Penetration Testing in Malta: Regulatory Requirements and Practical Guidance

Penetration testing — the controlled simulation of cyberattacks to identify exploitable vulnerabilities — has evolved from an optional best practice to a regulatory expectation for businesses in Malta. Under NIS2, GDPR, ISO 27001 and sector-specific requirements from the Malta Gaming Authority (MGA) and Malta Financial Services Authority (MFSA), organisations must demonstrate that they actively assess the effectiveness of their technical security controls. Regular penetration testing is the most credible way to do so.

The Regulatory Driver: Why Malta Businesses Must Test

Several overlapping regulatory frameworks create clear expectations for security testing in Malta:

NIS2 Directive

NIS2 Article 21(2)(e) requires in-scope organisations to implement processes for handling and disclosing vulnerabilities, and Article 21(2)(a) requires policies and procedures to assess the effectiveness of cybersecurity risk management measures. While NIS2 does not mandate penetration testing by name, MITA will expect to see evidence of technical security testing as part of any compliance assessment. Regular penetration testing is the standard mechanism for fulfilling this expectation.

GDPR Article 32

GDPR requires organisations to implement technical and organisational measures appropriate to the risk, and to have a process for regularly testing, assessing and evaluating the effectiveness of those measures. Penetration testing directly satisfies this requirement for the technical layer of a GDPR compliance programme. The IDPC may request evidence of security testing as part of an investigation following a personal data breach.

ISO 27001:2022 Annex A Control 8.8

ISO 27001 Annex A control 8.8 (Management of technical vulnerabilities) requires organisations to identify, assess and remediate vulnerabilities in information systems. A Penetration Testing Policy, regular test execution and documented remediation are core components of fulfilling this control.

Malta Gaming Authority (MGA) Requirements

The MGA's technical compliance framework for licensed gaming operators includes requirements for regular security assessments of gaming platforms, player data protection and the integrity of random number generators and game logic. MGA-licensed operators are expected to conduct penetration testing as part of their ongoing technical compliance, and test results may be requested by the MGA during audits or following a security incident.

MFSA-Regulated Firms and DORA

Investment firms, payment institutions and other MFSA-regulated entities in Malta are subject to DORA (the Digital Operational Resilience Act) from January 2025. DORA introduces explicit requirements for Threat-Led Penetration Testing (TLPT) for significant financial entities — the most rigorous form of adversarial testing, based on real threat intelligence targeting the specific institution.

What Should Be Tested in Malta Organisations

The scope of penetration testing should reflect the organisation's attack surface and risk profile:

• External network penetration test: Tests the perimeter — internet-facing systems, firewalls, VPN endpoints, web applications and APIs. This is the baseline test every organisation should conduct annually
• Web application penetration test: Focuses on web applications and APIs using the OWASP Web Security Testing Guide methodology. Essential for iGaming operators, fintech platforms and any organisation with a customer-facing web presence
• Internal network penetration test: Simulates an attacker with access to the internal network (insider threat or post-breach lateral movement). Recommended every one to two years for organisations with significant on-premise infrastructure
• Gaming platform security assessment: For MGA-licensed operators, targeted testing of gaming platform components including player authentication, session management, payment flows and API security. Often required to demonstrate compliance with MGA technical standards
• Social engineering / phishing simulation: Tests employee susceptibility to phishing and social engineering. Highly relevant given that credential theft is the leading initial access vector for incidents in Malta
• Cloud security review: Assesses configuration of cloud environments (AWS, Azure, GCP). Critical for Malta's iGaming and fintech sectors, which rely heavily on cloud infrastructure
• TLPT (DORA): Applies to significant financial entities under DORA. A structured, intelligence-led test simulating the TTPs of real threat actors targeting the specific institution

Selecting a Penetration Testing Provider in Malta

The quality of a penetration test depends heavily on the skill and methodology of the testing team. When engaging a provider in Malta or internationally, evaluate:

• Certifications: OSCP (Offensive Security Certified Professional), CREST or CHECK are the most widely recognised credentials for individual testers. For web application testing, OWASP or GWAPT certification is relevant
• Sector experience: For iGaming platform testing, look for providers with specific experience in gaming platform security, payment gateway testing and player data protection
• Methodology: The provider should follow a recognised methodology — OWASP WSTG for web applications, PTES or OSSTMM for network testing
• Report quality: A high-quality penetration test report provides clear finding descriptions, CVSS severity scores, reproduction steps and specific, actionable remediation guidance — not just automated scanner output
• Independence: For ISO 27001 and NIS2 compliance purposes, the test must be conducted by an independent party — not internal IT staff testing their own infrastructure
• Contractual protections: Ensure a signed NDA and written Rules of Engagement (RoE) are in place before testing begins

Managing Findings Effectively

The value of a penetration test is realised through effective remediation, not the test itself:

1. Prioritise by severity: Critical findings require immediate attention — typically within 7 days. High severity within 30 days, medium within 90 days
2. Assign ownership: Each finding should have a named owner responsible for remediation or risk acceptance
3. Track progress: Use a dedicated finding management tool to track status, evidence of remediation and retest results
4. Retest critical and high findings: Engage the test provider to verify that critical and high severity findings are genuinely resolved
5. Document risk acceptance: Where immediate remediation is not possible, document the business rationale, residual risk level and compensating controls
6. Report to management: Present a summary of test results, remediation status and trend data to senior management as part of the ISMS performance reporting cycle and, where applicable, to the MGA or MFSA

Building a Recurring Programme

A single penetration test provides a point-in-time snapshot. Sustained security improvement requires a recurring programme:

• Annual external perimeter and web application test as a minimum baseline
• Additional tests triggered by major infrastructure changes, new product launches or significant security incidents
• Gaming platform security assessments aligned with MGA audit cycles and licence renewal
• Social engineering exercises at least annually, ideally quarterly for organisations in high-risk sectors
• TLPT at the frequency required by DORA for applicable financial entities

Conclusion

Penetration testing is no longer optional for Malta businesses operating in regulated sectors. NIS2, GDPR, ISO 27001, MGA technical requirements and DORA each create clear expectations for regular, independent security testing. Organisations that invest in a structured, recurring penetration testing programme — with disciplined finding management — significantly reduce their exposure to both cyber incidents and regulatory enforcement action in Malta's demanding multi-framework compliance environment.