Estonia EISA / ISKE

Estonian Information System Authority guidelines - ISKE framework for public sector systems.


Short name	EISA EE
Region	Europe
Country or scope	Estonia
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers EISA EE

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for EISA EE.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for EISA EE and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EE-EITS-INV` Baseline Asset Inventory	The baseline security methodology requires a structure analysis inventorying all applications and systems within scope, so every software component must be recorded (E-ITS/ISKE baseline methodology, inherited from IT-Grundschutz structure analysis)	Scan
`EE-CSA-SEC` Duty to Apply Security Measures	System operators covered by the Cybersecurity Act must apply organisational and technical measures proportionate to risk to keep systems secure, including maintaining software at known, patchable versions (Cybersecurity Act 2018, security-measures obligation)	Scan
`EE-EITS-PATCH` Patch Management Precision	Baseline patch and change management modules require software to run at precisely determined versions rather than vague or floating version specifications (E-ITS operational security modules)	Scan
`EE-CSA-INC` Incident Notification Readiness	Significant cyber incidents must be reported promptly to the national CSIRT (CERT-EE), which requires the ability to quickly match affected components against published vulnerability identifiers (Cybersecurity Act 2018, incident-notification obligation)	Scan
`EE-EITS-DOC` Documented Security Records	Implementation of baseline measures must be documented and auditable, so machine-readable security records need a document identity and creation timestamp (E-ITS documentation requirements)	Scan
`EE-CSA-SUP` Responsibility for Outsourced Services	Service providers remain responsible for security when relying on third parties, requiring the supplier of software components underpinning the service to be identified (Cybersecurity Act 2018, service-provider responsibility)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ISKE-M1`	Security Policy and Management (M1)
`ISKE-M2`	Organisation of Information Security (M2)
`ISKE-M3`	Human Resource Security (M3)
`ISKE-M4`	Physical and Environmental Security (M4)
`ISKE-M5`	Communications and Operations Management (M5)
`ISKE-M6`	Access Control (M6)
`ISKE-M7`	Information Systems Acquisition and Development (M7)
`ISKE-M8`	Supplier Relationships (M8)
`ISKE-M9`	Incident Management (M9)
`ISKE-M10`	Business Continuity Management (M10)
`ISKE-M11`	Compliance (M11)
`ISKE-L1`	Baseline Protection Level (L1)
`ISKE-L2`	Standard Protection Level (L2)
`ISKE-L3`	High Protection Level (L3)

Policy templates

Written for EISA EE:

Estonia ISKE Implementation Policy
Estonia EISA Incident Reporting Procedure

And 22 from the standard set, adapted to EISA EE.