Threats on a voluntary basis, and 3) shall notify their voluntary participation in, or, as applicable, the cessation of their membership from, Information￾Sharing Arrangements to the Authority. The Authority is implementing a number of changes, including the introduction of Frequently Asked Questions (FAQs), updates to the CRMS within the Licence Holder (LH) Portal, and revisions to supporting documentation. These updates are intended to provide further guidance to Authorised Persons. Frequently Asked Questions (FAQs) The Authority released FAQs covering each of the three Cyber Reporting areas (Major ICT￾Related Incidents, Significant Cyber Threats, and Information-Sharing Arrangements) under the DORA Regulation. The three sets of FAQs are available on the MFSA website (our work > Supervisory ICT Risk and Cybersecurity), under the following tabs; ‘Major ICT-Related Incident Reporting’, ‘Significant Cyber Threat Notification’ and ‘Information-Sharing Arrangement Notification’. Cyber Reporting Management System (‘CRMS’)