Estonian Information Security Standard (E-ITS)

Summary

The regulation of the Minister of Justice and Digital Affairs sets the new version of the Estonian Information Security Standard (E-ITS), the information security management system that service providers subject to the Cybersecurity Act apply to their network and information systems. It requires the organisation's management board to appoint those responsible, allocate resources, adopt a security policy to be reviewed at least once a year and decide on accepting residual risks. It provides for a risk-management methodology linked to a catalogue of measures (Annex 1), divided into process and system modules, to be implemented through an implementation plan together with continuous staff training and internal assessments. Compliance is checked through external audits under the rules in Annex 2, and the Information System Authority (RIA) runs a support website with non-binding guidance. It replaces the E-ITS regulation of 16 December 2022.

Information

Jurisdiction

Estonia

Issuing body

Justiits- ja digiminister (Minister of Justice and Digital Affairs)

Type

Regulation

Available languages

Estonian

Topics

• Governance and coordination
• Digital public administration
• Critical infrastructure

Notes

Adopted on 25 August 2026 (regulation No. 30) under § 7(5) of the Cybersecurity Act and § 3(1) of Government Regulation No. 121 of 9 December 2022; published in the Riigi Teataja on 29 August 2026 and in force since 1 September 2026. Regulation No. 121, last amended in September 2026, determines who must apply the standard: exempt, among others, are providers certified to ISO/IEC 27001 that submit their certificate to RIA and entities with fewer than 50 employees and an annual balance sheet or turnover not exceeding EUR 10 million; those applying the standard must have an audit carried out every three years. Measures implemented under the previous version remain valid if compatible with the new text, and existing documentation remains valid for no more than three years after entry into force.

Justiits- ja digiminister (Minister of Justice and Digital Affairs). (2026). Eesti infoturbestandard (Määrus nr 30, RT I, 29.08.2026, 1). https://www.riigiteataja.ee/akt/129082026001

Justiits- ja digiminister (Minister of Justice and Digital Affairs). "Eesti infoturbestandard." 25 August 2026. https://www.riigiteataja.ee/akt/129082026001.

@misc{ee_eesti_infoturbestandard_2026,
  author       = {{Justiits- ja digiminister (Minister of Justice and Digital Affairs)}},
  title        = {{Eesti infoturbestandard}},
  year         = {2026},
  note         = {Määrus nr 30, RT I, 29.08.2026, 1},
  url          = {https://www.riigiteataja.ee/akt/129082026001},
  urldate      = {2026-10-29}
}