North Carolina General Statutes 18C-122. Independent audits
(a) Biennially, at the beginning of the calendar year, the Commission shall engage an independent firm experienced in security procedures, including computer security and systems security, to conduct a comprehensive study and evaluation of all aspects of security in the operation of the Commission and of the Lottery. At a minimum, such a security assessment should include a review of network vulnerability, application vulnerability, application code review, wireless security, security policy and processes, security/privacy program management, technology infrastructure and security controls, security organization and governance, and operational effectiveness.
(b) The portion of the security audit report containing the overall evaluation of the Commission and of lottery games in terms of each aspect of security shall be presented to the Commission, to the Governor, and to the General Assembly.
(c) The portion of the security audit report containing specific recommendations shall be confidential, shall be presented only to the Director and to the Commission, and shall be exempt from Chapter 132 of the N.C. Gen. Stat.. The Commission may hear the report of such an audit, discuss, and take action on any recommendations to address that audit under N.C. Gen. Stat. § 143-318.11(a)(1). The Commission may hear reports on the following matters under N.C. Gen. Stat. § 143-318.11(a)(1), all of which shall be exempt from Chapter 132 of the N.C. Gen. Stat.:
(1) Information regarding any vulnerabilities listed in subsection (a) of this section.
Terms Used In North Carolina General Statutes 18C-122
- Commission: means the North Carolina State Lottery Commission. See North Carolina General Statutes 18C-103
- Director: means the person selected by the Commission to be the chief administrator of the North Carolina State Lottery. See North Carolina General Statutes 18C-103
- Fiscal year: The fiscal year is the accounting period for the government. For the federal government, this begins on October 1 and ends on September 30. The fiscal year is designated by the calendar year in which it ends; for example, fiscal year 2006 begins on October 1, 2005 and ends on September 30, 2006.
- following: when used by way of reference to any section of a statute, shall be construed to mean the section next preceding or next following that in which such reference is made; unless when some other section is expressly designated in such reference. See North Carolina General Statutes 12-3
- Lottery: means any lottery game or series of games established and operated pursuant to this Chapter. See North Carolina General Statutes 18C-103
- lottery game: means any procedure or amusement authorized by the Commission where prizes are distributed among persons who have paid, or unconditionally agreed to pay, for tickets or shares that provide the opportunity to win those prizes and does not utilize a video gaming machine as defined in N. See North Carolina General Statutes 18C-103
(2) Information that could impair or adversely impact the security of the Lottery or the Commission in carrying out its responsibilities as directed in this Chapter.
(3) Information that could be used to provide an unfair advantage to a player or jeopardize the integrity of any lottery game.
(d) Biennially at the end of the fiscal year, in addition to the audits required by N.C. Gen. Stat. § 18C-116 and by subsection (a) of this section, beginning in 2010, the Commission shall engage an independent auditing firm that has experience in evaluating the operation of lotteries to perform an audit of the Lottery. The results of this audit shall be presented to the Commission, to the Governor, and to the General Assembly. (2005-344, s. 1; 2005-276, s. 31.1(i); 2009-357, s. 15; 2023-42, s. 4(i).)