The Information System Authority (RIA) organises protection on a national level for the public and private sector network and information systems that are essential for the functioning of the Estonian state.
The services that are essential for society are defined in subsection 3 of the Cybersecurity Act.
Aims and activities of CIIP
-
Collection and administration of data about CII
-
Compilation of sectoral reports on the risks to CII
-
Sectoral involvement of service providers and information exchange
-
Development of security measures
- Development of instructions and sample materials
- Provision of substantive advice and giving recommendations to service providers for risk analysis and a more effective implementation of security measures
- Raising cyber security awareness
Definitions
Critical infrastructure (CI) means an asset, system or part thereof, which is essential for the maintenance of vital societal functions, and the health, safety, security, economic or social well-being of people, and whose disruption or destruction would have a significant impact in a Member State as a result of the failure to maintain those functions (see Council Directive 2008/114/EC).
Critical information infrastructure (CII) means information and communications systems whose maintenance, reliability and safety are essential for the proper functioning of a country. The critical information infrastructure is a part of the critical infrastructure.
Network and information system means an electronic communications network within the meaning of subsection 2 (8) of the Electronic Communications Act, any device or group of interconnected or related devices, one or more of which, pursuant to a program, perform automatic processing of digital data, or digital data stored, processed, retrieved or transmitted by aforesaid elements for the purposes of their operation, use, protection and maintenance.
Last updated: 10.04.2026
