Requires adoption and implementation of cybersecurity standards by casinos and sportsbooks; establishes safe gaming certification program.
A1550, the “Gaming Industry Cybersecurity Act,” requires New Jersey casino licensees, sports wagering licensees, and their contracted operators to adopt and maintain cybersecurity programs that substantially comply with recognized standards, specifically the latest NIST cybersecurity framework or the ISO/IEC 27000 family of information security standards. Covered entities must implement these programs within 180 days of enactment, train employees on cybersecurity practices, and update their programs when the underlying standards are revised.
The bill also requires annual independent cybersecurity audits at the licensees’ expense, with findings submitted to the Division of Gaming Enforcement and the New Jersey Cybersecurity and Communications Integration Cell. It directs the division to adopt regulations covering employee training, audit scope, breach reporting, and response procedures, including a requirement to report certain cybersecurity breaches within 72 hours. In addition, the bill creates a safe gaming certification program under which entities that exceed minimum standards may receive a “Safe Gaming Seal” for use on websites, mobile apps, and advertisements.
The bill would add new cybersecurity compliance obligations to the State’s gaming regulatory framework under Title 5, chapters 12 and 12A, affecting casinos, sportsbooks, and their contracted operators, including internet gaming affiliates and casino service industry enterprises. It authorizes the Division of Gaming Enforcement to promulgate implementing rules, receive audit reports and breach notifications, investigate compliance, impose civil penalties, and suspend licenses or permits for repeated violations or nonpayment of fines. It also creates a public certification list and requires annual reporting on implementation and emerging threats.
The bill’s structure suggests a generally supportive posture toward stronger cybersecurity and responsible gaming oversight in the gaming industry. Although no committee transcript or vote record is provided, the proposal is framed as a consumer-protection and industry-integrity measure, with emphasis on modern security standards, breach reporting, and public certification. The inclusion of a voluntary-seeming “Safe Gaming Seal” indicates an effort to pair regulation with a positive market incentive for higher-performing operators.
The main points of potential contention are the cost and operational burden on casinos, sportsbooks, and their contractors, since the bill requires them to fund annual third-party audits, employee training, program updates, and compliance with evolving standards. Operators may also object to the breadth of the covered entities, the 72-hour breach reporting requirement, and the division’s authority to investigate, revoke certification, or suspend licenses. Another possible issue is the bill’s inclusion of artificial intelligence and blockchain security features in the certification standards, which may raise questions about feasibility, specificity, and whether those technologies should be mandated or merely encouraged.