Subject: Re: NIS2 Directive Applicability Query - Estonian Hosting Company (SupportHost OÜ)
From: "Sander Pelisaar" <[email-masked]>
To: <[email-masked]>
Cc: Riigi Infosüsteemi Amet <[email-masked]>
Date: Mon, 19 Jan 2026 18:51:01 +0200

Dear Mr. Messina,

Thank you for your enquiry. I apologize for the delay in responding.

1.	Because your company provides domain registration services (NIS2 Art. 
2(4)), it falls within the scope of NIS2 regardless of company size and is 
therefore subject to the Estonian Cybersecurity Act (see § 3(2)).
2.	You are required to register the company by 1 March 2026.
3.	ISO/IEC 27001 certification is acceptable. To rely on the exemption, you 
must submit a valid ISO/IEC 27001 conformity certificate to the Information 
System Authority (Riigi Infosüsteemi Amet). As your company qualifies as an 
SME, you are required to implement only the basic security measures 
(“esmased turvameetmed”) set out in the Network and Information Systems 
Cybersecurity Requirements Act § 51. Nevertheless, I recommend obtaining 
ISO/IEC 27001 certification because the Commission Implementing Regulation 
(EU) 2024/2690 is relevant to domain registration services and may make 
certification advantageous for compliance and supply‑chain assurance.
4.	Entities subject to the Estonian Cybersecurity Act must implement basic 
security measures (\"esmased turvameetmed\") as set out in the Network and 
Information Systems Cybersecurity Requirements Act § 51. Implementation of 
ISO/IEC 27001 will in most cases satisfy these measures. Because your 
company provides domain registration services, the Commission Implementing 
Regulation (EU) 2024/2690 is also relevant - 
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2690 
<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur-lex.europa.eu%2Flegal-content%2FEN%2FTXT%2F%3Furi%3DCELEX%3A32024R2690&data=05%7C02%7Cria_uldmeil%40ria.ee%7Ce3a0ed730ce84b58f3aa08de577aedcd%7Cb6dc47a368bc49d3a9cf0db148e9f818%7C0%7C0%7C639044382687256054%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=Uo%2BiBMtOCLjr6yGdl7IL4VRIbXHT8XS%2Ba%2BJSNY3orGY%3D&reserved=0> 
.
5.	As a NIS2 and Cybersecurity Act subject, you must report cyber incidents 
no later than 24 hours after becoming aware of an incident, where the 
reporting threshold is met.
6.	The staff headcount criterion covers full‑time, part‑time, temporary and 
seasonal staff and includes employees, secondees who are treated as 
employees under national law, owner‑managers and partners engaged in regular 
activity and deriving financial advantage from the enterprise. See the 
European Commission User guide to the SME definition 
<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fec.europa.eu%2Fdocsroom%2Fdocuments%2F42921&data=05%7C02%7Cria_uldmeil%40ria.ee%7Ce3a0ed730ce84b58f3aa08de577aedcd%7Cb6dc47a368bc49d3a9cf0db148e9f818%7C0%7C0%7C639044382687336675%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=fF5lHdVzAZ4rZXgSlmUuUGMW2rpysLISBieLQoXW%2FS4%3D&reserved=0> 
.
7.	If you host clients that are NIS2 entities, they will likely require you 
to comply with NIS2 obligations (or at least certain security controls) as 
part of supply‑chain security requirements.
8.	Transition periods: entities that were in scope as of 31 December 2025 
have a three‑year period to comply with the new requirements; newly in‑scope 
entities also have a three‑year compliance period. All in‑scope entities 
must register by 1 March 2026.

