A5822

An Act requiring the adoption of cybersecurity programs by casinos and sportsbooks operating in this State and supplementing Title 5 of the Revised Statutes.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. This act shall be known and may be cited as the “Gaming Industry Cybersecurity Act.”

2. As used in this act, P.L. , c. (C. ) (pending before the Legislature as this bill):

“Contracted operator” means an Internet gaming affiliate, casino service industry enterprise, and any other person or entity contracted by a casino licensee or sports wagering licensee to perform gaming-related services.

“Cybersecurity” means the practice of protecting networks, devices, and data from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and availability of information.

“Cybersecurity and Communications Integration Cell” means the New Jersey Cybersecurity and Communications Integration Cell established pursuant to Executive Order No. 178 (2015) in the New Jersey Office of Homeland Security and Preparedness, or any successor entity.

“Division” means the Division of Gaming Enforcement in the Department of Law and Public Safety.

3. a. (1) Within 180 days of the effective date of P.L. , c. (C. ) (pending before the Legislature as this bill), all casino licensees and sports wagering licensees, and their contracted operators, licensed and operating in this State under chapters 12 and 12A of Title 5 of the Revised Statutes, shall establish and implement a cybersecurity program that substantially complies with the most recent cybersecurity framework developed by the National Institute of Standards and Technology or the 27000 family of standards for an information security management system jointly published by the International Organization for Standardization and International Electrotechnical Commission.

(2) Each casino licensee, sports wagering licensee, or contracted operator, shall establish an employee training program to familiarize their employees with the cybersecurity program and industry best practices.

b. In every calendar year following the implementation of a cybersecurity program in accordance with subsection a. of this section, all casino licensees and sports wagering licensees shall, at their own expense, arrange for the conduct of an audit of their cybersecurity program, and that of their contracted operators, by an independent third party of sufficient technical expertise. The audit shall ensure the cybersecurity program that has been implemented complies with applicable regulations and current industry best practices. The auditor shall certify the findings of the audit, which shall be submitted to the division and the Cybersecurity and Communications Integration Cell by a date to be determined by the division.

c. Whenever a final revision to one or more of the frameworks listed in subsection a. of this section is published, a casino licensee, sports wagering licensee, or contracted operator whose cybersecurity program substantially complied with that framework shall revise their cybersecurity program to substantially comply with the revised framework, and submit a copy of the revised cybersecurity program to the division and the Cybersecurity and Communications Integration Cell, no later than 180 days after publication of the revised framework.

d. The division, in consultation with the Cybersecurity and Communications Integration Cell and pursuant to the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.), shall promulgate rules and regulations necessary for the implementation of this act. At a minimum, such rules and regulations shall:

(1) identify classes of employees that will require cybersecurity training or advanced training;

(2) determine the frequency and methods of certification for employee cybersecurity trainings;

(3) identify specific aspects of the cybersecurity program that should be assessed in the course of required audits;

(4) establish the necessary forms for submitting audits and certifications, as required by this section;

(5) require the reporting of any cybersecurity breach that affects the operations of a licensee, compromises the personal data of patrons, or exposes financial systems information within 72 hours of said breach; and

(6) establish procedures for reporting cybersecurity breaches and protocols for response.

Such rules and regulations may be supplemented and updated as necessary to reflect new cybersecurity standards, and to address new threats to cybersecurity in New Jersey’s gaming industry.

4. In addition to any fines or penalties otherwise available under State or federal law, a casino licensee, sports wagering licensee, or contracted operator who violates the provisions of section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill), or any rule or regulation promulgated thereunder, shall be liable to a fine of $10,000 for the first offense and $20,000 for the second and subsequent offenses. If the violation is of a continuing nature, each day during which it continues shall constitute an additional, separate, and distinct offense. The division may collect such fines in a summary proceeding pursuant to the "Penalty Enforcement Law of 1999," P.L.1999, c.274 (C.2A:58-10 et seq.).

If a casino licensee, sports wagering licensee, or contracted operator repeatedly violates the provisions of section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill), or fails to pay fines pursuant to this section, the division may suspend any permit or license to conduct gaming activities or perform related services for which the division is responsible for issuance or renewal.

