Nevada Gaming Control Board Cybersecurity Requirements 5.260(3): 5.260(3) Initial risk assessment, cybersecurity best practices and ongoing monitoring, within 90 days of licensing

A covered entity must perform an initial risk assessment of its business operation and develop the cybersecurity best practices it deems appropriate, then monitor and evaluate cybersecurity risks to the operation on an ongoing basis and modify its best practices and risk assessments as it deems appropriate. The assessment and the ongoing monitoring may be performed by an affiliate or a third party with cybersecurity expertise. The regulation names CIS Version 8, COBIT 5, ISO/IEC 27001 and NIST SP 800-53 or later versions as examples of best practices, and points to the NIST Cybersecurity Framework (version 1.1 or later) for guidance on risk assessment. Since the July 2024 amendment a covered entity must fully comply within 90 days of being licensed (the original deadline for existing licensees was 31 December 2023).