Runs an essential service, in Estonia

Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 6-1 and 7, as amended by RT I, 06.10.2026, 1 · Read the law's page

• Apply, on an ongoing basis, appropriate and proportionate technical, operational and organisational security measures, built on your own risk analysis, to manage the risks to the system you use in your activities or to provide your service, to prevent or minimise a cyber incident's impact on your service's recipients and on other services, and to prevent, detect or resolve a cyber incident.
• Account for your own needs and security requirements, current European and international standards where relevant, the cost of the measures, their proportionality to your risk exposure and to the likelihood and severity of a cyber incident including its societal and economic impact, and a systemic, comprehensive approach that protects both the systems and their physical environment.
• Where you delegate management of your system to another person, or host it with another person, you remain responsible for ensuring that person applies the security measures.
• Designate at least one management board member (or, if you have only one, that member, or the equivalent office-holder if you have no board) to approve your security measures, monitor their implementation and answer for that duty, and have that person complete regular training to understand and assess cyber risk, its impact on your services, and how to manage it.
• This binds an essential entity (ülioluline üksus) or an important entity (oluline üksus) under the Cybersecurity Act's Section 3, whose lists mirror NIS2's Annex I and Annex II; meeting those criteria brings you in, with no declaration. A domain name system service provider or top-level domain name registry operator is essential at any size (Section 3(2) points 1 and 7). A cloud computing, data centre, content delivery network, managed service or managed security service provider is essential at 250 or more employees with a balance sheet over EUR 43 million or turnover over EUR 50 million (Section 3(3)), and important from 50 employees with a balance sheet or turnover over EUR 10 million (Section 3(4) point 8); an online marketplace, online search engine or social media platform provider is important from that 50-employee size (Section 3(5)). A domain name registration service provider is not bound by this duty and only reports its details to RIA (Section 3-1). Energy, transport, health, drinking water, public administration and the other sector classes are reached the same way, but a credit institution, a trading venue operator and the securities register keeper are exempt and follow Regulation (EU) 2022/2554 (DORA) instead (Credit Institutions Act Section 82^4(3), Securities Market Act Section 124^6(9), Securities Register Maintenance Act Section 30^2(2)).
• The specific technical, methodological and, where relevant, sector-specific content these measures must have, including the Estonian Information Security Standard (E-ITS), comes from a Government or ministerial regulation issued under this duty.

Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 8 and 8-1, as amended by RT I, 06.10.2026, 1 · Read the law's page

• Submit an initial report to RIA without delay and no later than 24 hours after becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity, unless you are a security authority.
• A cyber incident has a significant effect if any of: it rates at least severe under your own risk analysis; it prevents you continuing your service beyond the maximum permitted outage in your service-level agreement or continuity requirements; it disrupts another provider's service continuity; resolving it requires extraordinary measures from your risk analysis or continuity documentation; it has caused or risks significant damage to you, another provider or your service's users; or a European Commission implementing act names it as significant. An incident that also disrupts your service in another EU member state is always significant.
• Where you delegate the administration of your system to another person or host it with another person, make sure that person notifies you within 24 hours of becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity (Section 8, subsection 1-1).
• Follow with an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report, unless you are a trust service provider, in which case you submit it within 24 hours instead.
• Submit an interim report if RIA asks for one, and a final report within one month of the incident report, or, if the incident is still unresolved at that point, treat that report as interim and submit a further final report within one month of resolution.
• Where relevant, notify within a reasonable time any person the significant incident or a significant cyber threat may affect, or the public where you cannot notify affected persons individually; inform the public yourself if RIA requires it, where public awareness serves prevention, resolution or the public interest.
• You may also voluntarily notify RIA of a cyber incident, a security vulnerability or a cyber threat, and from 16 October 2026 of a near-miss cyber incident, including a vulnerability report submitted anonymously.
• This binds the same essential and important entities as this jurisdiction's companion risk-management row, on the same Section 3 and Section 2(2) scope.