WLASCS: 2012 INITIAL CERTIFICATION AUDIT REPORT CALIFORNIA STATE LOTTERY. Prepared for

Transcription

1

2

3 WLASCS: 2012 INITIAL CERTIFICATION AUDIT REPORT Prepared for CALIFORNIA STATE LOTTERY Submitted By: GLI Test Labs Canada ULC Suite Roberts Street Burnaby, British Columbia, V5G 4C9 Canada Phone: (778) Fax: (778)

4 Roberto Zavala Chief, Internal Audits l Executive 700 rth 10th Street, Sacramento, CA 95757, USA Office: (916) l Cell: (916) July 24, 2014 GLI Test Labs Canada, a certification service entity duly appointed by the World Lottery Association (WLA) conducted a WLA Security Control Standard (WLASCS: 2012 ) full audit of California State Lottery between May 27, 2014 to June 4, As a result, the audit team recommends that based on the results of this audit and the organization's demonstrated state of development and maturity certification be Approved for California State Lottery upon confirmation and continuation of ISO27001:2005 certification from the registrar Société Générale de Surveillance (SGS) certification board. The SGS audit was completed June 10, The audit team conducted a process-based audit focusing on significant aspects, risks, and objectives required by the standard. The audit methods used were interviews, observation of activities and review of documentation and records. The objectives of this audit were to confirm that the lottery security management processes and associated controls conformed to all of the requirements of the standard; to confirm that the organization has effectively implemented the required lottery specific controls as specified within the standard and to confirm that the lottery security management processes were capable of achieving the organization s policy objectives. The audit team concluded that the organization has maintained an information security management system in line with control requirements of the WLASCS: 2012 standard. The lottery specific business line process documentation demonstrated conformity with the requirements of the lottery specific controls of the standard and provided sufficient structure to support implementation and maintenance of game security. The organization has demonstrated effective implementation, management and continual improvement of its lottery security controls. The organization has demonstrated the establishment and tracking of appropriate key performance metrics and monitored progress towards their achievement. An internal audit program has been fully implemented and demonstrates effectiveness as a governance and oversight tool for driving continual improvement within lottery specific control environments. The management review and oversight process demonstrated capability to ensure the continuing suitability, adequacy and effectiveness of the lottery controls. Please sign below as record of review and acceptance of audit report. Signature: Gregory Doucette WLASCS Accredited Auditor CONFIDENTIAL Document: WLASCS Audit Report Issue n : 1 Page n : 2 of 5

5 Contents 1. Organization Details Audit Objectives Scope of Certification Current Audit Findings and Conclusions Previous Audit Results Audit Findings... 5 GLI Test Labs Canada ULC All rights reserved. part of this document may be reprinted, reproduced, stored in a retrieval system or transmitted, in any form or by any means, without prior permission in writing from GLI Test Labs Canada ULC other than for the internal business use of the California State Lottery. Initially published and distributed on July 24, CONFIDENTIAL Document: WLASCS Audit Report Issue n : 1 Page n : 3 of 5

6 1. Organization Details WLASCS: 2012 Initial Audit Report Organization: Address: California State Lottery 700 rth 10th Street, Sacramento, CA 95757, USA Standard(s): WLASCS:2012 Accreditation Body(s) WLA:SRMC Representative: Site(s) audited: Roberto Zavala Site # rth 10th Street, Sacramento Date(s) of audit(s): May 27, June 4, 2014 Site # Ramco Street #110, Sacramento Site # Lucas Ranch Road, Rancho Cocamonga Lead Auditor: Gregory Doucette Additional team member(s): Thomas Bierbach Murray Lee This report is confidential and distribution is limited to the auditor and client representative. 2. Audit Objectives The objectives of this audit were: to confirm that the information security management system and lottery specific controls conform with all of the requirements of the standard; to confirm that the organization has effectively implemented the required lottery specific controls as specified within the standard; and to confirm that the security controls are capable of achieving the organization s policy objectives. 3. Scope of Certification Information Security Management Systems (ISMS) of California Lottery as it applies to all lottery and gaming related activities of its operation, including all related systems. In accordance with the Statement of Applicability version 1.0, approval date 5/19/14 established within the framework of the development of the ISMS. 4. Current Audit Findings and Conclusions The audit team conducted a process-based audit focusing on significant aspects, risks, and objectives required by the standard. The audit methods used were interviews, observation of activities and review of documentation and records. The audit team concludes that the organization has has not established and maintained its information security management system and lottery specific security controls in line with the requirements of the standard and demonstrated the ability of the controls to achieve agreed requirements for products or services within the scope and the organization s policy and objectives. Number of nonconformities identified: x Major x Minor Therefore the audit team recommends that, based on the results of this audit and the organization s demonstrated state of development and maturity, certification be: Granted / Continued / Withheld / Suspended until satisfactory corrective action is completed. CONFIDENTIAL Document: WLASCS Audit Report Issue n : 1 Page n : 4 of 5

7 5. Previous Audit Results The results of the last audit for this organization have been reviewed, in particular to assure appropriate correction and corrective action has been implemented to address any nonconformity identified. This review has concluded that: This is the initial WLASCS: 2012 certification audit, thus this section is not applicable as there are no previous nonconformities to be addressed. Any nonconformity identified during previous audits has been corrected and the corrective action continues to be effective. Management has not adequately addressed nonconformity identified during previous audit activities and the specific issue has been re-defined in the nonconformity section of this report. 6. Audit Findings The audit team conducted a process-based audit focusing on significant aspects, risks, and objectives. The audit methods used were interviews, observation of activities and review of documentation and records. The organization has established and maintained an information security management system in line with the requirements of the standard. The lottery specific business line process documentation demonstrated conformity with the requirements of the lottery s specific controls of the standard and provided sufficient structure to support implementation and maintenance of game security. The organization has demonstrated effective implementation, management and continual improvement of its lottery security controls. The organization has demonstrated the establishment and tracking of appropriate key performance metrics and monitored progress towards their achievement. An internal audit program has been fully implemented and demonstrates effectiveness as a governance and oversight tool for driving continual improvement within lottery specific control environments. The management review and oversight process demonstrated capability to ensure the continuing suitability, adequacy and effectiveness of the lottery controls. Certification claims are accurate and in accordance with WLA guidance. N/A In accordance with Government Code , Independent Audit of Lottery Security it states, The portion of the report containing specific recommendations shall be exempt from public disclosure and shall be presented only to the Commission, the Attorney General, the Controller and the Governor. That being said the remaining portions of this report have been omitted. CONFIDENTIAL Document: WLASCS Audit Report Issue n : 1 Page n : 5 of 5