Brazil’s Ordinance No. 722: A New Era for iGaming and Online Sports Betting Regulations

On May 2, 2024, Brazil’s Secretariat of Prizes and Bets (SPA) and the Ministry of Finance (MF) unveiled Ordinance No. 722, a significant regulatory framework aimed at enhancing the technical and cybersecurity standards for iGaming and online sports betting operators in the country. This ordinance mandates that operators adhere to a set of stringent criteria within six months of obtaining their gaming licenses. As Brazil continues to establish itself as a burgeoning hub for online gaming, these regulations are designed to ensure a secure and reliable environment for both operators and players.

Key Requirements of Ordinance No. 722

Among the most critical stipulations outlined in Ordinance 722 are the establishment of robust recovery systems, comprehensive business continuity and disaster recovery plans, advanced firewall protections, and rigorous penetration testing protocols. These requirements are essential for safeguarding sensitive data and maintaining operational integrity in the face of potential cyber threats.

Establishing Robust Recovery and Resilient Business Continuity Plans

One of the cornerstones of Ordinance 722 is its emphasis on recovery and business continuity. According to Annex IV, Section 15, operators must implement a recovery system that allows for the restoration of the betting system from the last backup point in the event of catastrophic failure. This includes not only the recovery of recorded information but also the restoration of security configurations and user accounts.

Furthermore, Section 17 mandates the adoption of a business continuity policy and disaster recovery plan. This plan must detail how operators will recover their betting operations if the production environment becomes inoperable. The ordinance emphasizes the importance of maintaining current system encryption keys and a comprehensive record of system parameters, ensuring that operators can swiftly respond to any disruptions.

Recommendation: Operators are encouraged to begin with an audit service to verify compliance with igaming regulatory standards and identify vulnerabilities in their business continuity and disaster recovery plans. Following this, employing a backup service that seamlessly protects and restores files, databases, and applications is crucial for ensuring ongoing business continuity.

Securing the Network with Advanced Firewalls

Ordinance 722 also places a strong emphasis on network security, particularly through the implementation of advanced firewalls. As stated in Annex IV, Section 31, all communications, including remote access, must pass through at least one approved application-level firewall. This firewall acts as a critical barrier, scrutinizing all incoming and outgoing communications to prevent unauthorized access and potential threats.

The ordinance specifies that firewalls should be strategically positioned at the junction of different security domains, ensuring that no alternative network paths exist that could bypass these protective measures. Access to the firewall should be limited to a select number of user accounts, primarily those of network or system administrators.

Recommendation: Operators should utilize firewall services equipped with advanced threat intelligence to gain insights into their threat landscape and perimeter activities, enabling effective detection, prevention, and response to both known and emerging threats.

Implementing Comprehensive Penetration Testing

To further bolster cybersecurity, Ordinance 722 mandates regular penetration testing. As outlined in Annex IV, Section 41, the purpose of penetration testing is to exploit any weaknesses discovered during vulnerability assessments of publicly exposed applications or systems that process, transmit, or store sensitive information. This proactive approach allows operators to identify and rectify vulnerabilities before they can be exploited by malicious actors.

Recommendation: Operators should leverage regularly scheduled vulnerability assessment and penetration testing (VAPT) services for continuous and comprehensive security assessments of their infrastructure and applications. This not only aids in achieving regulatory compliance but also provides a strong foundation for enhancing overall security posture.

A 360-Degree Cybersecurity Approach

To ensure comprehensive protection, it is recommended that operators adopt a holistic risk mitigation strategy. A complete, 360-degree defense strategy includes:

• Endpoint Detection and Response (EDR): Protects against advanced malware, ransomware, and phishing threats.
• Distributed Denial-of-Service (DDoS) Services: Provides comprehensive perimeter network mitigation against DDoS attacks.
• Managed Security Operations Centre (MSOC) and Security Incident and Event Management (SIEM): Prevents, detects, and remediates vulnerabilities and threats.
• Regulatory Security Compliance Services: Includes compliance audits, VAPT, and vulnerability scanning (V-Scan) solutions to achieve regulatory compliance and understand the attack surface area.
• Mobile Protect Services: Safeguards mobile endpoints against modern security threats.
• SafeBait Services: Offers customized simulations to combat social engineering threats, including sophisticated MFA, phishing, smishing, vishing, and quishing attacks.

By adhering to the SPA and MF’s Ordinance 722 policies and collaborating with a trusted solutions provider, operators can meet Brazil’s newest technical and cybersecurity standards, ensuring secure and reliable gaming environments.

Continent 8 – Your Trusted Partner

Continent 8 Technologies has been a trusted managed hosting, connectivity, cloud, and cybersecurity partner to the global iGaming and online sports betting industry for over 25 years. With a presence in every major regulated Latin American jurisdiction, including Brazil, Continent 8 offers operators access to state-of-the-art data centers, connectivity to a global private network, and best-in-class managed and professional services to support the most demanding gaming requirements.

For more information on how Continent 8 can support your organization’s regulatory and cybersecurity needs, visit www.continent8.com or connect with us at upcoming industry events.

Conclusion

As Brazil’s iGaming and online sports betting market continues to evolve, Ordinance No. 722 represents a significant step towards ensuring a secure and resilient operational environment. By implementing the outlined technical and cybersecurity measures, operators can not only comply with regulatory requirements but also foster trust and confidence among players, paving the way for a thriving gaming ecosystem in Brazil.