Skip to main content
FromNine
Menu

Trust and compliance

Trust and compliance for regulated organisations in Malta

Our information security is certified to ISO/IEC 27001. This page covers three things: the protection your systems and data get while we work for you, the part we play in your obligations under the NIS2 Order, DORA and the AI Act, and the route for obtaining our security documentation.

For Maltese public entities and regulated companies, where the MFSA, the MDIA, the IDPC and the CIP Department apply the EU rules.

Ask for security documentationOur commitments

Our commitments

Five commitments that apply to each engagement

Ministries, public entities and MFSA licence holders entrust us with sensitive data and with systems behind real decisions. These are the commitments they can hold us to.

  • Information security management

    Certified

    We run an information security management system certified to ISO/IEC 27001, the international standard in this field. Every engagement follows that system for its controls, the management of our own suppliers and the handling of incidents.

    Before any work begins we agree what access the team gets to your systems and data. It is kept to what the task requires and checked again whenever someone joins or leaves the team.

    ISO/IEC 27001 certified

  • Personal data and the GDPR

    How we work

    Before a line of code is written, we settle with you why the data is used, who may see it and how long it is kept. If we handle personal data for you, the relationship is that of processor and controller, covered by a contract as Article 28 GDPR demands.

    Where a high risk to people is likely, our engineers prepare the technical part of your data protection impact assessment, a document the IDPC may ask to see.

  • Human oversight of AI

    How we work

    During discovery we classify each AI use case together with you. Approval points, logging and technical documentation are part of the system from its first release, rather than prepared in a hurry before an audit. Agents act with limited rights and wait for approval before any step with consequences.

  • Accessibility

    How we work

    Interfaces are designed and tested to EN 301 549 and WCAG 2.2 level AA, through automated checks and manual review with assistive technology. You receive a conformance report that records any issues still open.

  • Data kept within the EU

    Per engagement

    Which hosting regions are used, who controls the encryption keys and from where support may access the system are settled with you before building starts and recorded in the architecture, with sovereign options where your obligations call for them.

What follows is a description of our practice as a supplier, not a statement that you comply. Your duties turn on your organisation and the use case, and interpreting them in law falls to your own advocates.

NIS2 Order

The NIS2 Order: support for the security of your supply chain

Malta transposed the NIS2 Directive, Directive (EU) 2022/2555, through the NIS2 Order (Legal Notice 71 of 2025, S.L. 460.41), in force since 23 January 2026. The competent authority is the Critical Infrastructure Protection Department (CIP Department), which also runs national self-registration. Essential and important entities are obliged to manage cyber risk to their network and information systems. The Directive names supply-chain security as one of the minimum measures (Article 21(2)) and expects entities to weigh the security practices of their direct suppliers and service providers (Article 21(3)).

As your supplier, we make it simpler for you to evidence that part of the duty. Security clauses, the incident channel and the handling of vulnerabilities are settled in each contract, and the controls relevant to your engagement are written down so your supplier risk process can review them. Whether the NIS2 Order covers your organisation, and how, is for you to decide.

  • Security clauses in writing

    Access, subcontracting, notification of incidents and cooperation in audits are set down in the contract instead of being taken for granted.

  • An incident channel you can rely on

    Named people and fixed timings on both sides, so that an incident at our end is passed to you fast enough for the Directive’s 24-hour early warning (Article 23(4)).

  • Handling of vulnerabilities

    The delivery pipeline scans dependencies, code and infrastructure, and each finding is either fixed or reported to you through the agreed channel.

  • Evidence when you ask

    Our ISO/IEC 27001 certificate, plus a description of the controls that cover your engagement.

DORA

DORA: ICT third-party risk for MFSA licence holders

DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), has been applicable since 17 January 2025, with the Malta Financial Services Authority (MFSA) as national competent authority. Licence holders such as credit institutions, insurers, investment services firms and payment institutions must treat ICT third-party risk as part of their ICT risk management framework, maintain a register of information on every contract for ICT services (Article 28) and include certain key clauses in those contracts (Article 30). Major ICT incidents go to the MFSA through the Licence Holder Portal.

When we deliver ICT services to a licence holder, we agree the provisions that Article 30 lists: a full description of the services, the places where they are delivered and where data is processed, help when an ICT incident occurs, cooperation with the MFSA and rights of termination. Where a service supports critical or important functions, the contract also covers exit strategies and our part in your resilience testing.

We provide what your register of information needs, and we write exit plans from the outset so that changing supplier stays a genuine option.

