EstoniaAct Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification
RT I, 11.10.2024, 1, §§ 1 and 7 (Credit Institutions Act §§ 82^4 and 92^4)
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a credit institution licensed in Estonia, Sections 82^4 and 92^4 of the Credit Institutions Act, added by this Act, bind you alongside Regulation (EU) 2022/2554.
- Comply with the requirements of Regulation (EU) 2022/2554, including by using and managing network and information systems as the Regulation provides (Credit Institutions Act Section 82^4(1)).NIST CSF 2.0GV.OC-03
- Develop, manage and test ICT business-continuity policies and ICT response and recovery plans as part of your business continuity plan, in line with DORA Article 11 (Section 82^4(2)).NIST CSF 2.0ID.IM-04
- Notify the Financial Supervision Authority and the Information System Authority of a major ICT-related incident as DORA Article 19 provides, using the reporting forms and deadlines set under DORA Article 20, and, when you notify the Authority of a significant cyber threat under Article 19(2), send the notice to the Information System Authority at the same time (Section 92^4(1), (3) and (4)).NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text, as of . Also read by: Finantsinspektsioon (Estonian Financial Supervision Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The penalty provisions the Act adds punish breaches of DORA requirements with a fine for a misdemeanour (väärtegu), not as a crime.
Who enforces it
Enforcement body
Finantsinspektsioon (the Financial Supervision Authority), which performs the tasks DORA assigns to it under Section 6(1) point 7^5 of the Financial Supervision Authority Act.
Settledness
- As of
- Guidance link
- https://fi.ee/et/investeerimine/investeerimisvaldkonna-regulatsioonid/dora-maarusest-ja-nouetest-eesti-finantssektoris-tegutsevatele-ettevotetele
- Guidance body
- Finantsinspektsioon (Estonian Financial Supervision Authority)
- Open questions
- Must a credit institution also notify the Information System Authority (Riigi Infosüsteemi Amet) of a major ICT-related incident itself under Section 92^4(1) of the Credit Institutions Act, when the Financial Supervision Authority's guidance says it forwards the reports it receives to the Information System Authority?
What this law does
The Act Amending the Financial Supervision Authority Act and Other Acts (Finantsinspektsiooni seaduse ja teiste seaduste muutmise seadus, RT I, 11.10.2024, 1), proclaimed by the President of the Republic on , implements Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2556 in Estonian financial-sector law.
Section 1 gives the Financial Supervision Authority (Finantsinspektsioon) the task of performing the duties DORA assigns to it and of cooperating with the cybersecurity authorities of Estonia and other member states, and requires it to take part in the DORA Oversight Forum.
New Section 47^11 of the Financial Supervision Authority Act makes the Authority cooperate with the Information System Authority (Riigi Infosüsteemi Amet), including by consulting it under DORA Article 42(5), and requires the Authority to forward to Eesti Pank without delay any notice or report under DORA Article 19(4) that it receives from a vital-service provider.
Section 7 adds Section 82^4 to the Credit Institutions Act, which requires a credit institution to comply with DORA, including by using and managing network and information systems as DORA provides, to develop, manage and test its ICT continuity and ICT response and recovery plans under DORA Article 11, and which exempts it from the cybersecurity requirements of Chapter 2 of the Cybersecurity Act.
New Section 92^4 of the Credit Institutions Act requires a credit institution to notify the Authority and the Information System Authority of a major ICT-related incident as DORA Article 19 provides.
A penalty provision the Act adds to other financial-sector acts punishes breaches of DORA Articles 5 to 14, 16 to 18, 19(1) and (3) to (5), and the other listed Articles, with a fine of up to EUR 5,000,000 or up to twice the profit gained or loss avoided, and for a legal person alternatively up to 10 percent of its or its consolidation group's consolidated turnover. The provisions Section 11(1) lists enter into force on , and the rest of the Act took effect on .
When LexLint raises it
When your app profile says your app is a bank.