Uganda’s National Lotteries and Gaming Regulatory Board (NLGRB) has received ISO/IEC 27001 certification, an international standard for information security management. The Board is among the first government organizations in Uganda to achieve the certification, as the country continues to move public services online.
The certification is significant for an organization responsible for regulating casinos, sports betting and lotteries and protecting the public from the potential harms of gambling. The NLGRB handles sensitive information about the operators it licenses and the people it serves.
“As a regulator, we handle very sensitive information,” said Denis Mudene Ngabirano, the Board’s Chief Executive Officer. “As a gaming board, we’ve adopted technology as our driver for all the processes that we carry out.”
Stella Makona Simiyu, Co-founder and Managing Director of Sentinel Africa Consulting in Uganda, said the growth of digital services has increased the risks to personal information and privacy.
“Implementing ISO 27001 and benchmarking against it offered a holistic way that the Board could ensure that they are covered 100% in terms of best practice controls,” she said.
The standard also requires ongoing monitoring and continuous improvement, helping organizations maintain their information security practices over time. Musa Wesutsa, Group CEO of Sentinel Africa Consulting, said information security is essential for public institutions that deliver services and handle citizens’ data.
“ISO 27001 is the de facto standard for information security,” he said.
The NLGRB’s experience highlighted that information security is not solely an IT responsibility. Licensing staff, for example, collect information from regulated businesses and members of the public.
“Many people think that information security is only something that concerns the IT,” said Isaac Koshaho, a Senior Licensing Officer at the Board. “But from my perspective and from the work I do, it concerns us in licensing.”
The certification process broadened the Board’s approach beyond technical tools such as firewalls, endpoint protection and access controls. Internal auditors, who also coordinate risk management, helped prepare and review key documents, including the information security management policy, procedures and access rights.
Sentinel Africa Consulting, the NLGRB’s implementation partner, tailored its approach to the Board’s relatively small team. Simiyu said technology could help make secure practices part of the organization’s routine. The Board adopted Rodela to manage its information security programme and centralize evidence.
“Rodela helped us mostly centralize the process, having all the evidence gathered in one place,” said Collins Akampurira, an IT Officer at the NLGRB.
Staff also received security awareness training through KnowBe4, including a simulated phishing exercise. Patrick Kafumi, a consultant and project manager at Sentinel Africa, said the exercise helped staff recognize phishing attempts and understand how easily people can be caught by them.
The work also involved making sure policies were being followed, rather than simply filed away. Gershom Lukwago, the Board’s Senior IT Officer for Compliance, said the team checked that documents were in place, operational and being used in practice. During the certification audit, auditors assessed the security measures, the supporting documentation and whether the system was working in practice. Mike Kamau, Managing Director for East and Southern Africa at CertiTrust, the certification body, said auditors look for evidence that policies are being applied.
“We come to the ground and actually check: is ISO alive? Is there evidence? Can we see footprints that you’ve been living this document?” he said. The aim, he added, is to ensure the system supports the organization’s objectives.
The certification may also provide a model for other organizations. Simiyu said the NLGRB’s achievement could serve as a benchmark for government institutions and private-sector organizations. For the Board, it also strengthens its ability to advise the gaming industry on information security and player protection. Lukwago said the goal is to help ensure that players are secure and are not cheated.
Those involved in the project stressed that achieving certification requires time and commitment from senior management. Ngabirano described ISO 27001 as a strategic business initiative, rather than simply a compliance exercise, and encouraged leaders in government and business to consider certification.
“I would say just do it,” said Simiyu. “Your board will always, always ask you: how secure am I? This is the beginning of answering that question.”
The NLGRB said the certification is not just a credential to display, but a continuing commitment to protecting the information it handles. Ngabirano thanked the Board’s staff, management and board, the Ministry of Finance, and Sentinel Africa Consulting for their contributions to the project.
The Board’s journey is featured in An ISO 27001 Certification Journey, a documentary produced by Sentinel Africa Consulting in collaboration with the NLGRB. The trailer is available on YouTube. The full documentary is scheduled to premiere on October 16, 2026.
About the NLGRB
The National Lotteries and Gaming Regulatory Board (NLGRB) supervises casinos, sports betting and lotteries in Uganda. Its mandate includes protecting the public from the adverse effects of gaming.
About Sentinel Africa
Sentinel Africa is a risk management and information security advisory firm operating in Kenya, Uganda and Rwanda. It supports organizations through standards such as ISO/IEC 27001, from initial assessment to certification, and served as the NLGRB’s implementation partner for this project.
