Pre-audit against E-ITS controls
We assess the current state against the standard's baseline protection controls and show which modules are relevant to you.
Estonian information security standard
E-ITS consulting – implementing the Estonian information security standard without excess bureaucracy
E-ITS is mandatory for organisations performing public duties. We help you set the scope, run the baseline protection analysis, prepare the documentation and reach the audit – without the standard becoming a project of its own.
Who it is for
Who this service is for
- Authorities and companies performing a public duty, for whom E-ITS is mandatory
- Organisations that moved from ISKE to E-ITS and whose implementation is unfinished
- Companies delivering contracts for the state that are required to comply with E-ITS
- Organisations that already have ISO 27001 and want to align it with E-ITS
What is included
What the service includes
Scoping and asset mapping
A list of information and supporting assets and the assignment of security classes – the foundation of E-ITS, and where most projects stumble.
Creating a roadmap
A realistic plan with owners and deadlines that takes your budget and procurement calendar into account.
Risk analysis
Risk analysis where baseline protection is not enough – without unnecessary duplication.
Developing procedures, or support
Documentation your people actually use, not just show to the auditor.
Internal audit and representation
We run the internal audit, prepare the management review and stand beside you at the audit.
Process
How we work
Scope and clarifying the obligation
We start from what is actually mandatory for you and what is not – this saves the most work of anything.
Mapping assets and security classes
Information assets, supporting assets and their security classes – the logic of E-ITS grows from here.
Baseline protection analysis
We compare existing controls with the standard's modules and record the gaps.
Implementation and documentation
Putting missing controls in place and creating documentation together with your team.
Internal audit and audit
We check readiness, fix the shortcomings and support you through the audit.
Outcome
What you end up with
- Mapped information assets and assigned security classes
- The baseline protection analysis result and an implementation overview
- Documented procedures and guidelines
- Internal audit report and management review
- A clear view of how far along you are with compliance
FAQ
Frequently asked questions
Who is E-ITS mandatory for?
E-ITS is mandatory for organisations performing public duties. The private sector may adopt it voluntarily. If you are not sure whether the obligation applies to you, we help clarify that before the project starts.
We have ISO 27001. Do we have to do E-ITS from scratch?
No. E-ITS is compatible with ISO/IEC 27001 and much of your existing management system, risk analysis and documentation can be reused. The main work is typically in asset mapping and covering the baseline protection modules.
What happened to ISKE?
ISKE was replaced by E-ITS and former ISKE users had to transition by the end of 2022. E-ITS itself is updated regularly, which means implementation is not a one-off project but needs maintenance.
How does E-ITS relate to the Cybersecurity Act?
The Cybersecurity Act sets the obligations and supervision; E-ITS provides a concrete framework of controls for meeting them. We help put the two together so you do not build two parallel systems.
Is E-ITS mandatory for you?
If you are unsure whether and to what extent the obligation applies to you, we help clarify that before any project starts.
See also
Related services
ISO 27001 consulting
Preparing your company for the ISO 27001 audit.
Read more →Information security audit and assessment
Independent assessment and an audit-readiness check.
Read more →Information security manager (CISO) as a service
Professional information-security leadership as a service – for companies that don't need a full-time security manager.
Read more →