Electronic Communications Office of Iceland (ECOI) assesses the cybersecurity arrangements and risk management frameworks of telecommunications providers and operators of digital infrastructure, among other methods, through self-assessment questionnaires. These questionnaires enable organizations to evaluate their compliance with minimum cybersecurity requirements. The purpose of these self-assessments is to provide ECOI with a better understanding of the cybersecurity posture of entities subject to its oversight. They also give organizations an opportunity to evaluate their security governance and controls against national cybersecurity requirements and internationally recognized best practices. The objective is to conduct self-assessments of the largest telecommunications providers and digital infrastructure operators every three years.

This follows the current approach, under which ECOI has already carried out two self-assessments among operators of essential digital infrastructure services and one among the country's largest telecommunications providers.In addition, ECOI works in cooperation with other supervisory authorities to implement self-assessments across other critical infrastructure sectors in accordance with cybersecurity legislation. This forms part of the Minister’s Cybersecurity Action Plan.The results of these self-assessments provide valuable input for defining and prioritizing further supervisory activities, including audits, reviews, and testing of telecommunications providers and other regulated entities.