Check List

Access control according to the necessary business authority

Purpose

To check if an access to ticketing-related information assets is appropriately restricted according to functions and responsibilities of the staff & third party personnel associated with instant lottery ticketing.

Audit resources

Procedure

Verification

Document

Access Control Policy Guide, Access Rights Plan

Product

Detailed study list and method

-    Check if an access control policy is established according to the levels of information assets related to ticketing

-    Clearly stated roles and access rights according to user classification

-    Establishment of registration and deletion procedure for information system users

-    Modification/deletion of information on user rights at the time of staff transfer or resignation

-    Documentation of a special user’s work and a periodical check of the documentation.

Check List

Remote user access management

Purpose

To ensure authorized remote user access and to prevent unauthorized access to gaming information systems.

Audit resources

Procedure

Verification

Document

Product

Detailed study list and method

-    Check if gaming systems are accessed from locations under control of lottery organization, excluding player participation in organization-offered games, in case of accident.

-    Check if the functional area is defined in conjunction with the process owner and manager, function of security and IT

-    Check if all activities about user access are logged, reported and reviewed.

-    Check every remote user access a security incident refection.