Meet NGC Reg 5.260 cybersecurity duties with evidence ready to show

Nevada Gaming Regulation 5.260 is the cybersecurity section of Nevada Gaming Commission Regulation 5. It requires covered gaming operators to protect their information systems and patron and employee personal information by performing a risk assessment, adopting cybersecurity best practices, reporting material cybersecurity incidents to the Nevada Gaming Control Board, documenting compliance and keeping records for at least five years.

Covered entities must comply. These are holders of a nonrestricted gaming licence that operate or expose games for play, and holders of licences allowing a race book, a sports pool or interactive gaming. Group I licensees, as defined in Regulation 6.010, have additional duties, including a designated cybersecurity lead and annual independent review and attestation.

Since the amendments adopted on 29 January 2026, a covered entity must notify the Board Chair as soon as practicable and no later than 24 hours after activating its incident response procedures. It must submit an Initial Cybersecurity Incident Response report within 5 calendar days, then give written updates every 30 days until the incident is resolved, and complete an investigation report covering root cause.

Regulation 5.260 does not mandate one framework. Each covered entity develops the cybersecurity best practices it deems appropriate after a risk assessment. The regulation gives CIS Version 8, COBIT 5, ISO/IEC 27001 and NIST SP 800-53 as examples, and points to the NIST Cybersecurity Framework for risk assessment guidance, so many operators build on ISO 27001 or NIST.

Failure to exercise proper due diligence in complying with Regulation 5.260 is treated as an unsuitable method of operation and may result in disciplinary action by Nevada gaming regulators. The regulation itself does not set a fixed fine; consequences are handled through the state's gaming disciplinary process, which can affect a licensee's standing.

Group I licensees must, at least annually, have their internal auditor or another independent cybersecurity expert verify through observations, examinations and employee inquiries that best practices are being followed. They must also engage an independent accountant or other independent expert each year to review the practices and attest in writing that they comply with the regulation.

ISO/IEC 27001 is named in Regulation 5.260 as an example of acceptable cybersecurity best practices. An organisation already running an ISO 27001 information security management system will have much of the risk assessment, control and documentation work in place, but must still meet Nevada-specific duties such as Board incident reporting deadlines, Group I attestation and five year record retention.

Yes, on request. Nevada Gaming Regulation 5.260 is mapped in OneClickComply's control library and available on request rather than live as a standard framework. OneClickComply can map its requirements to controls you already operate for frameworks such as ISO 27001, collect evidence automatically and support your internal audit and attestation preparation. It does not issue attestations itself.