This box is not visible in the printed version.
Gambling Commission advice around security audits for holders of all remote gambling operating licences including specified remote lottery licences.
Published: 9 February 2021
Last updated: 26 April 2024
This version was printed or saved on: 7 May 2024
Online version: https://www.gamblingcommission.gov.uk/licensees-and-businesses/guide/security-audit-advice
Overview:
This advice is for holders of all remote gambling operator licences, including specified remote lottery licences.
Table 1 of the Testing strategy for compliance with the remote gambling and software technical standards (Testing strategy) sets out that an annual security audit must be carried out by an independent auditor to assess compliance against the security requirements of the Remote gambling and software technical standards (RTS).
This requirement applies to licensees holding the following types of licence:
Newly licensed remote gambling operators with one or more of the above licences must submit a security audit within 6 months of the granting of the licence. Where licensees do not commence trading within this period, they may apply to the Commission to submit their security audit within 6 months of commencing trading.
A copy of the audit report must be submitted to the Gambling Commission (the Commission) by the licensee annually within 7 days if requested by the Commission or if any major non-conformities were identified.
Reports containing major non-conformities should be submitted to:
securityaudit@gamblingcommission.gov.uk
Requested reports should be submitted according to the process set out in the request.
In summary a ‘good’ standard security audit report must include the following:
Other relevant factors include such as whether the operator or systems are compliant or have been audited against other requirements. For example, Payment Card Industry Data Security Standards (PCIDSS).
The Commission will require as part of the security audit the auditor’s name and background. There must be sufficient information supplied to satisfy us that the auditor is both independent and suitably qualified.
This should include:
A suitable auditor is likely to have completed external security audits of other organisations.
The audit must cover section 7 of the Testing strategy that states the following.
Section 7:
The Commission has highlighted those systems that are most critical to achieving the Commission’s aims and the security standards that will apply to these critical systems:
The Commission requires the auditor to detail how the critical systems were identified and if the audit included the following areas:
The scope of the audit must cover all of the RTS security elements. We recognise however that it is common audit practice to use a risk based approach and where an area has adequate previous recent external audit work or is of low risk then it may not be necessary to re-perform audit work in that area every year. For example, if a separate external audit or review of backup capability was tested in an organisation six months prior and was found to be compliant then the audit need not review that again so soon providing the auditor can review and rely on the previously conducted work.
Where any aspect was not reviewed as part of this audit the report must detail why and include references to any relevant previous external audit that the auditor relied upon. Such previous audit can only be relied on if it was performed to ISO/IEC 27001 (or equivalent) standard.
The Commission must understand how the audit was conducted. It does not consider that a good audit can be conducted remotely based only on documentation.
It should include all three of the following methods:
An information security audit uses a range of assessment methods including gathering evidence, reviews of procedures, and access to offices and staff including non-technical staff.
For example:
If the operator has satellite operations in a number of locations around the world then the Commission would require the operator and auditor to determine during planning which locations are most critical to visit in order to assess the information security aspects for the Commission licensed activity.
Where it may not be appropriate to visit multiple locations, in certain areas remote based telephone calls and emails to gather information would suffice. A fully informed professional judgement would have to be made to ensure a suitably robust audit took place. Conducting an audit fully via remote means just by talking to staff and reviewing information by email would not be sufficient.
Operators must satisfy themselves of the information security adequacy in place with the third parties they use. Social responsibility code provision 1.1.2 outlines licensees’ responsibility for third parties. In addition to this code there are requirements that would be within the audit scope, specifically dealing with the management of third parties, namely the ISO/IEC 27001:2013 extract within the RTS: Standard – 15 Supplier Relationships.
The auditor, as part of planning for the audit and in conjunction with the operator, must establish if there are third parties and whether they should form part of the audit scope.
Important factors to consider here would include the functions the third party performs and whether they have access to information or systems critical to the licensees’ gambling provision. In some instances the auditor may be able to rely on other audit work conducted over the third party, providing the auditor is content with the adequacy and scope of that work.
A common example might be a third party data centre that hosts gambling servers. The auditor may rely on the fact that the data centre is ISO27001 certified or has been previously reviewed for the main area of their RTS responsibility, namely the physical security aspect.
Another example would be the use of B2Bs for part of the gambling provision. For example, managed online slots or a poker network. In this case, it is likely that the B2B is licensed as a remote gambling operator themselves and would therefore be subject to their own security audit. This fact alone does not absolve the B2C of their own responsibility in this area and we would expect the B2C to obtain assurance from the licensed B2B as outlined previously. For example, contractual terms, service level agreements and assurance statements such as ISAE 3402 Statements.
The audit report is to include the name and title of the people that were interviewed.
The Commission would expect the key stakeholders responsible for establishing the information security framework, and applying it to be interviewed, such as:
The audit report must include the policies, procedures and documents reviewed.
An example of some of the policies, procedures and documents that we would expect to be reviewed includes:
The operator may list different document names but this still must contain the applicable policy/procedure. The Commission may ask an operator for more information about this if it is unclear in the report.
The audit areas from which evidence is gathered includes:
The Commission would expect to receive an audit report using a standardised methodology of completing security audits. The following are some of the acceptable terms the Commission would expect to see in a security audit and an example of the layout of the report.
This example report uses the following definitions for the compliance assessments of each area evaluated.
The policy and evidence viewed was considered to be fully compliant with the BS ISO/IEC 27001:2013 guidelines.
A policy is in place but it is either not fully compliant with the BS ISO/IEC 27001:2013 guidelines or the supporting evidence (or lack thereof) raised potential concerns. This status does not signify a fail, but indicates that the process could be improved.
A control has not been addressed or is not compliant with BS ISO/IEC 27001:2013 guidelines. A course of action to remedy this should be provided with an appropriate time line.
A fundamental failing has been identified by the auditor that affects several controls and means that the overall Information Security Management policies cannot be adhered to. Until resolved, such an issue will normally mean the organisation is not compliant with ISO/IEC 27001:2013.
The Commission recognises that all the requirements listed in Section 4 of the RTS may not apply to certain operators. Sufficient evidence must be supplied within that audit report where any requirement was not applicable.
Audit reports which do not provide sufficient and clear evidence may not meet the Commission’s requirements and may be rejected.
Examples of content and style the Commission would expect to see.
Clearly defined findings assist the licensee’s management and the Commission in understanding the need for taking corrective action.
In general the format of a finding should be:
to ineffective disposal procedures resulting in confidential information being revealed to external parties.
will be added to our asset register recording details of the disposal method, certificate reference and date.