NIS2 in Estonia: short answer
NIS2 is the EU directive on cybersecurity risk management. Estonia implemented it through the Cybersecurity Act (Küberturvalisuse seadus, KüTS), in force from 1 January 2026. The main cybersecurity authority is RIA.
If your organisation is in a covered sector and meets the size test, you must register with RIA, apply ten minimum risk-management measures, manage supply-chain risk and report significant incidents. Entities in scope on 1 January 2026 had to submit their activity data by 31 March 2026; the transition period for implementing the measures runs to 1 January 2029.
The practical work is not a policy binder. It is a risk register, an incident process, tested backups, access control, supplier evidence and a management decision trail.
Does NIS2 apply to your organisation?
Apply a two-step test: sector and size. Both normally need to match. Some services are covered regardless of size.
| Group | Typical examples |
|---|---|
| Energy | Electricity, gas, oil, hydrogen, heating and cooling; charging points. |
| Transport | Road, rail, air and water transport, ports, airports, urban transport. |
| Banking and finance | Credit institutions, trading venues, central depositories and financial-market infrastructure. |
| Health | Hospitals, healthcare providers, medicines and medical devices, reference laboratories. |
| Water and wastewater | Drinking-water supply, wastewater collection and treatment. |
| Digital infrastructure | Data centres, cloud, CDNs, DNS, top-level domains, trust services. |
| ICT service management | Managed service providers (MSP) and managed security service providers (MSSP). |
| Public administration | State and municipal bodies, excluding core security, defence and law-enforcement activities. |
| Space, post, waste, chemicals, food | Space systems, postal services, waste management, chemical production and food production, processing and distribution. |
| Manufacturing | Medical devices, electrical equipment, machinery, motor vehicles and other listed products. |
| Digital providers | Online marketplaces, search engines and social networks. |
| Research | Research organisations carrying out applied research or development. |
| Question | How to assess | Result |
|---|---|---|
| 1. Are you in a covered sector? | Compare your main service with Annexes I and II. Do not rely on the company name or a broad activity code. | No: NIS2 is unlikely to apply. Yes: continue. |
| 2. Are you at least medium-sized? | At least 50 staff, or annual turnover or balance sheet above €10 million; include partner and linked enterprises. | Yes: likely in scope. No: check size-independent services. |
| 3. Is the service covered regardless of size? | Trust services, DNS, top-level domains, electronic communications and certain public-administration entities. | May apply even to a smaller provider. |
This is a readiness screen, not a legal opinion. Group structures, exceptions and sector definitions can change the result.
Short NIS2 scope check
Answer four questions. The check runs only in your browser; nothing is uploaded.
RIA registration
Registration is a notification of activity, not a certificate of compliance. Log in to the business area of eesti.ee, open the cybersecurity service-provider notification and submit the requested company, contact, sector and country details.
- Confirm scope: sector, service, size and group relationships.
- Prepare a 24/7 contact: a role mailbox and phone that will work during an incident.
- Submit accurate data: do not guess the sector; use the form and RIA guidance.
- Report changes: notify RIA of changes within two weeks.
- Save proof: confirmation, submission time, submitter and a copy of the data.
If you missed the 31 March 2026 deadline, register now and document why. Registration opens a supervisory dialogue; it does not replace the risk assessment or the evidence pack.
The ten NIS2 duties
Article 21 sets minimum areas for risk-management measures. They are deliberately broad: the organisation must decide how each area applies and keep evidence that the measure works.
- Risk analysis and information-security policy.
- Incident handling, detection and reporting.
- Business continuity, backup and crisis communication.
- Supply-chain security and supplier assessment.
- Secure acquisition, development and vulnerability handling.
- Effectiveness testing and security assessment.
- Basic cyber hygiene and security training.
- Cryptography and encryption where appropriate.
- Access control, asset management and least privilege.
- Multi-factor authentication, secure communications and emergency communication.
Use the NIS2 checklist (Estonian) to map each area to an owner, evidence and a test date.
Incident reporting: 24, 72 and 1 month
| When | Report | What to include |
|---|---|---|
| Within 24 hours | Early warning | What happened, when it was detected, whether it is ongoing or cross-border, initial severity and contact. |
| Within 72 hours | Notification | Affected systems and users, initial assessment, indicators and measures already taken. |
| Within 1 month | Final report | Root cause, impact, mitigation, recovery and measures to prevent recurrence. |
Record the time, sender, content and acknowledgement of every report. An incident report does not replace containment, recovery or legal advice. In Estonia, use the channel and fields prescribed by RIA.
What audit evidence looks like
NIS2 does not create a single mandatory audit certificate. Supervisors and customers can ask you to show that the measures operate. A credible evidence pack usually contains:
- Risk register: assets, threats, likelihood, impact, treatment and owner.
- Management decision: board minutes, approved risk appetite, budget and remediation deadlines.
- Technical evidence: configuration, access reviews, MFA, backup restore tests, logging and vulnerability handling.
- Supplier evidence: due diligence, contractual security requirements and review notes.
- Incident evidence: exercise reports, reporting records and lessons learned.
- Training evidence: attendance, content and phishing-exercise results.
A penetration test can test a system; it cannot replace governance, documentation or a supplier process. See the audit scope guide (Estonian).
Fines and supervision
For essential entities, fines can reach €10 million or 2% of worldwide annual turnover, whichever is higher. For important entities, the ceiling is €7 million or 1.4% of worldwide annual turnover. Supervisors can also issue warnings, binding instructions, remediation orders and temporary restrictions.
| Entity type | Maximum fine |
|---|---|
| Essential entity | €10 million or 2% of worldwide annual turnover, whichever is higher |
| Important entity | €7 million or 1.4% of worldwide annual turnover, whichever is higher |
The bigger operational risk is often downtime, data loss and lost customer trust. A fine is not automatic; the supervisor weighs severity, duration, impact and cooperation. It is also not the only cost of a weak incident process.
30-day readiness plan
- Days 1–3: confirm scope, group size and registration status; name an accountable owner.
- Days 4–7: build or refresh the asset and risk register; identify the top five scenarios.
- Days 8–14: test backup restore, MFA, privileged access and the incident contact route.
- Days 15–21: collect supplier and technical evidence; fix the highest-risk gaps.
- Days 22–30: run a tabletop incident exercise, record board decisions and schedule the next test.
Need a second pair of eyes? Request a scoping call or start with the checklist.
Frequently asked questions
Is NIS2 already in force in Estonia?
Yes. KüTS entered into force on 1 January 2026. RIA is the main cybersecurity authority.
When was the NIS2 registration deadline?
Entities in scope on 1 January 2026 had to submit their activity data to RIA within three months, by 31 March 2026. If you missed it, register now and document the delay.
Does NIS2 require an ISO 27001 certificate?
No. ISO/IEC 27001 is voluntary. It can support an information-security management system, but the certificate does not by itself prove NIS2 compliance.
What are the incident reporting deadlines?
An early warning within 24 hours, a notification within 72 hours and a final report within one month. In Estonia, reports go to RIA through the prescribed channel.
What fines can RIA impose?
For essential entities, up to €10 million or 2% of worldwide annual turnover, whichever is higher. For important entities, up to €7 million or 1.4%.
Does NIS2 require an audit?
NIS2 does not prescribe one audit certificate. Supervisors can ask for evidence that the ten risk-management measures work. An internal or independent audit is one way to test that.