11VAC5-90-200: Information security system

A facility operator shall implement, maintain, regularly review and revise, and comply with a comprehensive information security system, the purpose of which (i) shall be to take reasonable steps to protect the confidentiality, integrity, and availability of personal information of individuals who place a wager with the facility operator and (ii) shall contain administrative, technical, and physical safeguards appropriate to the size, complexity, nature, and scope of the operations and the sensitivity of the personal information owned, licensed, maintained, handled, or otherwise in the possession of the facility operator.