Third-party security and vendor risk in iGaming
A gambling operator depends on suppliers for games, payments, identity checks, odds, hosting and customer support, and many of them touch player data or money. OWASP's 2025 Top 10 now ranks software supply chain failures third. The NCSC's 12 supply chain principles give a practical structure for managing that risk.
Who the critical suppliers are
| Supplier type | What they touch | Key questions |
|---|---|---|
| Platform and wallet providers | Accounts, balances, transactions | Security testing, access controls, change management |
| Game providers and aggregators | Game sessions, win callbacks | API authentication, certification, callback integrity |
| Payment providers | Card and bank data, payouts | PCI DSS status, regulatory authorization, incident notification |
| Identity and KYC providers | Identity documents, biometrics | Data minimization, retention, location of processing |
| Hosting and cloud | Everything | Shared responsibility model, certifications, logging access |
| Support and marketing tools | Player contact data, sometimes account access | Least-privilege access, staff vetting |
The NCSC's 12 principles
The NCSC's principles of supply chain security (reviewed 22 October 2025) group 12 principles into four stages:
- Understand the risks: understand what needs to be protected and why; know who your suppliers are and what their security looks like; understand the security risk posed by your supply chain.
- Establish control: communicate your view of security risk to suppliers; set and communicate minimum security requirements; build security into contracting and require suppliers to do the same; meet your own responsibilities as a supplier and consumer; raise awareness in your supply chain; provide support for security incidents.
- Check your arrangements: build assurance activities into how you manage the supply chain.
- Continuous improvement: encourage continuous improvement of security within the supply chain; build trust with suppliers.
Assurance evidence
- Certifications: ISO/IEC 27001 certificates should be to the 2022 edition; the transition period for the 2013 edition ended on 31 October 2025. Check the certificate's scope covers the service you buy.
- Payment card security: for suppliers handling card data, ask for current PCI DSS attestation; see our payment security guide.
- Testing: recent independent penetration test summaries and how findings were fixed.
- Gambling-specific: some regulators require suppliers or their systems to be certified or audited; check our security rules pages.
Contract controls
- Minimum security requirements and the right to verify them.
- Incident notification within a defined time, with named contacts.
- Data location, retention and deletion at the end of the contract.
- Sub-processor approval and flow-down of the same requirements.
- Exit and continuity support if the supplier fails or the relationship ends.
A documented case: a vendor as the way in
In a September 2023 filing to the US Securities and Exchange Commission, Caesars Entertainment said suspicious activity resulted from "a social engineering attack on an outsourced IT support vendor used by the Company", and that a copy of its loyalty program database was taken. The filing said customer-facing operations, including its online and mobile gaming apps, were not affected. Caesars also filed breach notices with state attorneys general, including Maryland's. The case is a reminder that suppliers with privileged access, including IT support, belong in the scope of vendor risk, and that help-desk identity checks are a security control.
Ongoing monitoring
Review critical suppliers at least annually and after any incident or major change, keep an inventory of what each supplier can access, and remove access promptly when it is no longer needed. NIST's SP 800-161 Rev 1 gives a fuller supply chain risk management program for larger operators.
Questions about vendor risk
Is an ISO 27001:2013 certificate still valid?
No. Under the IAF transition rules, certificates to ISO/IEC 27001:2013 were to be withdrawn or terminated when the transition period ended on 31 October 2025. Ask for a certificate to the 2022 edition.
What are the NCSC supply chain principles?
Twelve principles in four stages: understand the risks, establish control, check your arrangements and continuous improvement. They range from knowing who your suppliers are to building security into contracts and supporting suppliers during incidents.
Sources
- NCSC, Principles of supply chain security (reviewed 22 October 2025) and NCSC/NPSA infographic
- NIST, SP 800-161 Rev 1, Update 1 (1 November 2024)
- OWASP, Top 10:2025 (A03)
- IAF MD 26:2023, transition requirements for ISO/IEC 27001:2022
- Caesars Entertainment, Form 8-K (14 September 2023); notice to the Maryland Attorney General (6 October 2023)
- All sources checked 24 October 2026.