Section 68IAC25-4-3. Reporting requirements related to system security

   (a) On a weekly basis, daily system event logs shall be reviewed by internal audit personnel. System event logs shall be maintained for a minimum of seven (7) days following the review.

  (b) The review shall provide reasonable assurance of the following:

(1) Users are only performing activities that have been explicitly authorized.

(2) Possible threats facing the LMGS are being assessed.

  (c) Evidence of the review of system event logs is to be maintained for one (1) year. The evidence is to include at a minimum the following:

(1) Date and time of review.

(2) Name and title of person performing the review.

(3) The system event log reviewed.

(4) Any exceptions, follow-up, and resolution of exceptions.

(Indiana Gaming Commission; 68 IAC 25-4-3; filed Jan 7, 2016, 8:21 a.m.: 20160203-IR-068150084FRA)