LapIT strengthens information security in northern Finland in partnership with Netum — continuity management is at the core of the strategy

LapIT is responsible for the organisation of ICT services for the municipal sector in northern Finland. This means safeguarding functions that are critical to the security of supply: As an in-house company that is owned by municipalities, wellbeing services counties and municipally-owned limited liability companies in Lapland, LapIT looks after the IT infrastructure and information security of Lapland Central Hospital, water utilities, electricity distribution companies and schools, for example.

Netum has been LapIT’s trusted partner in cybersecurity matters since 2023. According to Risto Hoppula, Security Manager at LapIT, the need for an external partner resulted from increased demand, which LapIT could no longer manage with its internal resources alone.

• "Even with LapIT's approximately 190 employees, we cannot manage on our own in the prevailing global situation. Geopolitical instability and the escalation of various security threats in recent years have made our customers increasingly aware of threats and risks related to information security," Hoppula explains.

LapIT has an ISO 27001-certified information security management system that covers all of its operations and all LapIT locations.

Cyber attacks against municipal organisations and increasingly advanced forms of phishing have made many public sector organisations more aware of information security threats. While Hoppula believes that there is an increased understanding of information security, the circumstances and level of preparedness vary considerably in the sparsely populated northern region.

• "The larger cities are up-to-speed on things and they have strong competence in information management. Smaller municipalities, on the other hand, have weaker resources, and the administrative director of a small municipality may serve as the designated data protection officer alongside all of their other duties. In such cases, it is extremely important that we can offer Netum's services to address gaps in skills and resources," Hoppula says.

Deeper customer insight

According to Account Director Eija Mattsson from Netum, a typical project with LapIT concerns a municipality that has insufficient internal resources and capabilities, which means that Netum's broad offering can be a significant help. In information security consulting, it is essential to first assess the current situation in order to determine which development areas are the most acute.

• "The most important added value for the customer comes from our ability to look at the situation from a fresh perspective. We have experts with diverse experience in information security, data protection and other aspects of IT. They provide LapIT's customers with access to the industry's best practices. Our experts are able to draw on their expertise from different sectors and provide sparring support to the customer organisation on a very broad scale," Mattsson notes.

An external partner is often also a financially sensible alternative for public sector organisations. Increasing regulation related to information security continuously creates new demands on municipalities, whose resources are already stretched thin.

• "As a partner, we scale our services according to the customer's needs. For example, we can provide services one day per week. Instead of having to recruit a full-time specialist, the municipality can take advantage of an external service that matches their requirements precisely," Mattsson explains.

Focus on continuity management

Netum develops not only LapIT’s customers' operations, but also LapIT’s own operations. In autumn 2024, Netum carried out a continuity management development project for LapIT. As LapIT deals with matters that are critical for the functioning of society, the company also wanted to bring more certainty to the continuity of its own operations.

According to Janne Perälä, Director of Industry-independent Services at LapIT, continuity management is one of LapIT’s strategic goals.

"This is directly related to the resilience of society: for example, hospitals and the water supply must function even if there are disruptions in the distribution of electricity. We must be able to recover from any threat or disruption quickly and in such a way that the impacts on society are minimised," Perälä notes.

Netum’s experts conducted extensive interviews with the personnel of LapIT and its owner-customers in order to assess the current situation. The extensive data collection phase was followed by a three-day workshop in which the data was analysed by key personnel and the most important development areas were selected. The workshop established a roadmap for LapIT's continuity programme, which includes the development areas and related targets, the persons responsible for them, and a preliminary schedule that also specifies dependencies.