ISO 27001 in Estonia: short answer
ISO/IEC 27001 is a voluntary international standard for an information-security management system (ISMS). Certification is issued by an accredited certification body after a two-stage audit and ongoing surveillance. It is not a legal licence and it does not automatically prove NIS2, E-ITS or DORA compliance.
The standard is useful when a customer, procurement or market expects a recognised management-system certificate. It also forces a repeatable cycle of risk assessment, controls, measurement and improvement.
Certification path
- Scope: legal entities, locations, systems and services in the ISMS.
- Gap analysis: compare current practice with ISO 27001 clauses and Annex A controls.
- Risk assessment: identify assets, threats, vulnerabilities and treatment.
- Implementation: policies, access control, suppliers, incidents, continuity and evidence.
- Internal audit and management review: test the ISMS and record decisions.
- Stage 1 and Stage 2: documentation review, then implementation audit.
- Surveillance: annual surveillance and recertification every three years.
Evidence auditors ask for
- ISMS scope, policy and risk methodology.
- Risk register, treatment plan and statement of applicability.
- Asset, access and supplier inventories.
- Incident, continuity and backup test records.
- Internal audit, management review and corrective actions.
- Training, awareness and competence records.
- Metrics showing whether controls work.
A document set without operating evidence is the most common reason a certification audit stalls.
ISO 27001, NIS2 and E-ITS
NIS2 is a legal duty; E-ITS is the Estonian framework; ISO 27001 is an international management-system standard. They overlap but are not interchangeable. Map each NIS2 duty to an ISO 27001 control and a proof, and do not assume a certificate covers incident reporting or supervisory cooperation.
See NIS2 in Estonia and E-ITS in Estonia for the local requirements.
Common mistakes
- Writing policies before understanding the actual risks.
- Treating the statement of applicability as a copy-paste list.
- No owner for suppliers, incidents or access reviews.
- Internal audit that only checks documents, not operation.
- Certification scope that excludes the systems customers actually rely on.
Request a scoping call if you need a gap analysis or evidence review before an audit.
Frequently asked questions
Is ISO 27001 mandatory in Estonia?
No. ISO/IEC 27001 is a voluntary international standard. A customer, procurement or sector rule may require it, but it is not a universal legal obligation.
Does ISO 27001 prove NIS2 compliance?
No. An ISO 27001 certificate can support an information-security management system, but NIS2 also requires governance, incident reporting, supply-chain management and supervisory evidence.
How long does certification take?
It depends on scope and maturity. A focused certification project often takes several months, including gap analysis, implementation, internal audit, management review and the certification audit.
Can Tehisabiline issue an ISO 27001 certificate?
No. Certification is issued by an accredited certification body. We can help with scoping, evidence preparation, internal review and remediation, but not with the certification decision.