E-ITS: the Estonian information security standard

E-ITS is the information security standard that Estonian organisations must apply under the Cybersecurity Act (küberturvalisuse seadus, KüTS). The legal chain has three links:

1. The Act. KüTS sets the obligation and defines the sectors and entities it covers.
2. Government regulation no. 121, "Võrgu- ja infosüsteemide küberturvalisuse nõuded". It sets the framework: who applies E-ITS, the audit every three years, the exemptions. The consolidated text in force from 1 October 2026 is in Riigi Teataja (read 2026-11-08).
3. The standard itself. Since 1 September 2026 this is regulation no. 30 of the Minister of Justice and Digital Affairs, "Eesti infoturbestandard", adopted on 25 August 2026 and published as RT I, 29.08.2026, 1. It repealed the earlier regulation no. 101 of 16 December 2022. RIA publishes the text and the catalogue in its E-ITS portal.

RIA says that E-ITS was based on the German BSI IT-Grundschutz method and on ISO/IEC 27001 (RIA, E-ITS overview, page updated 25 March 2026), and that the standard is updated every autumn. The 2026 edition is no longer formally tied to either of them.

In practice E-ITS has two parts: an information security management system (governance, risk management, roles, training, internal assessment) and a catalogue of modules with measures that you map to your assets and processes.

The scope is set in regulation no. 121 § 3. In summary:

• It applies to systems tied to the sectors named in KüTS § 3(2)-(5).
• A valid ISO/IEC 27001 certificate with a suitable scope, submitted to RIA, exempts you from E-ITS.
• Since 1 October 2025, organisations with fewer than 50 employees and turnover or balance sheet total of up to 10 million euros, and certain local government bodies, are not subject to the full obligation. They apply the primary security measures (esmased turvameetmed) listed in the annex of regulation no. 121 instead (§ 3(2^1) and § 5^1). RIA explains this on its primary measures page.

The exemptions carry conditions and exceptions. For example, RIA notes that general education schools stay under E-ITS or ISO/IEC 27001. Read the full analysis in who must apply E-ITS, and check the current regulation text for your own organisation. If you are unsure, ask RIA or an advisor before you start building.

The 2026 edition entered into force on 1 September 2026. According to RIA's news page, the stated aim is to reduce administrative burden and increase the organisation's own responsibility. The main changes:

Three practical consequences:

• A same-named measure is not the same measure. RIA warns that a measure may have the same title in 2024 and 2026 but different content. Re-assess it; do not copy the old status.
• Risk management drives priorities. You still map assets to catalogue modules, but you choose which measures to implement and in what order based on risk. A measure may be left out or replaced only if the protection need is met or the risk has been accepted (§ 7(6)), and management decides on accepting those risks (§ 3(2)).
• Supply chain is in focus. If a business process depends on an external party, you assess the risks and may ask that party for audit conclusions, certificates or self-assessment results (§ 7(8)-(9)).

Transition: measures implemented before 1 September 2026 that do not conflict with the new regulation stay valid until their implementation ends or they are updated, and documentation drawn up before that date stays valid for up to three years (§ 12). RIA recommends finding the deadlines of your audit cycle and moving to the 2026 version by the end of the current cycle at the latest. RIA also published a version converter for 2024 implementation plans. The full account is in E-ITS 2026: what changed.

The order below follows the structure of the standard. It is a working sequence, not a legal procedure.

1. Confirm that E-ITS applies to you. Check scope, the ISO/IEC 27001 route and the small-organisation exemption (previous section). Decide this first, because it changes everything after it.
2. Get management on board. Management accepts risks of unimplemented measures, receives regular overviews of risks, incidents and plan progress (§ 3), and appoints responsible people. Without a named owner at the top, the rest stalls.
3. Define business processes and map the assets that support them: information, systems, premises, people and external parties. Each asset is mapped to one or more catalogue modules.
4. Set a risk methodology. Regulation § 5 requires a methodology tied to the organisation's general risk management. Assess risks to the processes and assets, and record who accepts which risk.
5. Select measures and write the implementation plan. Take the measures from the catalogue (or from vendor recommendations or other relevant good practice), give each an owner and a deadline, and record why you excluded or replaced a measure. A measure that will take over a year must be treated as an accepted risk (§ 7(7)).
6. Implement, and keep evidence. Policies, configurations, logs, training records, contracts. Evidence should sit next to the measure it supports, with a review date.
7. Train people. Training of staff is a regulatory duty (§ 8).
8. Run incident management. Report incidents to CERT-EE and learn from them.
9. Assess internally, at least once a year. See the next section.
10. Order the audit from an independent audit firm, and fix findings before it starts.
11. Keep it current. The standard changes every autumn, so review the catalogue each year and update your plan.

This is the part most often described wrongly, so be precise.

Internal assessment (§ 9, "Organisatsioonisisene hindamine") is the organisation checking regularly that it has defined its processes, mapped assets, identified external requirements, assessed risks, mapped modules, drawn up the plan, implemented and monitored measures on schedule, and closed earlier findings. An external person may carry it out. Shortcomings must be fixed, and risks of unimplemented measures accepted, by the time the audit begins. RIA's implementation guide, which is recommended and not binding, says the assessment should be done at least once a year.

The external audit is still required. Regulation no. 121 § 4 says a service provider subject to the obligation must ensure an E-ITS compliance audit every three years and send the audit conclusion to RIA within 30 days of receiving it. RIA's guide adds that the audit is done by an external audit firm independent of the organisation.

What changed is the cycle in between. Previously the three-year cycle held pre-audits, interim audits and follow-up audits. Now the organisation's own assessment takes over the pre-audits and interim audits (you may keep them if you wish). Instead of a follow-up audit, if the conclusion refers to high-level risks you send RIA the full audit report as well as the conclusion, remove the shortcomings within six months and report that (see RIA's audit rules).

So the short version: internal assessment replaces the interim audit work, not the audit. More detail is in internal assessment versus external audit.

Nothing we found requires a particular tool. There are three realistic options:

• RIA's support application helps determine the protection need of business processes, drafts an implementation plan and lets you browse the measures catalogue. Use is not mandatory. RIA describes it as suited to feedback and understanding the logic, "not yet" to final decisions. RIA does not describe multi-user editing, evidence attachments or change history for it, so treat it as a planning aid for the first steps.
• Spreadsheets and documents cost nothing in licences and suit a small scope with one responsible person. The weak points are audit trail, collaboration, evidence links and review reminders, and the cost is staff time.
• Dedicated compliance software keeps measures, owners, evidence, risks, assets and tasks as linked records with a change history. It costs a subscription plus setup, and it pays off when several people share the work, when an audit is near, or when E-ITS sits next to ISO 27001, NIS2 or GDPR.

A common path is staged: draft the plan in RIA's tool, move it into the system you will actually run, and switch from spreadsheets to software when the pain shows up as missed reviews or lost evidence. The side-by-side comparison is in E-ITS software versus RIA's support application.

The 2026 catalogue has a dedicated module for AI, SYS.5.15 "Tehisarusüsteem" (in the 2024 version it was APP.EE.2). It treats AI as a system to be planned, risk-assessed, owned and monitored. Among its measures: define purpose and scope and assess whether public large language models may be used with your data (M1); assess risk and impact (M3); assign a data owner and a product owner (M4); account for legislation including the EU AI Act and the GDPR (M5); check suppliers (M16); and protect confidential data (M17, M22).

Two practical points. First, E-ITS does not ban staff from using public AI tools, but it expects you to decide in writing what data may go where. Second, an assistant that can change records in your systems is an actor, not a chat window: limit it to the permissions of one named user, require a person to approve each change, and keep a log. The full discussion, including ISO/IEC 42001 and the EU AI Act, is in E-ITS and artificial intelligence.

• Copying the 2024 status into 2026. Same title, possibly different content. Re-assess.
• Starting without a scope decision. Teams build a full E-ITS programme and then learn they qualify for the primary measures, or that an ISO 27001 certificate would have covered them. Or the reverse.
• Treating internal assessment as the audit. It is not. The external audit every three years remains.
• Measures without owners. A measure without an owner is a wish. Name a person and a date.
• Evidence collected only before the audit. Evidence is easier to keep as you go than to reconstruct. Attach it to the measure and note the review date.
• Unexplained exclusions. If you leave out or replace a measure, write why, and record who accepted the risk. An auditor will ask.
• Ignoring the supply chain. Processes that depend on a vendor need a risk assessment and, where possible, evidence from that vendor.
• Leaving the move to 2026 to the last moment. Documentation stays valid for a limited time. Plan the move against your audit cycle.
• No rule for AI tools. Staff will decide for themselves where data goes unless you write a short rule.

InfoPol is a compliance and information security management platform for risks, processes, assets, vendors, controls, documents and policies, tasks, incidents, and training with read acknowledgements. Every change is written to a tamper-evident audit log. InfoPol supports E-ITS: you set up the modules and measures you apply as controls and manage them next to your risks, assets and documents. That fits the 2026 approach, where you choose and document the measures yourself. InfoPol has native frameworks for ISO 27001 and for the primary security measures (esmased turvameetmed), which helps if you carry more than one obligation.

InfoPol also lets your own AI assistant work through an MCP server, with a person approving every write; see AI in InfoPol. Plans and prices are on the pricing page. InfoPol does not conduct audits and does not make your organisation compliant on its own: the decisions, the evidence and the audit stay with you.