How we research security requirements

Every requirement and recommendation on iGamingThreatLens traces back to a document published by the body that wrote it. This page explains which sources we use, how we track versions and what we will not publish.

Which sources count

1. The rule itself: gambling license conditions, technical standards, statutes and regulations, read on the regulator's or legislature's site.
2. Official frameworks: OWASP project pages, NIST publications, NCSC, CISA and ENISA guidance, ISO and PCI Security Standards Council pages.
3. Official records for any incident we mention: regulator decisions, court records, government agency releases or a company's own regulatory filing.
4. Trade press and vendor reports only to find primary documents. Anything we can only find there is labeled secondary.

Versions and dates

Security guidance changes by version. We name the version and publication date of every framework we cite, record whether a rule is law, a license condition, a technical standard or guidance, and give its effective date. Rules pages are reviewed at least every three months; guides at least every six months, or sooner when a framework is revised.

What we do not publish

• Invented incidents, attack volumes, threat statistics or "live" alerts.
• Exploit code, attack tooling or step-by-step offensive techniques.
• Claims that any product, vendor or operator is compliant, certified or secure.
• Legal or audit advice. Requirements depend on the license and facts; take qualified advice.

Use of AI tools

We use AI tools to help find sources, draft summaries and check consistency. Nothing is published until each fact has been checked against its source. Diagrams are drawn by us and show general concepts, not any organization's systems.