Current through Register Vol. 41, No. 3, September 23, 2024
A. Within 90 days after beginning operations
and annually thereafter, a permit holder shall engage an independent testing
laboratory or an independent firm approved by the director to perform a system
integrity and security assessment of its sports betting operations.
B. The scope of the integrity and security
assessment shall include, at a minimum, all of the following:
1. A vulnerability assessment of internal,
external, and wireless networks with the intent of identifying vulnerabilities
of all devices, internet sports betting platforms, and applications
transferring, storing, or processing personally identifiable information (PII)
or other sensitive information connected to or present on the networks;
2. A penetration test of all
internal, external, and wireless networks to confirm if identified
vulnerabilities of all devices, internet sports betting platforms, and
applications are susceptible to compromise;
3. A technical security control assessment
against the provisions of the sports betting law and this chapter consistent
with generally accepted professional standards and as approved by the
director;
4. An evaluation of
information security services, cloud services, payment services (financial
institutions, payment processors, etc.), location services, and any other
services that may be offered directly by the permit holder or involve the use
of third parties; and
5. Any other
specific criteria or standards for the integrity and security assessment
required by the director.
C. The independent testing laboratory or
independent firm shall issue a report on its assessment and submit it to the
director. The report shall include, at a minimum:
1. The scope of review;
2. Name and company affiliation of any
individual who conducted the assessment;
3. Date of assessment;
4. Findings;
5. Recommended corrective action, if any;
and
6. Permit holder's response to
the findings and recommended corrective action.
Statutory Authority: §§
58.1-4007,
58.1-4015.1,
and
58.1-4030 through
58.1-4047
of the Code of Virginia.
