How ValueMentor helped secure regulatory Go-Live for the UAE’s first national lottery in 24 weeks
Comprehensive security assessments and audits. More than 15 frameworks. Large number of critical systems. One fixed launch date. An independent assurance programme that gave the regulator the evidence it required, and the operator the approval it needed.
01 OVERVIEW
A national first, with no margin for error
In 2024, the United Arab Emirates opened a federally regulated commercial gaming market, overseen by the General Commercial Gaming Regulatory Authority (GCGRA). The first product to reach the public would be the country’s first national lottery. Its launch carried national visibility, a fixed date and no tolerance for a security or data protection failure.
Before a single ticket could be sold, the licensed operator had to prove to the regulator that its platforms, processes and data controls met a body of standards that was new to the region. ValueMentor, an independent security firm approved by GCGRA to perform security testing and audits for the sector, was engaged to produce that proof.
Over 24 weeks, a ten-person ValueMentor team tested and audited 100% of the systems against more than 15 security and privacy frameworks, guided the operator through remediation and kept the regulator informed at every stage. In November 2024, the operator received its Go-Live approval and Certificate of Operation, and the national lottery launched as planned.
Engagement at a glance
| Client | A licensed commercial gaming operator, Abu Dhabi, UAE |
| Regulator | General Commercial Gaming Regulatory Authority (GCGRA) |
| Programme | The UAE’s first national lottery |
| ValueMentor role | GCGRA-approved independent firm for security testing and audits |
| Team | 10 specialists across offensive security, GRC, audit and data protection, with dedicated project management |
| Timeline | 24 weeks to Go-Live (November 2024); continuous compliance support through 2025 and 2026 |
02 THE CHALLENGE
New rules, a fixed date and nowhere to cut corners
The engagement combined four pressures that rarely arrive together: unfamiliar regulation, an immovable deadline, a large and critical estate, and strict limits on where and how the work could be done.
| Challenge | What it meant in practice |
| New regulatory ground | The GCGRA Executive Regulation Bylaw, the World Lottery Association Security Control Standard (WLA-SCS) and the GLI standards were new to the UAE. The operator’s security team lacked prior experience interpreting or evidencing them. |
| A fixed launch date | More than ten regulator-mandated activities had to be completed, and their results accepted, before a Go-Live planned for November 2024. |
| Scale of the estate | Large number of critical systems had to be tested and audited inside the same window. |
| Breadth of benchmarks | More than 15 security and privacy frameworks and regulations applied, each with its own control language and evidence expectations. |
| Remediation inside the window | Findings had to be fixed and retested before approval. The timeline had to absorb discovery, remediation and verification in both stagging and production environment, not testing alone. |
| Strict data residency | Regulated data, including gaming data, had to remain in the UAE. No offshore or remote access was permitted. |
| Fully onsite delivery | All testing ran from the operator’s premises. Every commercial tool and licence had to be deployed and activated on site before work could begin. |
Mandated scope of work
GCGRA required the following activities to be completed and accepted before Go-Live:
| Security testing | Compliance and audit |
| Security Architecture Review Configuration Review and CIS baselining Application Security Testing External Network VAPT Authenticated Internal Network VAPT Static Source Code Review | Sensitive Data Protection Plan ReviewUnified compliance gap assessmentInformation Security Management System (ISMS) AuditUAE Data Protection Regulations AuditInformation Security Processes Maturity Audit |
What the operator set out to achieve
- Obtain Go-Live approval and the Certificate of Operation for the national lottery.
- Ensure comprehensive security coverage across all critical systems.
- Achieve compliance with GLI-19, WLA-SCS and the GCGRA Executive Regulation.
- Ensure secure integration and interoperability across the platform.
- Ensure complete data residency for regulated and gaming data.
- Ensure operational resilience for business continuity.
- Identify baseline deviations and confirm compliance with CIS Benchmarks.
- Complete a full risk analysis and remediate identified issues.
03 THE SOLUTION
A regulator-approved plan, delivered in parallel
ValueMentor’s approach rested on one principle: agree what “done” looks like with the regulator first, then run every workstream at the same time against that shared definition.
01. Mobilise onsite with senior specialists
ValueMentor deployed ten senior specialists across security testing, audit and GRC, supported by dedicated project management, to the operator’s office in Abu Dhabi. All commercial testing tools and licences were installed and activated on the premises. Working entirely onsite met the data residency requirement by design: regulated data never left the UAE, and no remote access was needed.
02. Agree the benchmark before the first test
The team first built a Compliance Requirements Document that set out every requirement applicable to the national lottery across the GCGRA Executive Regulation, WLA-SCS, GLI-19 and the wider framework set. It then produced a Test Plan defining the scope, measurable objectives, approach, tools and deliverables for each mandated activity. Both documents were submitted to GCGRA and approved before fieldwork began. This gave the regulator and the operator a single, agreed definition of success and traced every requirement to a specific activity.
