EstoniaKüberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential entity (ülioluline üksus) or an important entity (oluline üksus) drawn from the Cybersecurity Act's Section 3 entity and sector lists, which mirror NIS2's Annex I and Annex II; Section 2(2)'s digital-service-provider definition names a domain name system service provider, a top-level domain name registry operator, a domain name registration service provider, a cloud computing service provider, a data centre service provider, a content delivery network service provider, a managed service provider, a managed security service provider, an online marketplace operator, and an online search engine or social media platform provider, so a service in any of those lines is reached at the qualifying size threshold or above; the wider sector classes (energy, transport, banking, health, drinking water, central and local government public administration and the rest) are reached too, by declaring that you are an essential or important entity.
- Apply, on an ongoing basis, appropriate and proportionate technical, operational and organisational security measures, built on your own risk analysis, to manage the risks to the system you use in your activities or to provide your service, to prevent or minimise a cyber incident's impact on your service's recipients and on other services, and to prevent, detect or resolve a cyber incident.NIST CSF 2.0ID.RA-06
- Account for your own needs and security requirements, current European and international standards where relevant, the cost of the measures, their proportionality to your risk exposure and to the likelihood and severity of a cyber incident including its societal and economic impact, and a systemic, comprehensive approach that protects both the systems and their physical environment.NIST CSF 2.0ID.RA-05
- Where you delegate management of your system to another person, or host it with another person, you remain responsible for ensuring that person applies the security measures.NIST CSF 2.0GV.SC-07
- Designate at least one management board member (or, if you have only one, that member, or the equivalent office-holder if you have no board) to approve your security measures, monitor their implementation and answer for that duty, and have that person complete regular training to understand and assess cyber risk, its impact on your services, and how to manage it.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- The specific technical, methodological and, where relevant, sector-specific content these measures must have, including the Estonian Information Security Standard (E-ITS), comes from a Government or ministerial regulation issued under this duty.
These lines are LexLint's reading of the law's text. Also read by: Riigi Infosüsteemi Amet (RIA), the Estonian Information System Authority (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.SC-07The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
From , a violation of Section 7(1), (2), (3) or (5) by an essential or important entity (Sections 18-2(1) and 18-3(1) named Section 7(7) as well until Section 7(7) was repealed) is a 'väärtegu' (misdemeanour) under Section 18-2(1) (essential entity) or Section 18-3(1) (important entity), a form of quasi-criminal liability under Estonia's Penal Code procedural framework, prosecuted extrajudicially by RIA under Section 19(1) rather than tried as an ordinary crime, and time-barred after three years under Section 19(4). Only a fine (rahatrahv) is provided; the Act attaches no imprisonment to a Section 7 violation.
Penalty structure
Section 18-2(2) sets the ceiling for an essential entity that is a legal person at EUR 10,000,000 or 2 percent of its total worldwide annual turnover for the preceding financial year, whichever is greater; Section 18-3(2) sets the ceiling for an important entity that is a legal person at EUR 7,000,000 or 1.4 percent of that turnover, whichever is greater. Subsection (1) of each section sets the same fixed ceiling (EUR 10,000,000 for an essential entity, EUR 7,000,000 for an important entity), with no turnover limb, for a violation by an entity that is not a legal person.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Riigi Infosüsteemi Amet (RIA), the Estonian Information System Authority, which the Cybersecurity Act's own Section 19(1) names as the extrajudicial adjudicator (kohtuväline menetleja) for a violation of Sections 18-2 through 18-5, including a violation of this Section 7 duty (the offence provisions in Sections 18-2 and 18-3 do not list Section 6-1); Estonia's security authority (julgeolekuasutus) performs the Article 8(1) competent-authority tasks to the extent Section 14 provides, which covers supervision of the security authorities' own systems.
Settledness
- As of
- Guidance link
- https://www.ria.ee/uudised/uuest-aastast-laienes-kuberturvalisuse-seadus
- Guidance body
- Riigi Infosüsteemi Amet (RIA), the Estonian Information System Authority
- Open questions
- Does the Government or ministerial regulation issued under Section 7(5) and (6), including the Estonian Information Security Standard (E-ITS) and any sector-specific requirements it sets, impose obligations that go beyond the general risk-management duty Section 7 itself already states?
What this law does
Section 7 requires an essential or important entity to apply, on an ongoing basis, appropriate and proportionate technical, operational and organisational security measures, based on its own risk analysis, to manage the risks to the system it uses in its activities or to provide its service, to prevent or minimise a cyber incident's impact on the recipients of its service and on other services, and to prevent, detect or resolve a cyber incident.
It must account for its own needs and security requirements, current European and international standards where relevant, the cost of the measures, their proportionality to its risk exposure and to the likelihood and severity of an incident including its societal and economic impact, and a systemic, comprehensive approach protecting both the systems and their physical environment.
A service provider that delegates system management to, or hosts its system with, another person remains responsible for ensuring that person applies the security measures. The specific technical, methodological and sector-specific content of these measures, including the Estonian Information Security Standard (Eesti infoturbestandard, E-ITS), is set by a Government or ministerial regulation issued under Section 7, subsections 5 and 6.
Section 7(7), in force since , directed a provider named in a European Commission implementing act under Directive (EU) 2022/2555 Article 21(5) to follow that act's requirements for the service it covers. Section 7(7) is repealed with effect from by the Act published as RT I, 06.10.2026, 1.
Section 6-1, also added by the 2025 amendment, requires a service provider to designate at least one management board member, or for a single-member board that member, or the equivalent office-holder for a provider with no board, who approves the security measures, monitors their implementation, is accountable for that duty, and completes regular training to understand and assess cyber risk.
Section 2(2) defines 'digitaalse teenuse osutaja' (digital service provider), an entity class reached by this duty, as an umbrella covering a domain name system service provider, a top-level domain name registry operator, a domain name registration service provider, a cloud computing service provider, a data centre service provider, a content delivery network service provider, a managed service provider, a managed security service provider, an operator of an online marketplace, and a provider of an online search engine or social media platform.
Section 3(2) names a central government public administration entity as an essential entity. Section 3(2) also names a local government public administration entity as an essential entity, so this duty reaches both public and private duty-bearers. Section 1(2) excludes state-secret and classified-foreign-information systems from the Act. Section 1(2) also excludes systems the Ministry of Defence needs for international military cooperation and national military defence preparation.
Estonia's security authority (julgeolekuasutus) performs the competent-authority tasks of Directive (EU) 2022/2555 Article 8(1) to the extent Section 14 provides. Under Section 14(5) that covers administrative supervision of the security authorities' own systems. Both Section 7 and Section 6-1 entered into force on as part of Estonia's NIS2 transposition. Section 7 already stood in the Act before then, and the 2025 amendment reworded it.
A subject is given a three-year transition period to bring its activities into line with these requirements. Under Section 4-1(4), a vital-service provider (elutähtsa teenuse osutaja) instead brings its activity into line within the term set in the manner provided by Section 83(4)(3) of the Crisis Situations and National Defence Act (kriisiolukorra ja riigikaitse seadus).
Section 83(4)(3) of that Act provides that the term for meeting the Cybersecurity Act's requirements is to be no longer than five years from designation as a vital-service provider. RIA's own account of the amendment states that from 2026 the number of Estonian undertakings subject to these requirements grew by about 3,000, to roughly 6,500.
Section 1(4) applies this Act with the derogations that follow from an EU legal act regulating the operation of a provider's network and information system and its cyber-incident notification equivalently to this Act. Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .