EstoniaKüberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds the same essential and important entities as this jurisdiction's companion risk-management row, on the same Section 3 and Section 2(2) scope.
- Submit an initial report to RIA without delay and no later than 24 hours after becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity, unless you are a security authority.NIST CSF 2.0RS.CO-02
- A cyber incident has a significant effect if any of: it rates at least severe under your own risk analysis; it prevents you continuing your service beyond the maximum permitted outage in your service-level agreement or continuity requirements; it disrupts another provider's service continuity; resolving it requires extraordinary measures from your risk analysis or continuity documentation; it has caused or risks significant damage to you, another provider or your service's users; or a European Commission implementing act names it as significant. An incident that also disrupts your service in another EU member state is always significant.
- Where you delegate the administration of your system to another person or host it with another person, make sure that person notifies you within 24 hours of becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity (Section 8, subsection 1-1).NIST CSF 2.0GV.SC-05
- Follow with an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report, unless you are a trust service provider, in which case you submit it within 24 hours instead.NIST CSF 2.0RS.CO-02
- Submit an interim report if RIA asks for one, and a final report within one month of the incident report, or, if the incident is still unresolved at that point, treat that report as interim and submit a further final report within one month of resolution.NIST CSF 2.0RS.CO-03
- Where relevant, notify within a reasonable time any person the significant incident or a significant cyber threat may affect, or the public where you cannot notify affected persons individually; inform the public yourself if RIA requires it, where public awareness serves prevention, resolution or the public interest.NIST CSF 2.0RS.CO-02
- You may also voluntarily notify RIA of a cyber incident, a security vulnerability or a cyber threat, and from of a near-miss cyber incident, including a vulnerability report submitted anonymously.
These lines are LexLint's reading of the law's text. Also read by: Riigi Infosüsteemi Amet (RIA), the Estonian Information System Authority (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.CO-03Information is shared with designated internal and external stakeholders
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A violation of Section 8(1), (1-1), (4-1), (4-2), (4-3), (5), (7) or (8-1) by an essential or important entity is a 'väärtegu' (misdemeanour) under Section 18-2(1) (essential entity) or Section 18-3(1) (important entity), a form of quasi-criminal liability under Estonia's Penal Code procedural framework, prosecuted extrajudicially by RIA under Section 19(1) rather than tried as an ordinary crime, and time-barred after three years under Section 19(4). Only a fine (rahatrahv) is provided; the Act attaches no imprisonment to a Section 8 violation.
Penalty structure
Section 18-2(2) sets the ceiling for an essential entity that is a legal person at EUR 10,000,000 or 2 percent of its total worldwide annual turnover for the preceding financial year, whichever is greater; Section 18-3(2) sets the ceiling for an important entity that is a legal person at EUR 7,000,000 or 1.4 percent of that turnover, whichever is greater. Subsection (1) of each section sets the same fixed ceiling (EUR 10,000,000 for an essential entity, EUR 7,000,000 for an important entity), with no turnover limb, for a violation by an entity that is not a legal person.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Riigi Infosüsteemi Amet (RIA), the Estonian Information System Authority, which the Cybersecurity Act's own Section 19(1) names as the extrajudicial adjudicator (kohtuväline menetleja) for a violation of Sections 18-2 through 18-5, including a violation of this Section 8 reporting duty, and which also receives the notifications as the national CSIRT.
Settledness
- As of
- Guidance link
- https://www.ria.ee/uudised/uuest-aastast-laienes-kuberturvalisuse-seadus
- Guidance body
- Riigi Infosüsteemi Amet (RIA), the Estonian Information System Authority
- Open questions
- Does the ministerial regulation on incident-notification data and procedure issued under Section 8(8), or a future European Commission implementing act under Directive (EU) 2022/2555 Article 23(11) on the incident-report or final-report format, narrow or expand the significance triggers Section 8(2) already states?
What this law does
Section 8 requires an essential or important entity, other than a security authority, to submit an initial report to RIA (Riigi Infosüsteemi Amet, the Estonian Information System Authority) without delay and no later than 24 hours after becoming aware of a cyber incident with a significant effect on system security or service continuity, or one whose significant effect is not obvious but can reasonably be expected.
Section 8(2) defines 'significant effect' by six alternative conditions: the incident rates at least severe under the entity's own Section 7 risk analysis; it prevents continuing the service beyond the maximum permitted outage in a service-level agreement or continuity requirement; it disrupts another service provider's continuity; resolving it requires extraordinary measures identified in the risk analysis or continuity documentation; it has caused or risks significant damage to the entity, another provider or the service's users; or it is significant under a European Commission implementing act adopted under Directive (EU) 2022/2555 Article 23(11).
Section 8(3) makes an incident always significant where it also disrupts the service in at least one other EU member state. Section 8, subsection 4-1, requires an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report. A trust service provider instead submits that incident report within 24 hours under Section 8, subsection 4-2. Section 8, subsection 4-3, requires an interim report on RIA's request.
Section 8(7) requires a final report within one month of the incident report, treated as interim and followed by a further final report within one month of resolution if the incident remains unresolved at that point. Section 8(5) requires the entity to notify, within a reasonable time, a person whom the significant incident or a significant cyber threat may affect, or the public where affected persons cannot be individually notified.
Section 8(6) lets RIA itself inform the public after consulting the entity, or require the entity to, where public awareness serves prevention, resolution of the incident, or the public interest generally.
Section 8-1 lets a service provider voluntarily notify RIA of a cyber incident, security vulnerability or cyber threat, and lets any other person notify it of a significant-effect incident, security vulnerability or cyber threat, including a vulnerability report submitted anonymously, processed under the same Sections 8 and 12 procedure.
From a notification under Section 8-1 may also concern a near-miss cyber incident, and a notification by any other person may also concern a cyber incident without a significant effect. From Section 2, point 19, defines a cyber incident as an event that damages the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data, or of services offered through or accessible via a network and information system.
From that day Section 2, point 22-1, defines a near-miss cyber incident (napilt toimumata jäänud küberintsident) as an event that could have damaged that availability, authenticity, integrity or confidentiality but was prevented or did not occur.
Section 5(3) designates RIA as the competent authority and single point of contact under Directive (EU) 2022/2555 Article 8, the authority for large-scale incidents and crises under Article 9, the national computer security incident response team (CSIRT) under Article 10, the coordinated-vulnerability-disclosure coordinator under Article 12, and Estonia's participant in the CSIRTs network under Article 15. All these duties entered into force on as part of Estonia's NIS2 transposition.
Section 1(4) applies this Act with the derogations that follow from an EU legal act regulating the operation of a provider's network and information system and its cyber-incident notification equivalently to this Act. Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .