E-ITS in Estonia: short answer
E-ITS is the Estonian information-security standard maintained under RIA's framework. It provides a catalogue of security measures, a method for selecting them and an audit model. It is not a product certificate and it is not automatically the same as NIS2 or ISO/IEC 27001.
For an organisation under KüTS, E-ITS can be the practical way to structure the ten NIS2 risk-management areas. For an organisation outside the mandate, it remains a useful reference, but the legal obligation must be checked separately.
Who must use E-ITS?
The obligation depends on the entity type and the legal rule. The framework is used by parts of the Estonian public sector and by essential-service providers covered by KüTS. A private company is not automatically required to use E-ITS merely because it has a security programme.
Start with the legal question: does a statute, supervision decision, public procurement or contract require E-ITS? If not, decide whether E-ITS or ISO 27001 better fits your evidence and customer expectations.
What changed in 2026
RIA simplified the framework and audit model. The preliminary and interim audits were removed, the measure layer was simplified and the main audit moved to a three-year cycle. The current version and transition rules should always be checked on eits.ria.ee.
The practical effect is fewer overlapping audit steps, but not less evidence. The organisation still needs a scope, risk assessment, selected measures, implementation evidence and a remediation plan.
Measures and scope
E-ITS is modular: the organisation selects a baseline, adds modules for its technology and risk profile and documents justified exclusions. Typical evidence includes:
- Scope and asset inventory.
- Risk assessment and selected baseline.
- Access control, logging, backup and update evidence.
- Supplier and incident processes.
- Internal review, test results and remediation.
- Management approval and ownership.
Do not treat the catalogue as a checklist to fill once. The selected measures must match the actual system and be tested.
How the E-ITS audit works
The audit tests whether the selected measures are implemented and evidenced. It is not a penetration test and does not replace technical testing. A typical preparation sequence is:
- Define the scope and the applicable baseline.
- Map each selected measure to an owner, evidence and test date.
- Close obvious gaps and document accepted risks.
- Run an internal review against the audit questions.
- Prepare the evidence pack and the remediation log.
An independent audit can be useful, but the organisation remains responsible for the accuracy and currency of the evidence.
E-ITS and NIS2
NIS2 is the legal duty; E-ITS is one way to organise the security measures. A mapping table should connect each NIS2 area to the selected E-ITS measures and a proof. Do not claim that an E-ITS audit automatically satisfies NIS2: governance, incident reporting, supply-chain evidence and supervisory cooperation still need their own proof.
See NIS2 in Estonia for the ten duties, registration and reporting timeline.
What an auditor will ask for
- Approved scope and risk assessment.
- Selected measures and justified exclusions.
- Configuration, logs, access reviews and backup restore tests.
- Supplier and incident records.
- Internal audit or review results.
- Remediation plan with owners and deadlines.
Request a scoping call if you need a second pair of eyes on the evidence.
Frequently asked questions
Is E-ITS mandatory in Estonia?
E-ITS is mandatory for certain Estonian public-sector and essential-service entities under KüTS. It is not a universal requirement for every private company; the obligation depends on the entity and the applicable legal rule.
What changed in E-ITS 2026?
RIA removed the preliminary and interim audits, simplified the measure layer and moved to a three-year main audit cycle. The exact scope depends on the entity and the current E-ITS version.
Does E-ITS prove NIS2 compliance?
No. E-ITS can provide evidence for many security measures, but NIS2 also requires governance, incident reporting, supply-chain management and supervisory evidence. Map each NIS2 duty to an E-ITS measure and a proof.
Is E-ITS the same as ISO 27001?
No. E-ITS is the Estonian information-security framework; ISO/IEC 27001 is an international management-system standard. They can complement each other, but neither certificate automatically proves the other.
How often is an E-ITS audit required?
The main audit cycle is three years for entities covered by the current E-ITS framework. Confirm the applicable requirement with RIA and the legal act for your entity.