Electronic Communications Office
Cybersecurity
Secure and reliable digital solutions are essential to ensuring that society, businesses, and public services can operate without disruption. The Electronic Communications Office of Iceland (ECOI) oversees the cybersecurity and information security of electronic communications providers, digital infrastructure, and other entities subject to cybersecurity legislation.
The objective of this supervision is to promote robust risk management, enhanced preparedness, and stronger protection against cyber threats. To this end, ECOI assesses the cybersecurity posture of regulated entities through self-assessments, audits, testing, and the analysis of security incidents. The Office also supervises electronic identification and trust services and provides guidance on the implementation of cybersecurity requirements.
Here you will find information on the key activities of ECOI’s Cybersecurity Department, security incident reporting, cybersecurity supervision and requirements, as well as electronic identification and trust services.
Regulatory
The Electronic Communications Office of Iceland (ECOI) supervises network and information security at telecommunications companies, operators of digital infrastructure, and providers of digital services.
Self-assessment
ECOI assesses the cybersecurity governance and risk management frameworks of telecommunications providers and digital infrastructure operators, including through self-assessment questionnaires that enable organisations to evaluate their compliance with minimum cybersecurity requirements.
Audits and testing
The Electronic Communications Office of Iceland (ECOI) conducts audits and testing to assess whether telecommunications companies and operators of digital infrastructure comply with applicable legal and regulatory requirements. The objective is to obtain a clear picture of the state of cybersecurity and information security and to identify areas where improvements are needed.
Preliminary reviews of security incidents
ECOI conducts preliminary reviews of security incidents to assess their severity and determine whether security measures and procedures meet regulatory requirements. Cases are generally concluded with a findings letter and, where appropriate, recommendations for corrective action. Where warranted, a formal administrative investigation is initiated, which may lead to an official regulatory decision.