Section 68IAC25-5-6. Internal controls

   The casino licensee must submit internal controls for the following:

(1) Access privileges to the LMGS that includes, but is not limited to the following:

(A) Access to a component of the LMGS shall be configured to prevent the transfer of personally identifiable information outside of the casino.

(B) Access shall be continuously monitored by the casino licensee.

(2) Subsequent to an authorized use by a licensed supplier, the account shall be returned to a disabled state on all operating systems, databases, network devices, and applications until needed by such licensed supplier and approved by the executive director or the executive director's designee.

(3) Remote access to the LMGS and its components for purposes of licensed supplier support must include the following:

(A) The method and procedures used to gain access remotely, including the use of passwords and other logical controls, and commission staff observation.

(B) The procedures to be used by the IT department to further control and monitor access and to ensure that licensed suppliers have only the limited access needed to perform authorized support and update functions.

(Indiana Gaming Commission; 68 IAC 25-5-6; filed Jan 7, 2016, 8:21 a.m.: 20160203-IR-068150084FRA)