Implementing the Estonian Information Security Standard with Atlassian Products
The Estonian Information Security Standard (opens in a new tab) (E-ITS) is an Estonian-language information security framework that complies with Estonian legislation. Its mission is to develop and improve the level of information security in Estonian public sector institutions as well as private companies.
In this article, we take a closer look at E-ITS and explain how to implement the standard using Atlassian products, based on a hypothetical process.
Cybersecurity as the foundation of a digital nation
As Margus Noormaa, Director General of the Estonian Information System Authority (RIA), stated, cybersecurity is the foundation of a digital nation.
Until 2022, Estonia used the Information Security System (ISKE), which provided government and local authorities with guidelines for ensuring the information security of their databases.
E-ITS, which came into effect in 2023, is based on a risk-based approach and includes specific measures for protecting business processes.
Although E-ITS is primarily mandatory for the public sector, private companies can also implement the standard to ensure the security of their services.
"What matters is that the business keeps running and data does not leak. This is where the standard can help," said Rain Ojastu, Head of the Information Security Measures Department at RIA, commenting on the importance of E-ITS.
Preparing to implement baseline security
Organizations that have previously implemented ISKE may decide to transfer the technical security measures already in place from ISKE to E-ITS during the planning and design phase of the security process.
However, RIA notes that the mapping table showing the correspondence between ISKE and E-ITS measures is intended for informational purposes only. Therefore, fully automated migration is not recommended due to differences between the measures.
If ISKE has not been implemented systematically, practitioners have generally recommended starting from scratch.
The first important step in implementing E-ITS measures is to establish responsibility at the management level.
"First, you need to understand where the organization's requirements come from and what they are. Next, you need an overview of your assets, after which you can select the necessary measures from the E-ITS catalogue," explains Rain Ojastu, briefly outlining what implementing the standard involves.
In the following sections, we will explain in more detail how to carry out these steps.
Implementing a CMDB
When initiating the security process, during the planning and design phase, organizations map their business processes and the relationships between these processes and the applications and data sources, or assets, that support them.
Mapping processes and assets essentially involves implementing a CMDB (Configuration Management Database) for asset management.
By documenting their business processes, organizations gain a structured overview of these processes and an initial understanding of the information and services used within them.
Comprehensive process mapping is also an important input for defining the scope of protection (discussed in more detail in the next section). IT systems, applications, infrastructure, communication connections, and other resources necessary for business processes to function must all be documented.
Depending on the organization's information security maturity, a CMDB may already be in place. Otherwise, it may need to be established or reorganized.
It is important to note that the more detailed the CMDB structure, the more precisely E-ITS measures can be assigned.
Implementing E-ITS measures with Jira and Assets
Jira is a process management tool designed to track tasks (such as implementing a security measure) and their progress.
Assets is a CMDB tool designed to support asset management. Together, these two applications are well suited for implementing E-ITS.
If an organization already uses Jira, one of the key advantages of choosing Assets for asset management is that there is no need to pay for a separate application. Additionally, all your data is stored in one system.
Assets is included at no additional cost in the Jira Service Management Cloud Premium plan and has been part of Jira Service Management Data Center since version 4.15.
Figure 1. Diagram from the E-ITS implementation guide illustrating the steps required to implement E-ITS.
What's Next?
Getting started with E-ITS may seem like a complex undertaking, but investing time and effort in implementing asset management provides a solid foundation for effectively applying the standard.
A well-designed CMDB structure also supports many other processes, such as IT support, change management, and HR management.
The Estonian Information System Authority (RIA) also organizes a variety of training sessions and seminars to help organizations gain a deeper understanding of the standard.
Feel free to contact us to arrange a live demo and see firsthand how Assets supports asset management and the implementation of E-ITS security measures.
Contact
Stay up to date with our news and exciting projects
We share stories about our work and clients, talk about new trends in design and technology, and introduce the people in our team. Our content is a mix of useful information, inspiration, and sometimes a good laugh.