Technology Assurance Sandbox

Malta Digital Innovation Authority (MDIA), was established in 2018 to encourage the uptake of innovative technology, particularly newly deployed solutions, while ensuring that such technologies are deployed in line with recognised standards through its certification programme, to provide technological assurance to a wide variety of stakeholders such as investors, developers, solution users and the general public.

MDIA’s new flagship utility, the MDIA-TAS (Technology Assurance Sandbox), is intended to guide solution owners throughout a residency of four years (at most), as they align their solution with established control objectives based on international standards, in a phased and gradual approach.

At the end of each phase, an independent third-party technical assessment is conducted by a selected MDIA-authorised Systems Auditor (or an MDIA recognised Technical Exper,t as per conditions in the latest Sandbox Programme Guidelines), until the project is in alignment with all control objectives and/or proposed milestones.

We recommend that the latest Guideline Document is referred to for up-to-date superseding information about the programme. After a defined number of assessments, the applicant will be in a position to obtain the full MDIA certification – indicating that the solution provides technological assurances for various stakeholders, including users and investors.

The Technology Assurance Sandbox is designed with start-ups and smaller players in mind. It grants ultimate flexibility in selecting which controls are applicable at each stage of the Sandbox residency, as defined by applicants themselves, thus seamlessly integrating within the development plans of the individual applicant. The MDIA-TAS also presents low administrative costs and the possibility of applying for Government grants to substantially cover System Auditor Assessment related costs.

The Technology Assurance Sandbox is based on a gradual attainment of technological assurances together with uncompromised legal certainty, provided through requirements such as due diligence processes of the applicant, the appointment of a Technical Officer who is duty-bound to report and act in case of technology failure and the setup of a forensic node to keep an audit log of the underlying system’s operations and transactions, thus supporting possible investigation.

Forming part of the MDIA-TAS brings about a number of advantages to the applicant:

It allows the development of the solution to be in line with predefined control objectives aligned with international standards, thus reducing the risk failure which would adversely affect users.
It provides technological assurance to investors and end users, providing certainty in the functional correctness and dependability of such technologies and the underlying operational processes, thus making the solution a notch more attractive.
Provides legal and regulatory certainty even in line with developing EU regulations in technological camps.
Provides a competitive edge to competing solutions.
Ensures that following sandbox residency, MDIA certification process is seamless.

Residency in the MDIA-TAS will be phased in a manner appropriate for each individual Applicant. Despite the different conditions, all participants will go through three main phases, namely:

Standard onboarding phase:
Onboarding starts when the Applicant submits a completed Technology Assurance Sandbox Application Form, identifying the Technical Officer through the Technical Officer Application Form. The Application form shall be accompanied by a Residency Plan that describes how the IDPS will develop throughout its Sandbox Residency, a Sandbox Blueprint providing a description of the technology and a Business Plan. MDIA shall evaluate all Application Forms received against published Evaluation Criteria.

Upon being notified of a positive outcome, the Applicant is to contact and appoint a Technical Expert, who, upon being approved by the MDIA, shall perform the initial and subsequent Technical Soundness Reviews. The Initial Technical Soundness Review shall be submitted to the MDIA within three (3) months of the MDIA’s approval of the Technical Expert.

A tri-party meeting will be then held between the prospective Resident, Technical Expert and MDIA to discuss the outcome of the said report and if the MDIA deems it to be acceptable, the prospective Resident shall be notified and admitted into the Sandbox.
Monitored Sandbox residency phase:

In line with the defined Residency Plan, Sandbox Residents shall trigger iterations of Technical Soundness Assessments, which are then sent to the Authority for their endorsement.

Any changes to the Technological Arrangement or the Technical officer are to be submitted to the Authority through a Change Request Form. All changes shall be evaluated, and are either accepted or rejected.
Standard offboarding phase:
Sandbox Residents mayexit in one of the following ways:
(i) the Resident withdraws from the Sandbox for any reason at any stage.
(ii) the Resident proposes changes to the Application Form, Residency Plan or Technical Officer or Technical Expert which are not accepted by the Authority.
(iii) the Authority decides to expel a Resident from the Sandbox following a violation of applicable terms and conditions.
(iv) the Authority decides to terminate the Residency of a Resident for the failure to achieve or rectify the defined control objectives and scope within the milestones.
(v) the Authority is of the opinion that the IDPS within the Sandbox may give rise to third party risks.
(vi) the MDIA terminates or suspends the Sandbox. Any issues identified shall be first discussed with the Applicant and the Authority may grant the Applicant the opportunity to rectify, prior to proceeding with the standard off-boarding process.