E-ITS 2026: what changed

E-ITS is the information security standard that Estonian organisations must apply under the Cybersecurity Act (küberturvalisuse seadus, KüTS). The Government sets the framework in regulation no. 121, "Võrgu- ja infosüsteemide küberturvalisuse nõuded", and the minister responsible issues the standard itself as a separate regulation. The consolidated text of regulation no. 121 in force from 1 October 2026 is in Riigi Teataja (read 2026-11-08).

The 2026 standard is regulation no. 30 of the Minister of Justice and Digital Affairs, adopted on 25 August 2026 and published as RT I, 29.08.2026, 1. It entered into force on 1 September 2026 and repealed the earlier "Eesti infoturbestandard" regulation no. 101 of 16 December 2022. RIA publishes the text in its E-ITS portal: E-ITS requirements for the information security management system (read 2026-11-08). The portal's home page also notes that the new requirements and the 2026 edition applied from 1 September 2026.

According to RIA's own summary of the change (E-ITS news page, read 2026-11-08), the stated aim is to reduce administrative burden and increase the organisation's own responsibility. The main structural changes are:

• The regulation is shorter. The former separate "requirements for the information security management system" document is now part of the regulation itself. The long measures package (RIA mentions about 700 pages) is no longer part of the regulation.
• Baseline protection became an information security catalogue. The old catalogue had 109 modules and 1,802 measures in ten module groups. The new catalogue has 128 modules in nine module groups. RIA gives the measure count as about 1,490 on its news page (different counts appear at different stages of the draft, so check the portal for the current figure).
• The measures are no longer part of the regulation. The catalogue states the objective at module level; RIA keeps maintaining the measures in the portal, together with the support application.
• Module groups were reorganised. ISMS was replaced by GRC (governance, risk, compliance); software development got its own group, DEV; the industrial IT group IND was folded into SYS; APP was narrowed to end-user applications.
• Fewer lifecycle stages. Measures now have three stages: planning, operation and disposal.
• E-ITS is no longer tied to BSI IT-Grundschutz or to ISO/IEC 27001. RIA says this allows solutions adapted to Estonian conditions. This does not change the rule that a valid ISO/IEC 27001 certificate can exempt you from E-ITS (see below).

Under earlier editions an organisation chose a security approach: basic, core or high. RIA states that this is no longer an obligation. Priorities for implementing measures now follow from risk management, so effort goes to the assets and processes with the highest risk. You still map the assets of your business processes to catalogue modules, but you are free to choose the measures yourself: from the RIA portal, from vendor recommendations, or from another relevant good practice.

Two related points matter in practice. First, you can leave a measure unimplemented or replace it with an equivalent one only if the protection need is met or the organisation has accepted the risk (§ 7(6) of the regulation). Second, if a measure will take longer than a year to implement, it must be treated in risk management as an accepted risk (§ 7(7)). Management decides on accepting the risks of unimplemented measures (§ 3(2)).

Separately from the full standard, regulation no. 121 contains a short list of primary security measures (esmased turvameetmed) for small organisations; see the last section.

Three changes affect day-to-day work:

1. A same-named measure is not the same measure. RIA warns that a measure may have the same title in the 2024 and 2026 versions but different content. You cannot carry over the 2024 status; the whole measure has to be assessed again.
2. Risk management runs through everything. It is now used when mapping assets, in supply-chain contracts, in prioritising measures, in incident management, when assessing unimplemented measures and in audit findings. The regulation requires a risk management methodology tied to the organisation's general risk management (§ 5), and the management board must receive regular overviews of risks, incidents and the plan's progress (§ 3(3)).
3. Supply chain is in focus. If a business process depends on an external supply chain, you assess the associated risks, and you may require the external party to provide monitoring reports, audit conclusions, security certificates or self-assessment results (§ 7(8)-(9)). If a risk cannot be accepted, consider alternative measures or changing the partner (§ 7(10)).

Management training on risk management is also expected, according to RIA's summary. Training of staff is a regulatory duty (§ 8).

This is the change most often described incorrectly, so it is worth being precise.

What the regulation says: § 9 "Organisatsioonisisene hindamine" requires the organisation to assess regularly whether it has defined its business processes, mapped the assets, identified external requirements, assessed risks, mapped catalogue modules to assets, set a risk methodology, drawn up the implementation plan, implemented and monitored measures on schedule, and closed findings from earlier audits and assessments. The assessment may be carried out by an external person (§ 9(2)). Findings must be fixed, and the risks of unimplemented measures accepted, by the time the audit begins (§ 9(3)).

