The Estonian information security standard (E-ITS) is an Estonian-language standard compatible with the Estonian legal system and developed for ensuring protection for business processes and information systems used for fulfilling public functions.
E-ITS is based on the internationally recognised information security management standard ISO/IEC 27001 and the German baseline security system BSI IT-Grundschutz. The aim of the standard is to raise the level of Estonian public and private sector organisations’ information security and ensure system-wide security administration.
Along with ISO 27001, E-ITS is one of two possible information security standards that is obligatory to implement for vital service providers, public sector entities and others in the purview of the Network and Information System Security Directive (NIS) 2. They include companies engaged in providing district heat, keeping local roads passable, suppling drinking water and sewerage service and supplying medicines.
What are the steps to implementing E-ITS?
Implementation of E-ITS is a systematic process consisting of the following basic steps:
- Mapping business processes
A business process is a set of actions, operations and procedures that can generate goods or services (such as payment service, heating service etc.). The goal of the step is to establish business processes that need security.
- Loss analysis
Loss analysis is used to examine potential losses incurred as a result of breach of basic objectives of each business process, i.e. confidentiality, integrity or availability. Losses consist of direct damage (such as a grant forgone or penalty payment due to legal consequences) and indirect damage (such as loss of reputation). Loss analysis provides input for determining the protection needs (need arising from the value of an asset to safeguard the asset).
- Defining the protection scope
Activities, services (business processes) and related assets belonging to the protection scope and which will be protected by the information security process in future are defined. The goal is to define and document the protection scope as clearly as possible.
- Risk management
A suitable risk management methodology is prepared and a risk management process is carried out, consisting of identification and analysis of risks and planning of risk handling.
- Compiling the basic documents for information security
In basic documents the aims and principles of information security are defined, measurable goals are set, and the information security strategy, policy and other necessary basic documents are compiled. Documents needed for implementing specific security measures are not prepared in this stage.
- Determining security measures and preparing an implementation plan of information security measures
The information security measures implementation plan is a work plan used by the organisation to apply security measures. The implementation plan describes the timeframe, persons in charge, actions and resources. It is a means of managing and controlling the implementation of the entire information security process throughout the organisation. In order to prepare the information security measures implementation plan, security measures to be taken are defined taking into account the results of previous steps and risk analysis, and the current state of their implementation is established. The information security measures implementation plan is then prepared and priorities of activities are determined.
- Implementation of the information security measures implementation plan
Information security measures are implemented pursuant to the implementation plan. Detailed analysis of implementing individual measures is conducted in the course of further work.
Who should implement and audit E-ITS?
E-ITS is obligatory for the following organisations (not an exhaustive list):
- public sector institutions;
- vital service providers;
- other organisations specified in the Cyber Security Act (amendments to the legislation pending, and the list will expand).
A large share of these organisations must also commission an audit of compliance with the terms and conditions of E-ITS.
The following organisations do not have to order one:
- micro-enterprise, i.e., service provider with an average of less than 10 employees and whose balance sheet total for the year is not more than 2 million euros;
- state museum, museum operated by a person in public law, municipality or city government department, institution administered by municipality or city government department, municipal district or city district government department, institution administered by municipal district or city district government department and local government units’ shared authority and institution, not including cases involving a data processor or data controller for the purposes of the GDPR;
- service provider that has implemented security measures conforming to the requirements of ISO/IEC 27001 and submits to the Estonian Information System Authority a certificate to that effect.
Since the Cyber Security Act is being amended, the range of persons required to implement and audit E-ITS may change.
What do I do if the standard seems complicated and I don’t know where to begin?
- Take part in the training at the Digital State Academy. Introduction to and implementation of the Estonian information security standard (E-ITS): from protection needs to implementation plan.
- Talk to implementers at other organisations; ask for advice.
- Take part in Estonian Information System Authority information events.
- Read up on the subject on the eits.ria.ee website.
- Start implementing, because most of the skills and insights develop as you go.
- Contact Grant Thornton Baltic. Write to us using the query form or send an email to our Head of Digital and Information Security Services Artti Aston at artti.aston@ee.gt.com.