  • Financial servicesRegulated AI, resilient platforms and operations built for DORA and the MFSA.

AI Act

The AI Act: oversight and documentation from the design onwards

The AI Act, Regulation (EU) 2024/1689, is being phased in. Prohibited practices have been banned, and AI literacy required, since February 2025; Article 50 transparency duties followed in August 2026. After the 2026 amendment by Regulation (EU) 2026/1744, Annex III high-risk rules start on 2 December 2027. Malta has named its authorities: Legal Notice 226 of 2025 designates the Malta Digital Innovation Authority (MDIA) as lead market surveillance authority, and Legal Notice 227 of 2025 gives the IDPC that role for certain Annex III systems.

For a high-risk system the Act requires technical documentation (Article 11), automatic record-keeping of events (Article 12) and a design that allows effective human oversight (Article 14). Deployers in turn must give that oversight to staff who have the competence and authority to act (Article 26). Our first release already provides for this: approval points and an override wherever a decision affects people, and documentation written in step with the code.

Your role as provider or deployer follows from the way the system is put into service. Deciding it belongs to the legal analysis carried out by your advocates, and we provide the technical facts behind it.

In delivery

Security at each stage of delivery

Evidence of compliance grows out of the way the work is done, not out of a report drafted at the end.

  • Least-privilege access

    The team reaches only the environments and data its work needs, under terms agreed in advance and checked each time the team changes.

  • Every change reviewed and scanned

    A second engineer reviews each change before release. Scans of dependencies, code and infrastructure run automatically, and security tests are planned for each release.

  • Incidents follow an agreed procedure

    How incidents are classified, whom we notify and how evidence is kept are fixed at the outset, and written into the incident process if the NIS2 Order or DORA applies to you.

  • Handover and exit on paper

    Runbooks, architecture decisions and data models go with the system at handover, and exit plans show from day one how data comes back to you and what a switch would cost.

Due diligence

Ask for our security documentation

Procurement, security and legal officers rightly want proof before a contract is signed. We can provide the ISO/IEC 27001 certificate with its scope, completed answers to your supplier security questionnaire and the data processing terms for your engagement.

Use the contact page and tell us which framework you measure suppliers against, for example the NIS2 Order, DORA or the requirements of a call for tenders. The colleagues responsible will reply to you.

  • Get in touchSay in your message that you need security documentation.
  • Legal noticeCompany and registration details for your supplier file.

Malta

EU rules, applied by Maltese authorities

The GDPR, DORA and the AI Act are regulations and apply in Malta directly. NIS2 is a directive, and Malta has transposed it through the NIS2 Order (S.L. 460.41), in force since 23 January 2026, under which in-scope entities register with the CIP Department.

Supervision is always national. In Malta the CIP Department oversees the NIS2 Order, the MFSA supervises DORA for licence holders, the IDPC enforces the GDPR, and the MDIA leads market surveillance under the AI Act, with the IDPC responsible for certain high-risk systems. Where a programme also covers entities in other Member States, we agree one set of controls and link each incident channel to the authority to which that entity reports.

Questions from procurement and security officers

Does FromNine hold ISO/IEC 27001 certification?

Yes. Our information security management system is ISO/IEC 27001 certified. On request we share the certificate and its scope for your due diligence.

How do you help with our duties under the NIS2 Order?

The contract sets out security clauses, the channels for notifying incidents and how vulnerabilities are handled. We document the controls relevant to your engagement and give you the evidence your supplier risk review requires. Whether the NIS2 Order applies to your organisation, and how, is for you and your advocates to judge.

Will you sign the contract provisions DORA requires?

Yes. We accept the provisions of Article 30 DORA, report incidents to you through the agreed channel so you can inform the MFSA, document exit plans, take part in resilience testing and supply what your register of information needs.

Who answers for compliance with the AI Act?

Responsibility follows your role under the Act (provider or deployer) and the risk class the use case falls into. In discovery we agree the classification with you; oversight, logs and documentation are then engineered into the system, and your advocates receive the technical facts their legal analysis requires.

Where is our data hosted and processed?

In places agreed with you before building starts: your own cloud tenancy, an EU region of a public cloud, or your own premises for sensitive workloads. We select hosting and AI services to match and record the choice together with its exit options.

How can we obtain your security documentation?

Through the contact page. List the documents you need and the framework you assess suppliers against, and the responsible colleagues will reply.

Ask us for the evidence

Let us know the framework you measure suppliers against and the documents you require. We will explain what we can share and in what form.

Ask for security documentationAbout FromNine