United States: online gambling security requirements by state
The US states we reviewed that license online gambling require operators to commission independent security assessments. New Jersey requires one every year, Michigan within 90 days of launch and yearly after, including penetration tests, and Pennsylvania sets a similar scope. Nevada, where the annual review applies to Group I licensees, goes furthest on incidents, requiring notice to the regulator within 24 hours.
State requirements compared
| State | Assessment | Scope | Incident notice to regulator |
|---|---|---|---|
| New Jersey | Annual, independent professional approved by the Division | System integrity and security; ISO 27001 and penetration testing not named | No security-incident duty found in 13:69O-1.2 |
| Pennsylvania | Within 90 days of launch, then annual; third-party firm subject to Board approval | Application, internal and external penetration tests; ISMS audit (GLI-33 B, GLI-19 B or other framework) | Not found in the sources reviewed |
| Michigan | Within 90 days of launch, then annual; independent professional approved by the Board | Vulnerability assessment and penetration test of internal, external and wireless networks; ISO 27001 or similar policy review | Not found in R 432.638 |
| Nevada | Annual independent review for Group I licensees | Best practices such as CIS v8, COBIT 5, ISO/IEC 27001, NIST SP 800-53 | Within 24 hours; report within 5 calendar days |
New Jersey
N.J.A.C. 13:69O-1.2(q) says: "Each casino licensee offering Internet gaming shall perform an annual system integrity and security assessment conducted by an independent professional selected by the licensee, subject to the approval of the Division." The report goes to the Division annually and must include the scope, the assessors, the date, findings, recommended corrective action and the licensee's response. The text does not name ISO 27001, penetration testing or vulnerability assessment, and we did not find a duty in this section to notify the Division of a cyber incident.
Pennsylvania
A Pennsylvania Gaming Control Board letter of 25 October 2021, citing 58 Pa. Code § 809a.6(d), says the annual security audit must be "performed by an independent third-party cyber security company selected by the operator, subject to Board approval", within 90 days of commencing operations, and must include application penetration tests (mobile and web), internal and external vulnerability assessments and penetration tests, and an information security management system audit. We could not read the regulation text itself on an official site.
Michigan
Mich. Admin. Code R 432.638, effective 2 December 2020, requires an internet gaming platform integrity and security assessment "within 90 days after commencing operations, and annually thereafter", by an independent professional subject to Board approval. The scope includes "A vulnerability assessment of internal, external, and wireless networks", "A penetration test of all internal, external, and wireless networks", and "A policy and procedures review against the current ISO 27001 standard or another similar standard approved by the board." The full report goes to the Board.
Nevada: cyber incident notice
Nevada Gaming Commission Regulation 5.260, amended effective 29 January 2026, covers holders of licenses that permit interactive gaming among others. Covered entities must "Notify the Chair of the cybersecurity incident as soon as practicable but no later than 24 hours" after activating their incident response plan (the earlier 72-hour deadline was struck out) and file an "Initial Cybersecurity Incident Response report within 5 calendar days". It cites "CIS Version 8, COBIT 5, ISO/IEC 27001, and NIST SP 800-53" as examples of best practice, with compliance required within 90 days of licensing.
Other duties
State data breach notification laws apply alongside gaming rules; see our breach notification comparison. Card data handling is governed by PCI DSS through card brand contracts; see our PCI DSS page. We have not surveyed every state with legal online gambling.
Questions about US gambling security rules
Do US online casinos need penetration testing?
In Michigan, yes: R 432.638 requires a penetration test of internal, external and wireless networks within 90 days of launch and annually. Pennsylvania's regulator also requires penetration tests in its annual audit. New Jersey's rule requires an annual security assessment without naming penetration testing.
Which state requires gambling operators to report cyber incidents fastest?
Of the states we reviewed, Nevada: Regulation 5.260 requires notice to the Board Chair within 24 hours after activating the incident response plan, since January 2026.
Sources
- N.J.A.C. 13:69O-1.2 (via Justia; cross-checked with the DGE's consolidated PDF)
- PGCB, Correspondence re Interactive Gaming System Security Audit (25 October 2021)
- Mich. Admin. Code R 432.638 (via Cornell LII)
- Nevada Gaming Commission Regulation 5.260 (adopted and effective 29 January 2026)
- All sources checked 24 October 2026.