Book FREE Consultation

URM is pleased to provide a FREE 30 minute consultation on Transitioning to ISO 27001:2022 for any UK-based organisation. Once an enquiry form has been submitted, we will be in touch to understand the nature of your enquiry and to book a mutually convenient time for a 30-minute consultation slot with one of URM’s specialists.

GC RTS Consultancy Services

UK’s most experienced and proficient information security auditors has been conducting RTS audits for over a decade

GC RTS Consultancy Services

The Gambling Commission (GC) Remote Gambling and Technical Software Standards (RTS)

In order to operate a remote gambling product in the UK, licensed remote gambling operators and software gambling operators are required to conform with the Gambling Commission’s (GC) Remote Gambling and Technical Software Standards (RTS).  A key objective of the RTS is to “ensure customers are not exposed to unnecessary security risks by choosing to participate in remote gambling”.  To this end, licensees need to meet specific security requirements, which are based on implementing a subset of ISO 27001 Annex A controls.  It should be noted that there is no requirement to implement any of the main management system clauses of ISO 27001.

Applicable remote licensees also need to undergo an annual security audit conducted by an independent and suitably qualified auditor.  If your organisation needs to comply with GC’s RTS, URM can offer a range of consultancy and assessment services.

RTS Gap Analysis

If your organisation is looking to operate a remote gambling product in the UK and needs to meet the security requirements of the RTS, URM is able to conduct a gap analysis of the security controls you have implemented against the control areas from the Standard.  These control areas taken from ISO 27001 cover such topics as information security policies, human resource security, access control, cryptography, physical and environmental security, supplier relationships etc.   The focus of the gap analysis will be the controls that are protecting critical systems, e.g., electronic systems involved in processing payment card information or systems involved in the generation of random numbers or communication networks that transmit sensitive customer information.  Following the gap analysis, URM will produce a report which will not only detail those areas where your organisation needs to develop or improve your control implementation but also recommendations on how to address any gaps.

Implementation Support

Following your gap analysis, URM can help you with any remediation work particularly in developing policies (e.g., IS Policy and supporting policies), processes and a suitable training programme.  Some of the policies and processes may be existing documents which need amending or refining, whereas others may need to developed from scratch.  Whichever it is, URM will ensure they are developed with 2 goals in mind.  Firstly, they will be tailored to match your culture and style and reflect what you actually do.  Secondly, our consultants will ensure that anything produced will fully meet the requirements of GC RTS.

RTS Assessment Services

URM is one of the UK’s most experienced and proficient information security auditing organisations and has been conducting RTS audits for over a decade..  When conducting and reporting on GC RTS audits, URM follows the guidance and advice provided by the GC.  As such, the methodology for conducting audits will be based on enquiry, evidence and observation.  In terms of observation, this is ideally carried out on site and there is an expectation from the GC, unless particular circumstances dictate, that a number of key controls are audited on site.  

The evidence that will be required comprises policies, procedures and documents, such as an IT security policy supported by policies on user access, data backup, change management, cryptographic controls etc.  URM will seek to gather evidence on specific audit areas such as network diagrams, software changes, reviews of penetration tests and vulnerability scans, audit log reviews and training records.  We will look to conduct staff interviews and walkthroughs with evidence noted for selected processes

When reporting on audit results, URM adopts the same terminology as per ISO 27001 certification audits, i.e., major nonconformities, minor nonconformities and opportunities for improvement.  For each control, URM will indicate what evidence was observed and whether your organisation conforms.  If it doesn’t, URM will indicate the level of nonconformance.  For all non conformances, URM will indicate what needs to be done to remedy the situation.

Get in touch

Please note, we can only process business email addresses.

Why URM?

Track record

URM is one of the UK’s most experienced and proficient information security auditors and has been conducting RTS audits for over a decade and has conducted hundreds of ISO 27001-related audits.  URM has an unparalleled track record of assisting over 400 organisations to achieve and maintain certification to ISO 27001 and as such is perfectly placed to not only conduct audits but conduct gap analyses and help organisations remediate any gaps identified.

Assessor Competence

The Gambling Commission requires that the annual security audit is conducted by an independent and suitably qualified auditor.  All of URM’s auditors hold one or more of the main recognised qualifications, e.g., ISO 27001 Lead Auditor, Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) or Certified Information Systems Security Professional (CISSP).  A number also hold the Payment Card Industry Qualified Security Assessor (PCI QSA) qualification.  Furthermore, RTS audit reports are all peer reviewed before being submitted.

Achieving optimum balance

If used to remediate any gaps, URM’s goal is to achieve the optimum balance between meeting the RTS control requirements and ensuring the control (e.g., policy, process or other documentation) is tailored to your organisation’s size, culture and business objectives.

Information Security FAQISO 27001 FAQ

Common Pitfalls Identified in Organisations Seeking ISO 27001 Certification

Published on

URM’s blog discusses the common pitfalls of the ISO 27001 implementation and certification process, and how you can avoid making the same mistakes.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
Planning Your ISO 27001 Audit Programme

URM’s blog drills down into ISO 27001 audits, offering advice on how to effectively develop and implement an ISO 27001 conformant audit programme.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
How to Meet the ISO 27001 Requirements Around Interested Parties

URM’s blog provides advice and guidance on how you can meet the ISO 27001 requirements around interested parties and their needs and expectations.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
Lessons Learnt from Early ISO 27001:2022 Transitions

URM’s blog, produced in collaboration with BSI, discusses common mistakes we have seen in early ISO 27001:2022 transitions, and how to avoid them.

Read more
URM were super helpful and knowledgeable, talking and walking me through each one of the tests and providing some useful information on security and how to improve things in the future.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.