NIS2 Foundation: From Directive to Daily Practice under the Estonian Cybersecurity Act (KÜTS)

On completion of the course, participants is able to:

• determine whether their organisation is an essential or important entity and identify the information to submit to RIA;
• explain management-body duties, accountability, supervision and sanctions under NIS2 and KÜTS;
• translate NIS2 risk-management and incident reporting requirements into practical controls, processes and evidence;
• prepare a prioritised implementation roadmap and evidence pack, including actions to address supplier risk and incident response.

Since 1 January 2026, cybersecurity in Estonia has been a management responsibility with personal accountability and serious penalties. According to RIA, about 6,500 organisations now fall under the amended Cybersecurity Act (KÜTS), which transposes the NIS2 Directive, roughly 3,000 more than before. Fines can reach €10 million or 2% of worldwide annual turnover for essential entities and €7 million or 1.4% of worldwide annual turnover for important entities.

Organisations have a three-year transition period, and it is already under way. Many are still unsure whether they are in scope and what to do first, and smaller suppliers of regulated entities are already being asked for security assurances in contracts. Most available training either explains the directive in general terms or takes the form of a short webinar. This course connects NIS2 requirements to Estonian law and RIA’s expectations and helps participants turn that knowledge into practical work products they can use the following week.

The course aims to give participants a practical understanding of NIS2 requirements in the context of the Estonian Cybersecurity Act (KÜTS), enabling them to assess whether their organisation is in scope, define responsibilities, implement proportionate cybersecurity measures, manage incident reporting and prepare evidence for supervision.

The course is delivered in English.

Target audience and requirements:

• management board members and CEOs;
• CIOs, IT managers and heads of infrastructure;
• CISOs, information security officers and risk managers; compliance officers, DPOs and legal counsel;
• internal auditors and procurement or vendor managers;
• MSPs, IT service providers and consultants serving regulated entities;
• public-sector, energy, transport, health and manufacturing staff responsible for critical services.

No prior NIS2 or legal knowledge is needed.
Participants should have:

• a basic understanding of business IT (systems, networks, cloud) and knowledge of their organisation’s sector, size and main services;
• a working knowledge of English;
• a willingness to join group exercises and discussions.

Learning tools: The hands-on labs are paper-based. A laptop is optional.
Participants are asked to bring key facts about their organisation’s sector, size and main services.
An optional pre-reading pack is sent one week before the course.

Curriculum:
Day 1: Understand and scope (8 hours)

• A. Why NIS2 exists: threat landscape, cost of incidents and regulatory drivers.
• B. The regulatory map: NIS2, KÜTS, E-ITS, RIA and CERT-EE; transition period; fit with CER/HOS, GDPR, DORA and the Cyber Resilience Act.
• C. Are we in scope? sectors, size thresholds, essential and important entities, special cases, group rules and notifying RIA.
• D. Management accountability: duties of the management body, the responsible board member, mandatory training and responsibility that cannot be outsourced.
• E. Supervision and sanctions: RIA supervision, expectations for evidence, fines and corrective measures.
• F. The ten risk-management measures: Article 21, risk-based, all-hazards logic, mapping to E-ITS and ISO/IEC 27001.
• Lab 1: Scoping and accountability clinic.

Day 2: Execute and prove (8 hours)

• G. Recap and risk analysis: proportionality, control selection and documenting decisions.
• H. Incident handling and reporting: significant incidents; the 24-hour early notice, 72-hour notification and one-month final report; cross-border cases and overlap with GDPR.
• I. Continuity and crisis management: backups, recovery targets, crisis roles and decision-making.
• Lab 2: Incident tabletop with a running reporting clock: a ransomware scenario unfolds in stages. Teams decide, escalate and draft the 24-hour notice.
• J. Supply chain and secure development: supplier tiers, contract clauses, outsourced IT, subcontractor notifications and vulnerability handling.
• K. People and technical hygiene: awareness, board training, access control, MFA, cryptography and asset management.
• L. Roadmap and evidence: 30/60/90-day plan, transition period, evidence pack, audit readiness and common failure patterns.
• M. Knowledge check and close: personal action plan and questions.

Teaching methods: The course is delivered in a hybrid format: participants can attend either in the classroom or via Zoom. It combines trainer-led content, live polls, “spot the failure” cases, brief attacker-view demonstrations, group discussions and two paper-based hands-on labs.

Total duration: 16 hours, comprising 14 hours of taught content and interactive learning and 2 hours of hands-on labs.

The course is delivered in English

Assessment method: Achievement of the learning outcomes is assessed through participation in practical group exercises and labs, a short knowledge check and preparation of a personal action plan.

Completion requirements: Participants receive a certificate of completion after attending the course and completing the practical exercises and knowledge check. Participants who do not achieve the learning outcomes may request a certificate of attendance.

The price includes: Course manual, practical toolkit, guided self-study path and the opportunity to contact the trainer with follow-up questions for three months. For courses held at the training centre, the price also includes coffee breaks and group lunches.

Curriculum group: 0612 Database and network design and administration.