New information security requirements and the updated Estonian Information Security Standard E-ITS take effect on 1 September 2026

Estonia’s updated Estonian Information Security Standard, or E-ITS, will take effect on 1 September 2026. Its aim is to establish uniform and strong cyber-protection rules for network and information systems that have the greatest impact on everyday life. The standard focuses on mapping the protection needs of business processes and hardware, describing and managing risks, and testing and checking the continuity of systems. The obligation to commission external audits will be reduced, and the existing preliminary, interim and follow-up audits will be replaced by internal organizational assessments. Micro and small enterprises with fewer than 50 employees and annual turnover or a balance-sheet total not exceeding €10 million will be exempt from implementing E-ITS and from external auditing. Existing security measures will have a three-year transition period.