Board advances cyber‑incident reporting changes and SB 203 racing reforms after industry comment

The Nevada Gaming Control Board on Dec. 4 voted to forward two major regulatory packages to the Nevada Gaming Commission: proposed amendments to NGC regulation 5.26 (cybersecurity incident reporting) and a set of amendments to implement Senate Bill 203 that repeal or revise long‑standing rules on race broadcast disseminators and pari‑mutuel system operators.

Cyber‑incident reporting (NGC 5.26): Senior Deputy Attorney General Ed McGaugh summarized the proposed changes: add definitions for board and chair, change the initial notice requirement from a written form to a notification and shorten the immediate notification window from 72 to 24 hours; require a written initial cyber incident response report within five days of awareness or allow an in‑person meeting with the chair within five days (if an in‑person meeting is chosen the written report must follow within 30 days); require written updates every 30 days until resolution; and allow the chair to waive or modify timing requirements.

Industry testimony and compromise: Virginia Valentine of the Nevada Resort Association, and cybersecurity officers from major operators, asked for clarification and operational flexibility. Property cyber staff said initial vendor forensics often take up to 48 hours; several witnesses recommended that the 24‑hour notification should be measured from when the licensee determines a material cyber incident has occurred — not from the first indication of anomalous activity. Chief of the Enforcement Division said the board's intent was a brief phone call to the chair once a covered entity has determined a material incident; the board and staff agreed to revise draft language to require notification "within 24 hours of the covered entity's determination that a material cyber incident has occurred," permit a phone call as the initial notification and retain the five‑day initial report and 30‑day updates. The board voted to forward the draft, incorporating those on‑record changes, to the Nevada Gaming Commission for consideration and adoption.

SB 203 and race broadcasting: Chief Rusty LeBlanc and AG staff presented a separate, larger package of amendments to multiple regulations (NGC regs 5, 20, 21, 22, 26a/26b/26c) to implement SB 203. The bill repealed licensing requirements for disseminators and replaced certain system‑operator and pari‑mutuel operator licensing with a service‑provider registration model. Staff explained the historical purpose of disseminators, why technology has overtaken the old rules and why the draft shifts compliance responsibility to race books and tracks while retaining encryption and security provisions to protect wagering integrity.

Industry reaction: Representatives of the pari‑mutuel and simulcast community, including Mark Rubinstein and off‑track wagering stakeholders, generally supported the draft as implementing legislative intent. Nevada Disseminator Service's Todd Roberts, a long‑time licensee, said the legislative change effectively removed longstanding disseminator licenses and raised transition‑cost concerns for legacy businesses: "You get legislated out of business overnight," he said, and asked for administrative steps to ease the transition. Staff said the draft represents a compromise to preserve wagering integrity while lowering barriers for new system operators and that further refinements can be proposed after initial adoption.

Board action and next steps: The board voted to submit both the cyber‑reporting amendments and the SB 203 implementation package to the Nevada Gaming Commission for consideration and adoption; staff will prepare revised drafts incorporating on‑record clarifications for the Commission and post them for public comment.