What RIA says about the audit cycle: previously the three-year cycle contained pre-audits, interim audits and follow-up audits. Now the organisation's self-assessment takes over the obligation of pre-audits and interim audits, though an organisation may continue with them if it wishes. The main audit continues on a three-year cycle. RIA also notes that, instead of a follow-up audit, when the audit conclusion refers to high-level risks you must send RIA the full audit report as well as the conclusion, and remove the shortcomings within six months and report that (see the E-ITS news page above and the audit rules, read 2026-11-08).

What the law still requires: regulation no. 121 § 4(1) says a service provider subject to the E-ITS obligation must ensure an E-ITS compliance audit every three years, and send the audit conclusion to RIA within 30 days of receiving it (§ 4(2)). RIA's implementation guide, which is recommended and not binding, adds that the audit is carried out by an external audit firm independent of the organisation, and that the internal assessment should be done at least once a year.

So the accurate summary is: internal assessment replaces the interim audit work, not the audit. A separate article covers internal assessment versus external audit in detail.

Sources for the table are the RIA news page and the regulation text linked above. The "2024 edition" column describes the RIA summary of what the older edition contained.

Section 12 of regulation no. 30 sets the transition rules:

• Measures implemented before 1 September 2026 that do not conflict with the regulation remain valid until their implementation ends or they are updated.
• Documentation prepared before entry into force remains valid for up to three years from 1 September 2026, that is until 1 September 2029 on our reading.
• If you update that documentation under the new rules before the deadline, the updated documentation applies.

RIA's practical advice (E-ITS news page) is to find the contracts and deadlines of your audit cycle and to plan the move to the new version by the end of the current cycle at the latest, and not to leave the move to the last moment. RIA also published a version converter (read 2026-11-08) that converts a 2024 implementation plan table into a 2026 table and exports the change log between the versions.

Two different "three-year" periods are easy to confuse. The three-year documentation validity above is specific to E-ITS. Separately, RIA reported on 2 January 2026 that the Cybersecurity Act amendments transposing the NIS2 directive took effect in January 2026, that about 3,000 more companies now face mandatory requirements (to 6,500 in total), and that entities have a three-year transition period to align with the new requirements (RIA, 2 January 2026). We did not verify the exact legal basis of that transition on the primary text, so check your own deadline in the Act.

There is no single deadline for the whole standard, because it depends on your audit cycle and on your documentation. A sensible order:

1. Confirm that E-ITS applies to you. Check the scope in regulation no. 121 § 3: it applies to systems tied to the sectors in KüTS § 3(2)-(5); a valid ISO/IEC 27001 certificate with a suitable scope and submitted to RIA exempts you; small organisations may only need the primary measures.
2. Read the 2026 text and the catalogue in the RIA portal, and run the version converter on your 2024 plan.
3. Update your asset map and map the new modules (for example GRC.3 asset management and the new cloud and social media modules) to your assets.
4. Check your risk methodology. It must cover security measures, involve management, and drive the priorities in your implementation plan.
5. Re-assess measures whose titles look unchanged. Do not copy the old status.
6. Plan the annual internal assessment, and run one before you order an audit, because the shortcomings it finds must be fixed before the audit starts.
7. Fix your audit date. Find your audit cycle contracts and deadlines, and aim to be on the 2026 version by the end of the current cycle.
8. Keep incident reporting going. Report incidents to CERT-EE and send the audit conclusion to RIA within the 30 days.

Since 1 October 2025, organisations with fewer than 50 employees and turnover or balance sheet total up to 10 million euros, and certain local government bodies, are not subject to the full E-ITS obligation and instead apply the primary security measures listed in the annex of regulation no. 121 (§ 3(2^1) and § 5^1). RIA's explanation is on its primary measures page (read 2026-11-08), which also notes that general education schools stay under E-ITS or ISO/IEC 27001. The measures are a floor, not a replacement for E-ITS, and anyone already following E-ITS or ISO/IEC 27001 need not change anything. The exact exemptions and exceptions are detailed, so check the current regulation text.

InfoPol is a compliance and information security management platform for risks, processes, assets, vendors, controls, documents, tasks, incidents and training, with a tamper-evident audit log. InfoPol supports E-ITS: you set up the modules and measures you choose to use as controls. That fits the 2026 approach, where you pick and document the measures yourself. See the E-ITS page and pricing.