E-ITS internal assessment vs external audit

Section 9 of regulation no. 30 of the Minister of Justice and Digital Affairs (RT I, 29.08.2026, 1), "Organisatsioonisisene hindamine", requires the organisation to assess regularly whether its E-ITS programme is in place. The assessment checks that the organisation has:

• defined its business processes and mapped the assets that support them;
• identified external requirements;
• assessed risks and set a risk methodology;
• mapped catalogue modules to its assets;
• drawn up an implementation plan;
• implemented and monitored measures on schedule;
• closed findings from earlier audits and assessments.

Who does it: the organisation. The regulation allows an external person to carry it out (§ 9(2)). How often: the regulation says "regularly"; RIA's implementation guide, which is recommended and not binding, says at least once a year. What it produces: the regulation does not prescribe a report format that we could confirm, but the findings have to be fixed, and the risks of unimplemented measures accepted, by the time the audit begins (§ 9(3)). In practice that means a dated assessment record, a list of findings with owners and deadlines, and a record of risk acceptance by management.

Government regulation no. 121, "Võrgu- ja infosüsteemide küberturvalisuse nõuded", § 4(1) says a service provider subject to the E-ITS obligation must ensure an E-ITS compliance audit every three years. It sends the audit conclusion to RIA within 30 days of receiving it (§ 4(2)). The consolidated text is in Riigi Teataja (read 2026-11-08).

RIA's implementation guide adds that the audit is carried out by an external audit firm that is independent of the organisation. RIA publishes audit rules as part of the 2026 edition. We could not read the rules page text in an automated fetch on 8 November 2026, so the exact auditor qualification requirements, the audit scope definition and the form of the audit report are not restated here. Check them there before you order an audit.

What RIA says about the process, in its news page (read 2026-11-08): the main audit continues on a three-year cycle. Instead of a follow-up audit, when the conclusion refers to high-level risks you send RIA the full audit report as well as the conclusion, remove the shortcomings within six months and report that.

An organisation may also hold a valid ISO/IEC 27001 certificate with a suitable scope, submitted to RIA, which exempts it from E-ITS under regulation no. 121 § 3. In that case the E-ITS audit does not apply to you. Small organisations may only need the primary security measures. See who must apply E-ITS.

Under earlier editions, the three-year cycle contained pre-audits, interim audits and follow-up audits. RIA says that now the organisation's own assessment takes over the obligation of pre-audits and interim audits, though an organisation may continue with them if it wishes. So the cycle looks like this:

1. Year by year: internal assessment, findings fixed, risk acceptance recorded, evidence kept.
2. Before the audit: a final internal assessment, so that shortcomings are fixed when the audit begins (§ 9(3)).
3. Audit: the independent firm checks compliance and issues a conclusion.
4. After the audit: conclusion to RIA within 30 days; if high-level risks are cited, full report to RIA and six months to remove the shortcomings.
5. Back to step 1. Findings from the audit become input to the next internal assessment, because the assessment must check that earlier audit findings were closed.

Evidence. Keep it next to the measure it supports, with a date and a review date. Typical items are policies and procedures, configurations and logs, training records, contracts and supplier assurances, incident records, risk register entries and the management decision accepting a risk. Evidence that is gathered as you go is easier to defend than evidence reconstructed in the week before the audit.

Records. Keep a written trail for each decision an auditor may question:

• why a measure was left out or replaced (§ 7(6)) and who accepted the risk;
• any measure that takes longer than a year to implement, treated as an accepted risk (§ 7(7));
• the dated internal assessment, its findings and how each was closed;
• management's regular overviews of risks, incidents and plan progress (§ 3(3)).

Roles.

• Management decides on accepting risks of unimplemented measures (§ 3(2)) and receives the overviews.
• The security officer owns the programme and runs or commissions the internal assessment.
• Each measure has a named owner and a date.
• If you use an external person for the assessment, keep them separate from the audit firm you order later; whether the same firm may do both is a question to settle with the audit firm and RIA, and we could not confirm a rule either way.

Timing. Find the dates and contracts of your audit cycle, run the internal assessment well before the audit is ordered, and plan the move to the 2026 version by the end of the current cycle, as RIA advises. Measures with the same title in the 2024 and 2026 versions must be re-assessed, not copied.

InfoPol supports E-ITS: organisations set up their E-ITS measures as controls in InfoPol, and it keeps controls, evidence, tasks, documents and a tamper-evident audit log in one place, so the internal assessment and the audit work from the same records. AI may draft, but a human approves every change. InfoPol does not conduct audits; the decisions, the evidence and the audit remain with you.

• The auditor qualification requirements and the detailed audit scope in RIA's audit rules.
• Whether the regulation prescribes a format for the internal assessment record.
• Whether the same external party may perform both the internal assessment and the audit.