NGC Regulation 5

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-09-17 Amendment to Regulation 5.200 (gaming salons) takes effect
2. 2026-01-29 Amended Regulation 5.260 (incident response plan, 24-hour notice) takes effect
3. 2024-07-25 Regulation 5.260(3) amended to require compliance within 90 days of licensing
4. 2023-12-31 Original deadline for covered entities to comply with Regulation 5.260(3)

1. 2026-09-17
   Regulation 5 (Rev. 09/26) AmendmentCurrent text

   The Commission amended section 5.200 (gaming salons) on 17 September 2026, effective the same day; the codified Regulation 5 is published as Rev. 09/26. source

2. 2026-01-29
   Regulation 5.260 amendments (January 2026) Amendment

   Amendments approved on 29 January 2026, effective the same day, replaced "cyber-attack" with "cybersecurity incident" and set new incident response and reporting duties. source

   More

   • Each covered entity must keep a documented cybersecurity incident response plan.
   • Notify the Board Chair within 24 hours of activating the plan, including incidents originating at a third-party vendor where patron personal information is compromised.
   • File an Initial Cybersecurity Incident Response report within 5 calendar days, or meet the Chair within that period, and send written updates every 30 days until resolved.
   • The Chair may waive, modify, condition or revoke reporting obligations on a timely request.
3. 2024-07-25
   Regulation 5.260(3) amendment (July 2024) Amendment

   Replaced the original 31 December 2023 compliance date with a requirement to comply within 90 days of being licensed; effective on adoption. source

4. 2022-12-22
   Regulation 5.260 Cybersecurity (adopted December 2022) Amendment

   Adopted on 22 December 2022 and effective 1 January 2023, added section 5.260 (Cybersecurity), with an initial compliance deadline of 31 December 2023 for covered entities. source

Regulation 5 governs every licensed gaming establishment; its cybersecurity section binds nonrestricted casino licensees and race book, sports pool and interactive gaming licensees.

Covered entities

Holders of a nonrestricted licence that operate games, and holders of licences for a race book, a sports pool or interactive gaming (5.260(2)(f)). source

What it protects

The licensee's information systems and records, and the personal information of patrons and employees as defined in NRS 603A.040 (5.260(1)). source

Group I licensees

Covered entities classified as Group I under regulation 6.010 have extra duties: a designated responsible individual and annual internal and independent reviews (5.260(5)). source

Rest of Regulation 5

Regulation 5 also covers methods of operation, grounds for disciplinary action, compliance review, AML compliance officers, information licensees must furnish and club venues. source

Covered entities assess risk and choose best practices themselves; Group I licensees add an annual internal audit and an annual independent review with written attestation.

Risk assessment

Perform an initial risk assessment, adopt cybersecurity best practices (for example CIS v8, COBIT 5, ISO/IEC 27001 or NIST SP 800-53) and keep monitoring; comply within 90 days of being licensed. source

Incident reporting

Notify the Chair within 24 hours of activating the incident response plan, report within 5 calendar days, update every 30 days and investigate the root cause (5.260(4)). source

Annual reviews

Group I licensees: at least annually an internal auditor or independent entity verifies practices, and an independent accountant or other entity attests in writing to compliance. source

Records

Document all procedures taken to comply and their results, and keep the records for at least five years (5.260(6)). source

Failure to comply is an unsuitable method of operation subject to discipline; the Commission can fine up to $500,000 per violation on an initial complaint.

Discipline

Failure to exercise proper due diligence in complying with 5.260 is an unsuitable method of operation and may result in disciplinary action (5.260(7)). source

Licence action

After a Board complaint, the Commission may limit, condition, suspend or revoke a licence or finding of suitability (NRS 463.310(4)). source

1. Law text NGC Regulation 5 – Operation of Gaming Establishments (Rev. 09/26)
2. Guidance Gaming Statutes and Regulations (index)
3. Guidance Notice 2026-33 – Amendments to NGC Regulation 5.260
4. Law text Regulation 5.260 as adopted on 29 January 2026
5. Guidance History of adopted regulations, technical standards and policies

1. NV SB 220

   NRS 603A sets security and breach duties for all data collectors in Nevada; Regulation 5.260 adds gaming-specific risk assessment and 24-hour incident reporting to the Board.

2. NYDFS Part 500

   23 NYCRR 500 is a prescriptive cybersecurity regulation for New York financial services; the Nevada rule lets gaming licensees choose recognised best-practice frameworks.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to NGC Regulation 5 (RSS)