A sports wagering licensee shall: Implement, maintain, regularly review and revise, and comply with a comprehensive information security system that reasonably protects the confidentiality, integrity, and availability of a bettor’s personally identifiable information; and Ensure that the security system set forth in §A(1) of this regulation includes administrative, technical, and physical safeguards which: Are appropriate to the size, complexity, nature, and scope of the operations; and Protect the personal information owned, licensed, maintained, handled, or otherwise in the possession of the sports wagering licensee. A sports wagering licensee shall: Within 90 days of commencing operations, and annually thereafter, conduct a vulnerability assessment, penetration testing, and operational security control review against ISO 27001 standard, or other similar standards such as CIS or NIST CSF; Perform vulnerability assessments and penetration testing of the sports wagering platform at multiple layers, including: Internal and external network; Mobile and web application; Database; Firewall; If applicable, wireless; and Any additional security testing that the Commission requires; Ensure that a Commission approved third party described in Regulation .02B of this chapter conducts the testing required in §B(1) and (2) of this regulation; Ensure that the annual reporting requirement required in §B(1)—(3) of this regulation is submitted to the Commission no later than 120 days after the end of the licensee’s fiscal year; Perform internal quarterly vulnerability scans; and Submit to the Commission documentation of the scan results and the actions taken to resolve identified vulnerabilities. A sports wagering licensee shall submit to the Commission the assessment report issued by the third party and the licensee’s report. The combined reports in §C of this regulation shall: Provide details for all vulnerabilities identified; Assess the adequacy and effectiveness of the sports wagering licensee’s information technology security controls and system configurations; and Provide recommendations for eliminating each material weakness or significant deficiency identified. A sports wagering licensee shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and: Remediate the vulnerability no later than 90 days following the earlier of vulnerability’s identification or public disclosure; or Document why remediation action is unnecessary or unsuitable.