Managing E-ITS: dedicated software vs RIA's support tool vs spreadsheets

E-ITS is the Estonian information security standard. RIA says it is based on the German BSI IT-Grundschutz method and on ISO/IEC 27001, and that it is updated every autumn (RIA, E-ITS overview, page updated 25 March 2026). The E-ITS portal states that the 2026 version and new information security requirements took effect on 1 September 2026 (eits.ria.ee, E-ITS 2026 version).

Whatever tool you choose, the work behind it is the same:

• identify the business processes and assets in scope;
• decide the protection need of each process;
• select the measures from the catalogue that apply to you and write an implementation plan;
• assign an owner to each measure and keep evidence that it is in place;
• assess risks and keep the whole set current, including after each yearly update of the standard;
• be ready to show all of it to an auditor.

A tool does not do this work. It decides how much of it is manual, how much is visible to others, and how much survives staff changes.

RIA publishes a web-based support application for E-ITS, known informally as the "wizard" (Estonian: "võlur"). RIA describes three things it does (eits.ria.ee, support application; RIA news, 16 October 2025):

1. It helps determine the protection need of business processes.
2. It generates a draft implementation plan of measures (in Estonian, IMR) tailored to the organisation profile you enter.
3. It lets you browse the measures catalogue by keyword.

Other facts from RIA's pages:

• Use is not mandatory.
• It can be downloaded to your computer or used online, and it is available in Estonian and English.
• At the time of checking, the portal listed version 2.0.10 (release candidate 1) built on the 2026 catalogue. RIA's earlier announcements referred to the 2024 version, so check which catalogue the version you open uses.
• RIA says the tool is in rapid development and is suitable for giving feedback and understanding the logic, but "not yet for making final decisions". RIA also warns that if you enter wrong information about your organisation, you may not get all the measures you need.
• We found no price or licence fee on RIA's pages. It appears to be free to use, but we have not seen RIA state this in so many words, so confirm on the portal.

What RIA does not describe, and what we therefore cannot claim for it: multi-user editing, evidence attachments, change history, reminders for reviews or a risk register. Judging by RIA's own description it is a planning aid for the first steps, not a system for running the standard day to day.

Good for: a first look at the standard, a first draft of the implementation plan, finding the relevant measures quickly, and understanding the logic before you invest in anything else.

Many organisations manage E-ITS in Excel, Word and a shared folder. RIA's tool itself is positioned as something that saves you from "juggling Excel tables", but plenty of organisations carry on with them, especially when the scope is small.

What spreadsheets do well: they are free in licence terms, everybody can use them, and you can shape them to your own way of working. For a small organisation with a few processes and one person responsible, this can be entirely adequate.

Where they struggle:

• Audit trail. A spreadsheet shows the current state, not who changed a status, when and why. You can reconstruct some of it from file versions, but that is slow and unreliable.
• Collaboration. Several people editing the same file leads to conflicts and copies. Ownership of a measure is a column, not something that notifies anyone.
• Evidence. Evidence lives in a folder, and the link between a measure and its evidence is held together by file names and discipline.
• Reminders. Nothing prompts a review. Review dates are noticed only when someone looks.
• Yearly updates. When the catalogue changes each autumn, you compare and merge by hand.

The cost is hidden in staff time. The licence is free; the maintenance is not.

Good for: small scope, one responsible person, low change rate, or as a deliberate first stage before you know what you need.

Dedicated software keeps the measures, owners, evidence, risks, assets and tasks as linked records in one system, with permissions and a history of changes. The details differ between products, so read this section as a description of the category and check each product against it.

What it adds in principle:

• Audit trail: every change is recorded with who and when, ideally in a log that cannot be edited silently.
• Collaboration: owners, roles and tasks, so the person responsible for a measure is notified and accountable.
• Evidence: documents and records attached to the measure they support, with review dates.
• Reuse: the same risk, asset or policy can serve E-ITS and other frameworks, instead of being rewritten per standard.

What it costs: a subscription or licence (prices vary by vendor and size, and we do not quote any), plus setup. You must load or build the E-ITS measure list, and you must adopt a way of working. A tool used badly is no better than a spreadsheet used badly.

Good for: several people working on the same records, an audit within the year, E-ITS together with ISO 27001, NIS2 or GDPR, or any case where you need to show who decided what and when.

Where InfoPol fits

InfoPol is a compliance platform for information security management: risks, processes, assets, vendors, controls, documents, tasks, incidents, training and a tamper-evident audit log. InfoPol supports E-ITS: you set up the measures that apply to your organisation as controls and manage them like any other control, linked to the risks, assets, documents and tasks that belong to them. More on the setup is on our E-ITS page.

"Not described by RIA" means we could not confirm it on RIA's pages, not that the feature is absent. Open the tool and check.

Ask five questions.

1. How many people will touch the records? One person: a spreadsheet may be enough. Three or more: shared records start to matter.
2. When is your audit or customer review? If it is within a year, you will need a defensible history and evidence links.
3. Which other obligations do you carry? If you also face ISO 27001, NIS2 or GDPR, reusing one set of risks and documents saves real effort.
4. How often does your scope change? A stable scope tolerates manual upkeep; a changing one does not.
5. Who keeps it alive after the first year? The decisive cost of any tool is the habit of using it.

A sensible path for many organisations is staged: start with RIA's tool to understand the standard and draft the plan, carry the plan into whatever system you will actually run, and move from spreadsheets to software when the pain shows up as missed reviews, lost evidence or version confusion.

A few things hold regardless of tool:

• Treat RIA's draft plan as a draft. RIA itself says it is not for final decisions.
• Name an owner for each measure. A measure without an owner is a wish.
• Keep evidence next to the measure it supports, and record the review date.
• Re-check the catalogue after each autumn update.
• Write down why you excluded a measure. An auditor will ask.

If you want to see how this looks in practice, contact us with questions about your own situation.