The Nevada Gaming Control Board on Dec. 4 voted to forward revised amendments to NGC Regulation 5.26 — governing licensee reporting of cyber incidents — to the Nevada Gaming Commission after extended testimony from industry cybersecurity officers and operators.

Senior Deputy Attorney General Ed McGaugh summarized the substantive changes: definitions for board and chair, a change from a required written notice within 72 hours to a short notification (phone/email) within 24 hours, a new requirement for an initial cyber incident response report within five days (with an option to meet in-person with the chair within five days and submit the written report within 30 days), and 30-day written updates until the incident is fully resolved. The draft also gives the chair authority to waive or modify requirements in specific cases.

Industry speakers, including the Nevada Resort Association and property security officers, urged refinement of the 24-hour window because forensic analysis and vendor response may take longer. Eric Hansen, information security officer for Affinity Gaming, said some incident determinations require forensic work that often takes more than 24 hours; he recommended that the 24-hour clock start from the licensee’s determination that a material incident has occurred. Chief Torgerson (Enforcement) and the board agreed: the board asked staff to amend subsection 4(a) to require notification to the chair "as soon as practical, but no later than 24 hours after the covered entity determines a material cyber incident has occurred." Chief Torgerson described the initial notification as a short courtesy call to the chair so the board can avoid learning of incidents from third parties or the media.

The board also agreed to standardize terminology (use "cyber incident") and to clarify that the regulation applies to covered entities that operate in Nevada (i.e., incidents affecting Nevada operations). Board members said they will continue to work with stakeholders to produce final draft language before the Commission meeting.

Judge Saad moved to submit the draft (dated 11/06/2025) incorporating the changes discussed on the record; the motion passed with unanimous aye votes from the members present.

What’s next: Staff will revise the draft to reflect the record discussion (24-hour window tied to licensee determination, language standardization, chair/designee clarification) and the revised draft will be filed with the Nevada Gaming Commission for consideration and public comment.