NADC Launches Information Security Management System Implementation Training

The National Anti-Doping Center held an introductory training session for heads of structural units, marking the beginning of the implementation of the Information Security Management System (ISMS).

The session was opened by NADC’s Information Security Officer, who presented the purpose of the system, approaches to risk management, and the changes that the structural units will need to introduce during its implementation.

Why NADC Is Implementing an ISMS

NADC processes sensitive information on a daily basis, including athletes’ whereabouts information, doping control results, and Therapeutic Use Exemptions. Protecting this information is essential for compliance with the WADA Code and the International Standard for the Protection of Privacy and Personal Information (ISPPPI), as well as with Ukrainian legislation on personal data protection.

The Information Security Management System has been developed in accordance with the requirements of the ISO/IEC 27001:2022 international standard. It will establish procedures for classifying information, controlling access to it, protecting it during storage and transmission, and responding to potential incidents. The organisation is currently moving from developing the regulatory framework to implementing these mechanisms in its day-to-day operations.

Topics Discussed During the Training

Participants were introduced to the information protection framework, which will cover six consecutive areas of work — from identifying information assets to regularly reviewing and improving security measures.

Particular attention was paid to the practical changes that each structural unit will need to implement, including the transition to secure corporate channels for storing and transmitting data, the use of multi-factor authentication, and the role of every employee in promptly identifying and reporting potential incidents.

The training was the first step in preparing staff for these changes. The next stage will involve the phased implementation of the relevant measures within each structural unit.

Objectives for 2026

The organisation has set six objectives to be achieved throughout the year as part of the system’s implementation. These include protecting athletes’ data, demonstrating compliance with international requirements, successfully completing an ISO/IEC 27001:2022 certification audit, and raising staff awareness of information security.