Pursuant to RSA 284:22-c, IV(g), each ADW provider shall file with the commission by April 15 of each year for the previous calendar year in which ADW was offered a copy of the annual independent third-party cybersecurity audit which shall include, at a minimum, the following:

1. (a) A PCI attestation of compliance;
2. (b) A penetration test of all digital platforms, mobile applications, internal, external, and wireless networks to confirm if identified vulnerabilities of all devices, the servers, and applications are susceptible to compromise; and
3. (c) Recommended corrective action, and remediation plans, if applicable.

Source. #14448, eff 12-3-25, EXPIRES: 12-3-35