# COMAR Title 36 — Maryland State Lottery and Gaming Control Agency

## Subtitle 10 — Sports Wagering Provisions

### Chapter 18 — Sports Wagering Technical Standards

#### Regulation .06 Information Security.

*COMAR 36.10.18.06*

A. A sports wagering licensee shall:

  (1) Implement, maintain, regularly review and revise, and comply with a comprehensive information security system that reasonably protects the confidentiality, integrity, and availability of a bettor’s personally identifiable information; and

  (2) Ensure that the security system set forth in §A(1) of this regulation includes administrative, technical, and physical safeguards which:

    (a) Are appropriate to the size, complexity, nature, and scope of the operations; and

    (b) Protect the personal information owned, licensed, maintained, handled, or otherwise in the possession of the sports wagering licensee.

B. A sports wagering licensee shall:

  (1) Within 90 days of commencing operations, and annually thereafter, conduct a vulnerability assessment, penetration testing, and operational security control review against ISO 27001 standard, or other similar standards such as CIS or NIST CSF;

  (2) Perform vulnerability assessments and penetration testing of the sports wagering platform at multiple layers, including:

    (a) Internal and external network;

    (b) Mobile and web application;

    (c) Database;

    (d) Firewall;

    (e) If applicable, wireless; and

    (f) Any additional security testing that the Commission requires;

  (3) Ensure that a Commission approved third party described in Regulation .02B of this chapter conducts the testing required in §B(1) and (2) of this regulation;

  (4) Ensure that the annual reporting requirement required in §B(1)—(3) of this regulation is submitted to the Commission no later than 120 days after the end of the licensee’s fiscal year;

  (5) Perform internal quarterly vulnerability scans; and

  (6) Submit to the Commission documentation of the scan results and the actions taken to resolve identified vulnerabilities.

C. A sports wagering licensee shall submit to the Commission the assessment report issued by the third party and the licensee’s report.

D. The combined reports in §C of this regulation shall:

  (1) Provide details for all vulnerabilities identified;

  (2) Assess the adequacy and effectiveness of the sports wagering licensee’s information technology security controls and system configurations; and

  (3) Provide recommendations for eliminating each material weakness or significant deficiency identified.

E. A sports wagering licensee shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and:

  (1) Remediate the vulnerability no later than 90 days following the earlier of vulnerability’s identification or public disclosure; or

  (2) Document why remediation action is unnecessary or unsuitable.