UKGC Security Audit: How to Prepare

What the UKGC security audit is

The UK Gambling Commission (UKGC) asks remote operators covered by its security rules to have a yearly audit of their critical systems. The audit checks you against the security rules in the Remote Gambling and Software Technical Standards (RTS). These rules are based on ISO/IEC 27001, the best-known global standard for keeping data safe. The UKGC's guidance says the first audit is due within six months of the license being granted.

The audit must be done by a suitably qualified, independent auditor. The rules do change, so always check the Commission's current security audit advice for the latest version.

Which systems are in scope

The RTS rules focus on your most important systems, called critical systems. These are the systems that hold customer accounts, money, bets and game results, plus the data in them. In practice that usually means:

• Player accounts and the wallet (where player balances are held)
• Money paid in and out
• Game and betting platforms, including the RNG (the random number generator that decides results) and odds feeds
• Back-office and admin tools that can change balances, bets or limits
• The servers, networks and suppliers these systems depend on

What auditors look for

The RTS follow ISO 27001 closely, so expect questions in these areas:

• Your security policy and who owns it
• Access control: least privilege (only the access each person needs), MFA, staff who join and leave, admin accounts
• Logging (records of who did what) and monitoring of critical systems
• Finding security flaws and patching (installing updates that fix them)
• How you control changes and build software safely
• How you check the security of suppliers, such as platform and game providers
• How you deal with attacks and keep running during an outage
• Physical security of the places your systems are hosted

Is a penetration test required?

The UKGC does not list a penetration test (a hired expert tries to break in, with permission) as a separate rule. But a recent pentest report is some of the best proof that you find and fix flaws and build safely. Auditors often ask to see it. We recommend testing your player site, APIs (the connections apps use to talk to your systems) and back office before the audit. That way, serious findings are fixed by the time the auditor arrives.

A practical preparation checklist

1. List your critical systems and the suppliers behind them.
2. Check for gaps against the RTS security rules.
3. Fix the high-risk gaps first: admin access, MFA (a second login step, such as a code on your phone), logging and patching.
4. Write or update the policies the auditor will ask for.
5. Run a penetration test and fix the serious findings.
6. Collect evidence in one place: screenshots, settings, tickets and logs.
7. Do a practice audit with the people who will be interviewed.

Start at least two to three months before the audit date. In our experience, most failed or qualified audits (passed with reservations) come from missing evidence, not missing controls.

How NextGarrison helps

We help operators, sportsbooks and game providers get ready for the UKGC security audit. That covers a gap check, help fixing issues, policies, penetration testing and evidence packs. We also help with Malta Gaming Authority (MGA) rules and with getting ready for GLI-19 and GLI-33 lab testing. See our iGaming security services.