20:04:34:12Integrity and security assessment -- Report.

The full independent information technology security professional's report on the assessment must be submitted to the executive secretary no later than thirty days after the assessment is conducted and must include: (1) A scope of the review; (2) The name and company affiliation of the individual or individuals who conducted the assessment; (3) The date of assessment; (4) Findings; (5) Recommended corrective action, if applicable; and (6) The hub licensee's or online wagering services provider's response to the findings and recommended corrective action. When approved by the executive secretary, the independent information technology security professional may leverage the results of prior assessments within the past year conducted by the same professional against standards from the International Organization for Standardization, the International Electrotechnical Commission, the National Institute of Standards and Technology, the Payment Card Industry, or equivalent. Any leveraging must be noted in the professional's report. Components unique to the state must be given fresh assessments.

Source: 53 SDR 35, effective September 30, 2026.