Platform security baseline for online gambling
A gambling platform's baseline is shaped by two forces: the security audits regulators require, many built on ISO/IEC 27001:2022, and the common web application weaknesses OWASP tracks. Meeting the audit is the floor; covering the OWASP Top 10:2025 in development and testing is what keeps the platform out of incident reports.
The OWASP Top 10:2025
| Category | Gambling platform focus |
|---|---|
| A01:2025 Broken Access Control | Players reaching other players' data; staff tools reachable by players; back-office roles. |
| A02:2025 Security Misconfiguration | Cloud storage, debug endpoints, default credentials, verbose errors. |
| A03:2025 Software Supply Chain Failures | Game provider SDKs, third-party scripts on payment pages, open-source libraries. |
| A04:2025 Cryptographic Failures | Personal and payment data in transit and at rest. |
| A05:2025 Injection | Search, filters, reporting tools. |
| A06:2025 Insecure Design | Promotions and wallets that can be abused by design. |
| A07:2025 Authentication Failures | Account takeover; see our guide. |
| A08:2025 Software or Data Integrity Failures | Unsigned updates, untrusted callbacks from game or payment providers. |
| A09:2025 Security Logging & Alerting Failures | Missing audit trails for balance changes and admin actions. |
| A10:2025 Mishandling of Exceptional Conditions | Errors during payouts or bet settlement leaving inconsistent state. |
What regulators' audits look for
In Great Britain, remote operators' annual security audit covers the RTS security requirements, which the Gambling Commission based on Annex A of ISO/IEC 27001:2022. Michigan requires a vulnerability assessment and penetration test of internal, external and wireless networks plus an ISO 27001 or similar policy review within 90 days of launch and every year; Pennsylvania's regulator requires application and network penetration tests and an ISMS audit. Ontario requires a recognized IT control framework and regular independent assessments. Details are on our security rules pages.
A practical baseline
- Govern: a named security owner, risk register and policy set; NIST CSF 2.0's Govern function is a useful structure.
- Basics: UK Cyber Essentials v3.3 covers firewalls, secure configuration, security update management, user access control and malware protection, and says "authentication to cloud services must always use MFA".
- Access: least privilege for staff, MFA on all admin and remote access, quarterly access reviews, and separation between player and back-office systems.
- Secure development: threat modeling for wallets and promotions, code review, dependency scanning, and testing against the OWASP Top 10 and the API Security Top 10.
- Logging: tamper-resistant logs of logins, balance changes, admin actions and configuration changes, with alerting.
- Resilience: tested backups, capacity for major sporting events, and DDoS protection.
- Testing: independent penetration tests at least annually and after major changes.
ISO/IEC 27001:2022
ISO/IEC 27001:2022 was published on 25 October 2022. Under the IAF transition rules, certificates to the 2013 edition were to be withdrawn when the transition ended on 31 October 2025. A certificate is not required by the UK Gambling Commission, but its audit controls come from this edition, so an existing ISMS maps well.
Questions about platform security
What is new in the OWASP Top 10 2025?
Software Supply Chain Failures is a new, broader category at A03, and Mishandling of Exceptional Conditions is new at A10. Security Misconfiguration moved up to second.
Is Cyber Essentials enough for a gambling operator?
It is a useful baseline for basic controls, but gambling regulators require more, such as the UK's annual security audit against ISO/IEC 27001:2022-based controls or US state penetration testing.
Sources
- OWASP, Top 10:2025
- NCSC, Cyber Essentials: Requirements for IT infrastructure v3.3 (April 2026)
- IEC webstore, ISO/IEC 27001:2022 publication record; IAF MD 26:2023
- Regulator requirements as cited on our security rules pages
- All sources checked 24 October 2026.