23 CAR § 355-1704 – Security requirements

(a) The communication process used by the EGS and the host system must be robust and stable enough to secure each cashless transaction such that a failure event or events can be identified and logged for subsequent audit and reconciliation.
(b) In addition, cashless systems must conform to the following security requirements:
1. (1) The numbers of users that have the requisite permission levels/login to adjust critical parameters are limited;
2. (2)
  1. (A) Only a logged, authorized employee shall have the ability to access all player information.
  2. (B) Security of this information (including patron PIN codes or equivalent patron identification) must be maintained at all times; and
3. (3) Any adjustment to an account balance would require a supervisor’s approval with all changes being logged and/or reported indicating who, what, when, and the item value before and after the change, with the reason.