5. a. Within one year of the effective date of P.L. , c. (C. ) (pending before the Legislature as this bill), the division, in consultation with the Cybersecurity and Communications Integration Cell and experts in cybersecurity and responsible gaming, shall establish a safe gaming certification program. Casino licensees, sports wagering licensees, and their contracted operators that meet or exceed the program’s minimum standards shall be certified and shall receive a “Safe Gaming Seal” which may be prominently displayed on their Internet websites, mobile gaming applications, and advertisements in this State.

b. The minimum standards for the safe gaming certification program shall include:

(1) the use of enhanced encryption and fraud detection systems;

(2) transparency measures;

(3) performance of independent audits exceeding those required by law;

(4) adoption of appropriate artificial intelligence and blockchain security features; and

(5) readily accessible responsible gaming tools such as deposit and time limits.

c. Casino licensees, sports wagering licensees, and contracted operators may apply for certification no more than once during any three-year certification period, unless otherwise permitted by the division. Once approved, the certification shall remain valid for a period of three years, unless revoked for noncompliance, breach, or failure to maintain applicable cybersecurity or responsible gaming standards. The division shall establish the necessary forms, procedures, and timelines to oversee the issuance and renewal of the safe gaming certification.

d. The division shall have the authority to investigate and audit any certified casino licensee, sports wagering licensee, or contracted operator upon suspicion of noncompliance, and to hire or contract with cybersecurity experts as may be necessary to perform such investigations and audits, and may revoke the certification upon a finding that the minimum standards established pursuant to this section have not been met.

e. The division shall maintain a list of all certified casino licensees, sports wagering licensees, and contracted operators, and shall publish this list on its official Internet website.

6. The division and the Cybersecurity and Communications Integration Cell, shall prepare an annual report summarizing the progress made towards implementation of this act, P.L. , c. (C. ) (pending before the Legislature as this bill), and identifying emerging threats in the gaming industry. This report shall be published online, and shall be submitted to the Legislature pursuant to section 2 of P.L.1991, c.164 (C.52:14-19.1).

7. This act shall take effect immediately.

STATEMENT

This bill establishes the “Gaming Industry Cybersecurity Act.”

The bill requires that every casino licensee and sports wagering licensees, and their contracted operators, adopts and implements a cybersecurity program that substantially complies with current best practices. As best practices evolve, these cybersecurity programs will be required to be updated. Employees will be required to undergo cybersecurity training as well.

The bill also requires all casino licensees and sports wagering licensee, at their own expense, to arrange for the conduct of an audit of their cybersecurity program and that of their contracted operators, by an independent third party of sufficient technical expertise. The auditor will certify the findings of the audit and submit them to the Division of Gaming Enforcement and the New Jersey Cybersecurity and Communications Integration Cell by a date to be determined by the division in each year following the adoption of a cybersecurity program.

To implement the requirements of this bill, the division, in consultation with the Cybersecurity and Communications Integration Cell, will establish regulations that:

(1) identify classes of employees that will require cybersecurity training or advanced training;

(2) determine the frequency and methods of certification for employee cybersecurity trainings;

(3) identify specific aspects of the cybersecurity program that should be assessed in the course of required audits;

(4) establish the necessary forms for submitted audits and certifications, as required by this section;

(6) establish procedures for reporting cybersecurity breaches and protocols for response.

The bill provides that licensees and their contracted operators that fail to meet the new cybersecurity requirements will be liable to a fine of $10,000 for the first offense, and $20,000 for the second and each subsequent offense. Continued violations, or a failure to pay fines, may result in the suspension of licenses to conduct gaming activities or perform related services.

The bill also establishes a safe gaming certification program for licensees and contracted operators that exceed minimum standards in cybersecurity. The minimum standards will include:

(1) the use of enhanced encryption and fraud detection systems;

(2) transparency measures;

(3) performance of independent audits exceeding those required by law;

(4) adoption of appropriate artificial intelligence and blockchain security features; and

(5) readily accessible responsible gaming tools such as deposit and time limits.

If these standards are met, the licensee and contracted operator will be awarded a “Safe Gaming Seal” which may be displayed prominently on their Internet gaming website, mobile applications, and in advertisements.

Finally, the bill requires the division and the Cybersecurity and Communications Integration Cell to complete an annual report assessing the implementation of cybersecurity programs under the bill and identifying emerging threats in the gaming industry.