Best regards,

Sander Pelisaar

Legal Adviser

+372 5366 7126

 <mailto:[email-masked]> [email-masked]

Information System Authority of Estonia

Legal Department

Pärnu maantee 139a, Tallinn 15169

 <https://eur10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ria.ee%2F&data=05%7C02%7Cria_uldmeil%40ria.ee%7Ce3a0ed730ce84b58f3aa08de577aedcd%7Cb6dc47a368bc49d3a9cf0db148e9f818%7C0%7C0%7C639044382687388949%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=CV06iG%2FihIhPbL%2BOmeu2c4R56AEvDg56hw%2FoYhfXByM%3D&reserved=0> 
www.ria.ee

Saatja: Ivan - SupportHost <[email-masked]>
Saatmisaeg: reede, 16. jaanuar 2026 00:38
Adressaat: Riigi Infosüsteemi Amet <[email-masked]>
Koopia: cert üld <[email-masked]>
Teema: NIS2 Directive Applicability Query - Estonian Hosting Company 
(SupportHost OÜ)

[email-masked] <mailto:[email-masked]>  ei saada teile sageli 
meilisõnumeid. Lugege teavet selle kohta, miks see on oluline 
<https://aka.ms/LearnAboutSenderIdentification>

E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava 
linke ega manuseid!

Dear RIA Cybersecurity Team,

I am writing to seek official clarification regarding the applicability of 
the NIS2 Directive requirements to our Estonian company under the recently 
amended Cybersecurity Act.

Company Information:

*	Company name: SupportHost OÜ
*	Registry code: 16285499
*	EMTAK code: 63102 (Web hosting services)
*	Legal address: Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 
15551
*	Annual revenue: Approximately €1 million
*	Workforce: 1 formal employee (owner) + 8 independent contractors
*	Average total workforce: 9 people

Business Activities: We provide web hosting services (shared hosting) and 
domain registration services to approximately 6,000 clients across various 
sectors (small businesses, professionals, agencies, e-commerce). Our servers 
are physically located in Germany and the Netherlands.

Current Compliance Status: We obtained ISO/IEC 27001 certification 
approximately one month ago (November 2024).

Questions:

Based on the recent amendments to the Cybersecurity Act (particularly the 
September 2025 regulation establishing thresholds of 50 employees and €10 
million revenue for E-ITS exemption), I would appreciate your clarification 
on the following points:

1.	NIS2 Applicability: Given our company size (under 50 employees and under 
€10M revenue), are we subject to NIS2 Directive requirements under Estonian 
law?
2.	Registration Obligation: Are we required to register with CERT-EE by 
April 1, 2026?
3.	E-ITS Requirements: Does our ISO 27001 certification fulfill the E-ITS 
requirements, or are we exempt from E-ITS obligations due to our company 
size?
4.	Minimum Security Obligations: If we are exempt from full NIS2/E-ITS 
requirements, are there any basic security measures ("esmased turvameetmed" 
per §51) that we must implement?
5.	Incident Reporting: Are we obligated to report cybersecurity incidents to 
RIA/CERT-EE even if below the size thresholds?
6.	Workforce Calculation: For the purpose of the 50-employee threshold, how 
should we count independent contractors working under partita IVA 
arrangements? Are they considered employees?
7.	Supply Chain Requirements: If we host clients who are themselves subject 
to NIS2 (essential or important entities), does this create any compliance 
obligations for us as their service provider?
8.	Transition Period: If we are determined to be subject to NIS2 
requirements, what is the exact timeline for achieving compliance?

Background for Question: We want to ensure full compliance with Estonian 
cybersecurity regulations and provide accurate information to our clients. 
Additionally, as we plan to grow our business toward €300K monthly revenue 
in the next few years, we want to understand at what point we would become 
subject to NIS2 requirements.

Could you please provide written confirmation of our obligations (or 
exemption) under the current Estonian implementation of the NIS2 Directive? 
This will help us plan our compliance strategy appropriately.

I am available for any follow-up questions or to provide additional 
information if needed.

Thank you for your assistance.

Best regards,

Ivan Messina

Founder & Owner SupportHost OÜ

Registry Code: 16285499

Email: [email-masked] <mailto:[email-masked]>