The Supervisory ICT Risk and Cybersecurity (SIRC) Function's Webpage and Key Updates

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt The Supervisory ICT Risk and Cybersecurity (‘SIRC’) Function’s Webpage and Key Updates The Supervisory ICT Risk & Cybersecurity (‘SIRC’) Function within the Malta Financial Services Authority (‘MFSA’ or ‘the Authority’) would like to remind financial entities of its dedicated webpage available on the Authority's website. The webpage provides essential information on, among other topics, the legal framework relating to digital operational resilience, Major ICT-Related Incident Reporting, Significant Cyber Threat Notifications, Information-Sharing Arrangement Notifications, Threat-Led Penetration Testing (‘TLPT’), and ICT third-party risk management, including the Register of Information (‘RoI’). In addition, the webpage serves as a central source for updates on authorisation and supervisory expectations, and any other guidance issued by the SIRC Function from time to time. These include Dear CEO Letters, Circulars, User Guide Documentation and Frequently Asked Questions (‘FAQs’). The latter covers:

• the three cyber-reporting areas established under the DORA Regulation, namely
  Major ICT-Related Incidents, Significant Cyber Threats and Information-Sharing Arrangements (newly published), (our work > Supervisory ICT Risk and Cybersecurity under the following tabs; ‘Major ICT-Related Incident Reporting’, ‘Significant Cyber Threat Notification’ and ‘Information-Sharing Arrangement Notification’) and
• the Register of Information (recently updated).
  (our work > Supervisory ICT Risk and Cybersecurity under the following tab; ‘ICT Third-Party Risk’) Financial entities are encouraged to regularly consult the dedicated webpage and remain attentive to updates. 1 October 2026

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt For any queries one should reach out to the SIRC Function as per the contact points identified within the circular titled: The Supervisory ICT Risk and Cybersecurity (‘SIRC’) Function’s Contact Points.