The CIBELAE virtual workshop entitled Strengthening Security Culture in Lotteries: From Diagnosis to Action was held from 2-4 September, with the support of the World Lottery Association (WLA).
The three-day workshop aimed to facilitate a first approach to certification, promoting regional alignment with demanding international standards. International experts and representatives of Ibero-American lotteries covered:
- Regional diagnosis and participatory dynamics to identify common barriers and opportunities along the path to certification.
- Best practices and management tools, based on the experiences of certified lotteries in the region.
- The importance of lottery security, current threats, and technological innovations applied to its strengthening
The importance of WLA security certification
The WLA Security and Risk Management Committee (SRMC), is responsible for developing and maintaining the WLA Security Control Standard (WLA-SCS:2024). On the final day, members from the SRMC provided a deep dive into security best practices, including:
- Anton Stiglic, Vice President of Information Technology, CIO, Loto-Québec, Canada, and WLA SRMC TWG Chair
- Fabien Marechal, Head of Corporate Cybersecurity, FDJ United, France, and WLA SRMC TWG Vice Chair
- Pablo Piriz, IT Manager, Banca de Quinielas de Montevideo, Uruguay, and WLA SRMC TWG Member.
Why cybersecurity matters
Cybersecurity for lotteries and sports betting operators is key to protect networks, systems, and data from a wide variety of evolving threats, to ensure trust and resilience.
Gaming operators rely on technology, so a breach could halt operations and undermine player trust.
This is an enterprise-wide risk, not just an IT issues, which requires leaders to understand the stakes in order to protect revenue and reputation.
WLA SCS certification – a blueprint for lottery security
Achieving certification to the WLA Security Control Standard (WLA SCS:2024) is important for the reputation of our industry, and for public trust. It signals to stakeholders (government, players, partners) that a lottery has a mature, robust security program in place and demonstrates alignment with globally accepted best practices.
The WLA Security Control Standard is the only global cybersecurity framework tailored specifically for lottery and gaming. It builds on IEC/ ISO 27001 and adds sector-specific controls across four annexes:
- Annex A – G Controls: Organizational security
- Annex B – L Controls: Game operation integrity
- Annex C – S Controls: Development and delivery of gaming systems
- Annex D – M Controls: Multijurisdictional game requirements
Two certification levels are available:
- Level 1: Foundational security (ISO 27001 not required)
- Level 2: Advanced security (ISO 27001 required)
Ensuring preparedness and resilience
The WLA SCS requires documented policies, risk assessments, incident response plans, regular audits, and continuous improvement. These elements enable operations to defend against attacks and quickly recover if an incident occurs.
Levels of certification
WLA-SCS Certification Level 1: Compliance with the WLA-SCS Level 1 proves a basic but essential level of information security for gaming operators and shows their commitment to achieving WLA-SCS Level 2, the highest level of certification. ISO/IEC 27001 certification is not a prerequisite. Level 1 certification is not open to WLA Associate Members, but only to Regular Members.
WLA-SCS Certification Level 2: Compliance with the WLA-SCS Level 2 allows WLA member organizations to ensure the integrity, availability, and confidentiality of services and information vital to their secure operation. Level 2 certification is open to both Regular and Associate Members. ISO/IEC 27001 certification is mandatory.
Find out more about the work and activities of the SRMC
For coverage in Spanish about the event, check out the CIBELAE article
