Uganda's National Lotteries and Gaming Regulatory Board has been awarded ISO/IEC 27001, the international standard for information security management.
The NLGRB is among the first government bodies in Uganda to hold it. That matters because of what the Board actually stores.
What the regulator holds
The NLGRB licenses casinos, sports betting and lotteries. To do that it collects detailed records from every operator it authorises.
It also holds information on the people the system is meant to protect.
"As a regulator, we handle very sensitive information," said chief executive Denis Mudene Ngabirano. "As a gaming board, we've adopted technology as our driver for all the processes that we carry out."
That second sentence is the reason the first one is a problem. Digitising a regulator concentrates operator and player data in one place.
What the standard requires
ISO 27001 is not a one-off audit. It sets controls across how an organisation handles information, then requires ongoing monitoring and improvement.
Stella Makona Simiyu, co-founder and managing director of Sentinel Africa Consulting in Uganda, advised on the work.
"Implementing ISO 27001 and benchmarking against it offered a holistic way that the Board could ensure that they are covered 100% in terms of best practice controls," she said.
Musa Wesutsa, group chief executive of Sentinel Africa Consulting, called it "the de facto standard for information security".
Why licensees should care
Operators hand regulators commercially sensitive material. Shareholding, financials, systems detail, player volumes.
In most African markets you submit that and hope. There is rarely a published standard describing how the regulator stores it, who can see it, or what happens after a breach.
Certification does not remove that risk. It does mean an external assessor has checked the controls, and that the Board has to keep meeting them.
For an operator weighing Uganda against a neighbour, it is a small but real point in Uganda's favour.
A busy few weeks for the Board
The NLGRB has been unusually visible this month. It seized more than 370 illegal gaming machines in October, and published the notice confirming Bet1Cent's exit from the market.
Enforcement, orderly exits and now data governance. That is a regulator building out all three sides of its job at once.
Frequently asked questions
What is ISO 27001?
An international standard for information security management. It sets required controls and demands continuous monitoring rather than a single audit.
Why does a gaming regulator need it?
Because it holds licensing records, operator financials and information about players. Digitised services concentrate that data in one place.
Is the NLGRB the first in Uganda to get it?
It is among the first government organisations in the country to achieve the certification.
Who advised on the certification?
Sentinel Africa Consulting, whose Uganda managing director is Stella Makona Simiyu.
Does certification guarantee data cannot be breached?
No. It means controls have been externally assessed and must be maintained, which is a stronger position than an unaudited one.
Source: the certification was reported by e-Play Africa.
