The business motivator
Norsk Rikstoto is a foundation established by Det Norske Travselskap and Norsk Jockeyclub. Norsk Rikstoto is the only company in Norway that facilitates betting on horse racing and the fundamentals for such activity is sanctioned and regulated by the Norwegian Government.

Availability to the information systems in a timely fashion is a critical success factor for generating revenue at Norsk Rikstoto. Hence, the company has made major investments on disaster recovery facilities to be able to perform a quick fail-over for the most critical applications in case of a severe break-down of services.

Nevertheless, there is a constant need for a professional business tool to organize all the security issues such as policy, rules and procedures, security assessments, disaster recovery and risk management.

The challenge
The majority of the employees at Norsk Rikstoto are highly skilled technicians with a dedicated focus on technical solutions. The basic challenge for the company was to be able to obtain the full overview of and knowledge about the business impact and risks involved in daily business. Historically, there hadn’t been a tradition to include security processes in the projects. The organization had also been quite busy bringing new products to the market.

There was a significant change of course in 2002 when Norsk Rikstoto hired an information security officer. From this moment information security was officially addressed as an area of importance, but there were still challenges related to commitment and involvement. Information security projects were conducted on an ad-hoc basis, and the security officer constantly had to struggle his way through the organization to get attention and budgets.

The solution
There was a breakthrough in the information security management field in 2009 when Norsk Rikstoto carried out a project to make a complete disaster recovery plan. ControlManager™ by Siscon appeared to be the perfect management tool to organize assets, business processes and organizational units and responsibilities for this project. Even though a number of other systems had been tested and evaluated, none of them could match ControlManager™ in respect of simplicity, effectiveness and integration features.

At the time of the ControlManager™ introduction Norsk Rikstoto had also invested a lot of time preparing a security handbook with the professional assistance from security consultants at Nova IT. Once again, ControlManager™ with its strong relationship to ISO27001 and 27002 turned out to be a perfect match. The security handbook and the disaster recovery plan was now an overall and comprehensive security framework presented in a structured and available format.

The result
ControlManager™ has now become an appreciated part of the security operations at Norsk Rikstoto. It has unquestionably become the single source of security related information. “There’s no doubt that ControlManager™ is playing a major part in the process of implementing and maintaining the ISMS”, CISO at Norsk Rikstoto Morten Halvorsen concludes.