GLI-33 crosswalk to adjacent standards + state-specific technical standards. PCI DSS (Payment Card Industry Data Security Standard) v4.0 - applies to card-not-present payments in event wagering systems; required for any operator handling cards directly; tokenization + scope-reduction common. NIST CSF 2.0 - voluntary cybersecurity framework + commonly used by US-based operators for governance + identify + protect + detect + respond + recover; coordinates with GLI-27 (Standards for Network Security) which is more prescriptive. ISO/IEC 27001:2022 (Information Security Management System) - commonly certified by larger operators alongside GLI-33 certification; auditors may map GLI-27 + GLI-33 controls to ISO 27001 Annex A controls + ISO 27002 implementation guidance. ISO/IEC 27017 (Cloud Security) + 27018 (Privacy in Cloud) + 27701 (Privacy Information Management) - applicable to cloud-hosted operators. SOC 2 Type II - typical service-organization attestation; common for B2B operators + suppliers. STATE TECHNICAL STANDARDS: each state typically adopts GLI standards by reference + adds state-specific addenda (e.g. NEW JERSEY DGE - 'NJ Internet Gaming Technical Standards' + 'NJ Sports Wagering Technical Standards' + 'Mobile Wagering Technical Standards' + 'Geolocation Provisional Standards'; PENNSYLVANIA PGCB - 'PGCB Sports Wagering Technical Standards' + 'Interactive Gaming Technical Standards'; MICHIGAN MGCB - Internet Gaming Standards; NEVADA GCB - Regulation 5 + 6 + 5A; INDIANA IGC - Sports Wagering Rules); STATE PRIVACY + DATA PROTECTION - state DP laws (CCPA + Florida FDBR + CTDPA + others) apply with operator-CPNI + minor protections; ANTI-MONEY-LAUNDERING - Bank Secrecy Act + FinCEN MSB rules + state AML for gaming. INTEGRITY MONITORING ASSOCIATIONS: IBIA (International Betting Integrity Association) + GLMS (Global Lottery Monitoring System) + SBIA (Sports Betting Integrity Alliance) + state-specific.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.