Who must apply E-ITS in Estonia - the Cybersecurity Act scope, the small-organisation exemption, primary security measures, ISO 27001 and voluntary use.
Author: Klaus JõgiPublished:
E-ITS is mandatory for organisations that fall under the Estonian Cybersecurity Act (küberturvalisuse seadus, KüTS) as providers of the services it lists, unless they are small enough to use the primary security measures instead or hold a valid ISO/IEC 27001 certificate; everyone else may use it voluntarily. This article explains how to work out which group you are in. All legal statements link to a primary or official source and were read on 8 November 2026. For a decision with consequences, read the regulation itself or ask RIA.
The obligation has two layers. The Cybersecurity Act sets who is a service provider in scope and what they must do to secure their networks and information systems. The Government's regulation no. 121, "Võrgu- ja infosüsteemide küberturvalisuse nõuded", says how: which organisations apply E-ITS, which may apply something lighter, and what audit and reporting duties follow. The consolidated text of the regulation is in Riigi Teataja (read 2026-11-08). The standard itself is a separate ministerial regulation, covered in our 2026 article.
Per regulation no. 121 § 3, E-ITS applies to the systems tied to the sectors named in KüTS § 3. We do not reproduce the full sector list here, because it is long and has been extended since the NIS2 amendments took effect in January 2026. RIA reported that about 3,000 more companies now face mandatory requirements, to a total of 6,500 (RIA, 2 January 2026, read 2026-11-08). Read KüTS § 3 on Riigi Teataja for the exact list of sectors and organisation types, and check your own sector there.
Being in a listed sector, or being a listed type of public body, is the first test. Size is the second.
2.The small-organisation exemption
Since 1 October 2025, the Government has eased the requirements for smaller organisations. According to RIA's announcement (read 2026-11-08), the regulation was approved on 25 September 2025, and the following no longer have to apply E-ITS or ISO/IEC 27001 in full:
micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total of up to 10 million euros;
institutions run by local governments, except general education schools;
state museums;
unions of local government units.
RIA says the change affects about 1,200 companies and local government institutions. In the regulation this appears as § 3(2^1) and § 5^1, as read in the consolidated text.
Two cautions. First, the size test combines headcount with a financial limit (turnover or balance sheet total), so read the exact wording and how it counts linked enterprises. Second, the easing is not unconditional: RIA says organisations that run systems needing special protection may still need more than the primary measures, and general education schools that are data controllers or processors under the Public Information Act still need an external E-ITS audit (same RIA page). Organisations already following E-ITS or ISO/IEC 27001 do not need to change anything.
The primary measures are the minimum level for organisations that fall under the exemption above. RIA describes them as a clear and achievable minimum that addresses threats such as phishing, data theft and ransomware, and states that they do not replace E-ITS. The list is in the annex to regulation no. 121, and RIA explains it on its primary measures page (read 2026-11-08).
Practically, this means: an exempt organisation does not run the full management system, risk methodology, catalogue mapping and three-yearly audit that E-ITS requires. It implements the listed measures instead. If its situation changes, for example growth over the thresholds or a system that needs special protection, the answer may change too.
4.ISO/IEC 27001 as an alternative
A service provider that applies security measures under ISO/IEC 27001 can send RIA a valid certificate, and then the E-ITS requirements do not apply to it (regulation no. 121 § 3). RIA's page on audit and certificate notifications (read 2026-11-08) says the certificate is sent to RIA by email as an image file. The certificate scope must cover the systems that would otherwise fall under E-ITS.
5.Voluntary adoption
An organisation outside the obligation can still adopt E-ITS. Typical reasons are a customer or partner asking for a recognised Estonian standard, a wish to structure information security work around a catalogue, or preparing for a future move into scope. A voluntary adopter chooses how far to go: no legal duty to audit or report to RIA arises from adopting it alone. RIA positions E-ITS as intended mainly for larger and more mature organisations, so a small organisation may find the primary measures a better start.
6.Does it apply to me? A checklist
Answer in this order:
Do you provide a service listed in KüTS § 3, or are you a public sector body in scope? If no, there is no legal E-ITS obligation. You may still use it voluntarily.
Do you hold a valid ISO/IEC 27001 certificate whose scope covers the systems, and have you sent it to RIA? If yes, E-ITS does not apply to you.
Do you have fewer than 50 employees and turnover or balance sheet total of up to 10 million euros? If yes, you apply the primary measures, unless one of the exceptions below applies.
Are you a local government institution (not a general education school), a state museum or a union of local governments? Same exemption, same primary measures.
Do you run a system that needs special protection, or are you a general education school that is a data controller or processor? Check whether full E-ITS, or an external audit, is required.
Still unsure? Ask RIA, which advises companies and institutions on the requirements.
7.Comparison table
Organisation type
Obligation
What to apply
Organisation in a KüTS § 3 sector that is not exempt (for example 50 or more employees, or above the financial limit)
Legal obligation
Full E-ITS, external audit every three years, audit conclusion to RIA within 30 days
Organisation in scope with a valid ISO/IEC 27001 certificate, sent to RIA
Legal obligation met by certificate
ISO/IEC 27001; E-ITS does not apply
Micro or small enterprise (under 50 employees, turnover or balance sheet up to 10 M euros) in scope
Exempt from full E-ITS
Primary security measures
Local government institution (not a general education school), state museum, union of local governments
Exempt from full E-ITS
Primary security measures
General education school that is a data controller or processor
Not exempt
External E-ITS audit (per RIA)
Organisation outside KüTS
No legal obligation
Optional: E-ITS, ISO/IEC 27001 or primary measures
The three-yearly audit and the 30-day deadline are from regulation no. 121 § 4, as described in our 2026 article. Check the current text of the regulation for edge cases.
8.Where InfoPol fits
InfoPol is a compliance and information security management platform. It has native frameworks for the primary security measures (E9) and for ISO/IEC 27001, and it supports E-ITS: you set up the E-ITS measures you apply as controls. See pricing.
No. The obligation comes from the Cybersecurity Act (KüTS) and Government Regulation no. 121 and attaches to organisations in the sectors and roles the Act lists. Many companies are outside it, and some in scope are exempt from the full standard because of their size.
My company has 30 employees. Do I need E-ITS?
Probably not the full standard. Under regulation no. 121, organisations with fewer than 50 employees and turnover or balance sheet total of up to 10 million euros apply the primary security measures instead. The exemption has conditions, so check the regulation text and, if in doubt, ask RIA.
Does an ISO/IEC 27001 certificate replace E-ITS?
For an organisation that is subject to the obligation, a valid ISO/IEC 27001 certificate with a suitable scope, submitted to RIA, can take the place of E-ITS under regulation no. 121 (§ 3). The scope of the certificate must cover the systems in question.
Yes. Nothing stops an organisation from adopting E-ITS voluntarily, for example because a customer or partner expects it. Only organisations with a legal obligation must also arrange the audit and report to RIA.
Are the primary security measures optional?
For the small organisations the regulation covers, the primary measures are the minimum they apply instead of full E-ITS. They are a floor and do not replace E-ITS.