Uganda’s NLGRB details security measures behind ISO 27001
The regulator has introduced centralised security management, phishing awareness training and cross-department controls to safeguard sensitive information.
Key takeaways:
- Uganda’s NLGRB detailed its information security measures in an update published on October 28.
- The regulator adopted Rodela to centralise its information security management processes and supporting evidence.
- Staff received KnowBe4 security awareness training, including a simulated phishing campaign.
- Licensing, IT, internal audit, risk management, and compliance teams participated in the certification process.
- CEO Denis Mudene described ISO 27001 certification as a strategic business initiative rather than simply a compliance exercise.
Uganda.- The National Lotteries and Gaming Regulatory Board (NLGRB) has detailed the information security measures behind its ISO/IEC 27001:2022 certification, including technology, staff training, and organisation-wide controls aimed at protecting sensitive regulatory data and supporting player protection.
In a statement released on October 28, the regulator outlined how it implemented its information security management system, with contributions from its licensing, IT, internal audit, risk management and compliance teams.
The regulator adopted Rodela, a system for managing its information security management system and centralising supporting evidence, on the recommendation of its implementation partner, Sentinel Africa Consulting. “Rodela helped us mostly centralise the process, having all the evidence gathered in one place,” said Collins Akampurira, IT Officer at the NLGRB.
The board also introduced KnowBe4 security awareness training, including a simulated phishing campaign to help staff recognise fraudulent messages and understand cyber threats.
The certification process extended beyond the IT department. Internal auditors helped prepare and review key documents, including the information security management policy, methodologies, and access rights. Compliance staff also checked that procedures were operational and being followed.
The NLGRB supervises casinos, sports betting, and lotteries in Uganda. It handles sensitive information from licensed operators and the public, making information security an important part of its regulatory responsibilities.
Gershom Lukwago, Senior IT Officer for Compliance at the NLGRB, said the regulator wanted to ensure players were secure and not cheated. The board also expects to use its experience to guide stakeholders and regulated platforms on security measures relevant to player protection.
NLGRB CEO Denis Mudene described ISO/IEC 27001 certification as a strategic business initiative rather than simply a compliance exercise. The regulator said the achievement could provide a benchmark for other government institutions and private-sector organisations seeking to strengthen their information security practices.
The certification was issued by Certi-Trust and covers the NLGRB’s Kampala head office operations, including personnel, supporting systems, and information assets. Announced in July 2026, it is valid until June 8, 2029, subject to annual surveillance audits.
Frequently asked questions (FAQs)
- What is ISO/IEC 27001:2022 certification? ISO/IEC 27001:2022 is an international standard for information security management systems. It provides a framework for organisations to manage information security risks and protect sensitive information.
- What is Rodela and how does Uganda’s NLGRB use it? Rodela is the system used by the NLGRB to manage its information security processes and centralise supporting compliance evidence.
- What is KnowBe4 and why did the NLGRB introduce it? KnowBe4 is a security awareness training platform. The NLGRB used it to train staff to recognise phishing attempts and understand cybersecurity threats.
- Who certified Uganda’s NLGRB under ISO/IEC 27001:2022? Certi-Trust issued the NLGRB’s certification, which was announced in July 2026 and is valid until June 8, 2029, subject to annual surveillance audits.
