20:04:34:11Integrity and security assessment -- Scope.

The scope of the online pari-mutuel wagering system integrity and security assessment is subject to the approval of the commission and must include: (1) A vulnerability assessment of digital platforms; mobile applications; internal, external, and wireless networks with the intent of identifying vulnerabilities of all devices; the online pari-mutuel wagering systems; and applications transferring, storing, or processing personal identifying information or other sensitive information connected to or present on the networks; (2) A penetration test of all digital platforms; mobile applications; internal, external, and wireless networks to confirm devices; the wagering systems; and applications that are susceptible to compromise; (3) A review of the firewall rules to verify the operating condition of the firewall and the effectiveness of the firewall's security configuration and rule sets that must be performed on all perimeter and internal firewalls; (4) A technical security control assessment approved by the commission with generally accepted professional standards; (5) An evaluation of information security services, cloud services, payment services, financial institutions, payment processors, location services, and any other services that may be offered directly by the licensee or involve the use of third parties; and (6) At the discretion of the executive secretary, any additional assessments or specific testing criteria that may be required by internal controls.

Source: 53 SDR 35, effective September 30, 2026.