Arvid Nordquist had long worked to ensure access to accurate data. With a growing focus on information security and new opportunities within AI, the need for control over the company’s information increased – not least the data within its ERP system. A joint review with Implema provided both answers and some unexpectedly positive news.
Arvid Nordquist is a family-owned Swedish company with a history dating back to 1884. Today, the company is a well-known player in coffee and food, with operations including production, distribution, and sales. When business-critical processes are closely intertwined, access to accurate and secure information becomes crucial.
Secure Systems Are Not Enough
Arvid Nordquist had long worked with data quality, availability, and backup. But as demands for information security increased, new questions arose. How sensitive was the information? Where was it located? And who could access it?
An important step was to begin classifying information in the Microsoft environment using Microsoft Purview. This allowed the company to gradually build a better picture of what information existed and how it needed to be handled.
“We need to know what kind of data we are using and how it should be handled. Just by starting to classify the information, we gain a completely different insight into the data we actually possess,” says Adam Nygren, IT Operations Manager at Arvid Nordquist.
AI Makes Old Questions More Urgent
When AI tools can find, compile, and use information in new ways, existing permissions and information structures gain greater significance. For Arvid Nordquist, the question became concrete in connection with plans to introduce Microsoft Copilot more broadly across the organization.
“When the question of a broader rollout of Copilot came up, I felt we first needed to understand what it would actually be able to access. We needed to work on information security in parallel,” says Adam Nygren.
The rollout of Copilot therefore had to go hand-in-hand with the work on classifying and protecting information. However, the work in the Microsoft environment simultaneously raised another question.
“But What About the Information in the ERP System?”
Microsoft Purview provided better control over information in the Microsoft environment. But Arvid Nordquist’s SAP system also contains data from central parts of the business, which Purview does not reach. What did information security look like there?
“When we were asked how we handle the information in the ERP system, my reaction was something like: ‘Right, how do we do that?’ It’s a large part of our critical business data,” says Adam Nygren.
The question became the starting point for a joint workshop with Implema.
From Gut Feeling to Actual Risk
The workshop gathered expertise from both IT and business operations. Together with Implema, the group reviewed what information was in the SAP environment, how it was used, who had access to it, and what consequences it could have if it fell into the wrong hands. Older data and the need for data purging were also discussed from the perspectives of security, data quality, and future use.
A central part was to assess risks based on probability and consequence, instead of assuming all information was equally sensitive.
“Sometimes you can enter such a discussion with the feeling that the risks are greater than they actually are. When you systematically look at probability and consequence, you get a much better picture of where the real risks lie and can focus efforts where they provide the greatest benefit,” says Charlott Brask, Quality & Process Manager at Implema.
“It is the business that best understands the importance of information, and IT that has knowledge of the systems and security. When these perspectives meet, a relevant risk assessment can be made, and the right measures prioritized,” adds Ida Ottosson, Project Manager within Business Transformation at Implema.
Fears Proved Greater Than Risks
The review showed that Arvid Nordquist already had a stable foundation in how the ERP system environment, information access, and security had been built.
“I went into the workshop convinced that we would find large areas that we needed to work on further. Instead, we received confirmation that we have worked diligently with our ERP system for a long time and made good decisions regarding how access and data should be structured,” says Adam Nygren.
At the same time, concrete areas for improvement were identified. Older information could be cleared out, and the workshop sparked ideas on how classification could be automated when information is extracted from SAP, for example, in reports.
Just as important was that Arvid Nordquist gained a clearer picture of what did not need to be prioritized. Resources could be directed to the areas where there was actual need.
“It creates confidence to be able to show that you have actually gone through the issues, performed a risk assessment, and made conscious decisions,” says Charlott Brask.
From IT Issue to Shared Responsibility
The work has also made information security a more natural part of the discussion when new initiatives and projects are planned.
“I think there has been a clear shift in perspective. When we run projects that might affect our ERP system, the question now comes up about information and security. Just having more people aware of the issue and seeing its importance is a big step forward,” says Adam Nygren.
Information classification is now being gradually expanded, with future possibilities to use more automated classification to detect and manage sensitive information.
As AI plays a larger role, control over information becomes even more critical. To use AI in a secure and value-creating way, organizations need to understand what information the technology has access to, how current it is, and how it may be used.
Control over information thus becomes both a protection for current operations and a prerequisite for taking the next step.