03. Test from the ground up
Testing began with internal and external asset discovery, followed by configuration baselining against CIS Benchmarks. The team then carried out multiple security assessments and testing in the stagging environment first and executed the retesting in production environment to validate the effectiveness of remediation of identified findings. Findings were rated by business risk and reported in a form that fed directly into the operator’s risk management process.
04. Assess compliance once, against every framework
Rather than run separate gap assessments for each standard, ValueMentor’s consulting team mapped the requirements of all applicable frameworks into one unified control set. A single assessment established the maturity of the operator’s information security and compliance programmes and reduced repeated evidence requests. The audit team ran the ISMS, data protection and information security process maturity audits in parallel with security testing, which was essential to fit the 24-week window.
05. Strengthen data protection before auditing it
The Sensitive Data Protection Plan (SDPP) is a core GCGRA requirement which mandates SDPP development in collaboration with an approved Sensitive Data Service Provider (SDSP) like ValueMentor. ValueMentor reviewed the plan ahead of the formal audit, reported gaps and advised the operator on fixes and compensating controls, then validated that those controls worked in practice. The data protection audit that followed tested implementation effectiveness.
06. Fix, verify and close
ValueMentor worked alongside the operator’s teams to remediate findings. The GRC team provided necessary advisory support to define and implement risk treatment actions. Once fixes were in place, the testing team retested each finding in production environment and formally declared closure in the retest report.
07. Keep the regulator close
The project management and audit teams gave GCGRA regular progress updates throughout the engagement, building the regulator’s confidence well before approval was requested. As the launch date approached, the team worked beyond business hours to keep every activity on schedule.
04 THE RESULTS
Approved, certified and launched on time
In November 2024, through the combined efforts of the operator and ValueMentor, and with the support of GCGRA, the operator received its Go-Live approval and Certificate of Operation. The UAE’s first national lottery launched as planned.
From findings to verified closure The team reported potential findings, each rated by business risk so the operator could fix the most serious exposures first. Remediation ran alongside ongoing testing, with ValueMentor advising the operator’s teams on each fix. At retest, 90% of reported findings were confirmed closed and formally declared so in the retest report. Remaining items were addressed through risk treatment actions defined with the advisory support of ValueMentor’s GRC team.
Objectives met
| Objective | Outcome |
| Obtain Go-Live approval and Certificate of Operation | ✓ Achieved in November 2024. The UAE’s first national lottery launched. |
| Ensure comprehensive security coverage | ✓ 100% systems tested and audited across 10+ mandated activities. |
| Achieve GLI-19, WLA-SCS and GCGRA Executive Regulation compliance | ✓ Every applicable requirement mapped in a GCGRA-approved baseline, assessed and evidenced to the regulator. |
| Ensure secure integration and interoperability | ✓ Architecture review, application testing and source code review assessed the platform and its integration points. |
| Ensure complete data residency | ✓ All testing and audit work performed onsite in the UAE. The data protection audit validated the effectiveness of data protection controls. |
| Ensure operational resilience for business continuity | ✓ ISMS and information security process audits assessed the controls that support continued operations. |
| Identify baseline deviations against CIS Benchmarks | ✓ Configuration baselining identified deviations from CIS Benchmarks and fed them into remediation. |
| Deliver risk analysis and remediation support | ✓ Potential findings reported on a risk basis. 90% closed and verified at retest; remaining items managed through defined risk treatment actions. |
Beyond launch: continuous compliance
Go-Live was a milestone, not the finish line. ValueMentor has continued to support the operator through 2025 and 2026 as its trusted digital trust assurance partner, helping it sustain compliance as its platform, threat landscape and regulatory obligations evolve.
05 KEY TAKEAWAYS
What other operators can learn
- Agree the benchmark before the test. A regulator-approved requirements baseline and test plan turned an unfamiliar rulebook into a shared, auditable checklist and reduced the risk of late-stage disputes over scope.
- Unify frameworks to save time. Mapping more than 15 frameworks into one control set allowed a single gap assessment instead of many, and reduced the evidence burden on the operator.
- Run workstreams in parallel. Testing, audits and regulator reporting ran side by side. A sequential approach would not have fitted a 24-week window.
- Treat data residency as a design input. Onsite delivery with locally activated tools kept regulated data in the UAE by default, with no exceptions to manage.
- Findings count only when closed. Risk-based reporting, hands-on remediation advice and formal retesting turned potential findings into verified evidence of closure.
- Keep the regulator informed. Regular, transparent reporting-built confidence ahead of the approval decision.
06 NEXT STEPS
Planning a launch in the regulated UAE commercial gaming market?
We support commercial gaming operators, casino operators and gaming/casino service providers across the region to meet regulatory requirements and secure their business, from pre-licence readiness to continuous compliance.
▸ GCGRA-mandated security testing and audits
▸ GLI-19 and WLA-SCS readiness and gap assessment
▸ ISMS, data protection and sensitive data protection plan audits ▸ Continuous compliance and remediation advisory
