Call us now:
This is an important read for those following the MGM (and Caesars) cyber attacks in 2023, and possible State and Federal Regulatory Oversight. Last week MGM submitted its 2023 10K, that discussed the companies cybersecurity risk management oversight and assurance. Highlighting the potential for oversight from State and Federal Regulators. (https://lnkd.in/eGJXdNCi).
It is important to note that the Nevada Gaming Commission (NGC) introduced cybersecurity risk management regulation in 2023. Requiring covered entities, including MGM, to comply with a broad suite of cybersecurity risk management requirements by the 31st December 2023. That one assumes covered entities would have had made progress towards implementing, by September 2023.
Requirements including
1. Conducting a risk assessment of business operations.
2. Developing cyber best practices deemed appropriate.
3. On an ongoing basis monitor and evaluate cybersecurity risks and modify cyber best practices and risk assessments.
4. Notify the NGC Board within 72 hours of a cyber attack.
For Group I licensees (one assumes this would include MGM)
5. Designating a qualified individual responsible for developing implementing and overseeing enforcement of cyber best practice.
6. Undertaking an annual internal audit of compliance to cyber best practices.
7. Undertaking an annual audit by an independent accountant to review compliance to cyber best practices.
One wonders if MGM will be under the scrutiny of state regulators including the Nevada Gaming Commission (NGC)? Whose expectations are for covered entities to comply to cybersecurity risk management regulations by the 31st of December 2023?
@Thaddeus Dziekanowski Brian D. McCarthy
Veritas GRC
#cybersecurity #cyberriskmanagement #mgm #cyberattack
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7167787437845397504