**Note to User:**The following checklist for 542.16 Information Technology remains available on the NIGC website for use for those operations that continue to use internal controls based on 542.16 Information Technology due to their tribal-state gaming compact, approved gaming ordinance or other tribal regulation. On April 22, 2014, Section 542.16 was removed from part 542 and on September 27, 2018, part 542 was suspended. To view Section 542.16 prior to its removal, use the following

link: https://www.federalregister.gov/citation/67-FR-43400 . NIGC offers an updated, non-binding guidance on Class III Minimum Internal Control Standards which includes a section on Information Technology which may be found at https://www.nigc.gov/utility/documents/guidance-on-the-class-iii-minimum-internal-control-standards-mics. At this time, there is no checklist developed or available for the Class III Guidance. There is a checklist available for Class II 543.20 Information Technology

at https://www.nigc.gov/images/uploads/checklists-and-worksheets/54320IT%20ITDataChecklist10012014.docx that with minor modification can be used for the Class III Guidance.

***NATIONAL INDIAN GAMING COMMISSION***

***MICS AUDIT CHECKLIST***

**MICS QUESTION**

**YES**

**NO**

**W/P	REF	MICS COMMENT**

Page 4 of 11

10. Are non-IT personnel precluded from having unrestricted access to the secured computer areas? (Inquiry)

 542.16(a)(5)

11. Are the computer systems, including application software, secured through the use of passwords or other approved means where applicable (Application software installed on specific

computers, computer systems located in secure	 room, etc)? (Applicable to all gaming and related

areas) (Inquiry and review other- perform log-in tests on network system(s) and each stand alone system.)

12. Do management personnel or persons independent of the department being controlled assign and

control access to system functions? (Inquiry and	 review other- perform log-in tests on network

system(s) and each stand alone system.)

13. Are passwords controlled as follows unless otherwise addressed in this section: (Inquiry)

542.16(a)(6)

542.16(a)(6)

Does each user have their own individual password?

14. Are passwords controlled as follows unless otherwise addressed in this section: (Inquiry and review supporting documentation)

Are passwords changed at least quarterly with changes documented?

15. Are passwords controlled as follows unless otherwise addressed in this section: (Inquiry and

 542.16(a)(7)(i)

 542.16(a)(7)(ii)

review supporting documentation)	

For computer systems that automatically force a password change on a quarterly basis, isdocumentation maintained listing the systems and the date the user was given access?

542.16(a)(7)(iii)

***NATIONAL INDIAN GAMING COMMISSION***

***MICS AUDIT CHECKLIST***

**MICS QUESTION**

**YES**

**NO**

**W/P	REF	MICS COMMENT**

Page 8 of 11

changes, including evidence of user acceptance, date in service, programmer, and reason for changes, is documented and maintained?

(d) **Security logs.**

34. Are computer security logs generated by the system reviewed by IT supervisory personnel for evidence of the following: (Note: Standard does not apply to personal computers.) (Inquiry)

Multiple attempts to log-on? (Alternatively, the system shall deny user access after three login attempts)

35. Are computer security logs generated by the system reviewed by IT supervisory personnel for evidence of the following: (Note: Standard does not apply to personal computers.) (Inquiry)

Unauthorized changes to live data files?

36. Are computer security logs generated by the system reviewed by IT supervisory personnel for evidence of the following: (Note: Standard does not apply to personal computers.) (Inquiry)

Any other unusual transactions?

(e) **Remote dial-up.**

37. If remote dial-up to any associated equipment is allowed for software support, does the gaming operation maintain an access log (computerized or manual) that includes: (Inquiry and review supporting documentation)

Name of employee authorizing modem access?

 542.16(d)(1)(i)

 542.16(d)(1)(ii)

 542.16(d)(1)(iii)

 542.16(e)(1)(i)

38. If remote dial-up to any associated equipment is	 542.16(e)(1)(ii)

allowed for software support, does the gaming operation maintain an access log (computerized or manual) that includes: (Inquiry and review supporting documentation)

Name of authorized programmer or manufacturer representative?

***NATIONAL INDIAN GAMING COMMISSION***

***MICS AUDIT CHECKLIST***

**MICS QUESTION**

**YES**

**NO**

**W/P	REF	MICS COMMENT**

Page 11 of 11

39. If remote dial-up to any associated equipment is allowed for software support, does the gaming operation maintain an access log that includes: (Inquiry and review supporting documentation)

Reason for modem access?

40. If remote dial-up to any associated equipment is allowed for software support, does the gaming operation maintain an access log that includes: (Inquiry and review supporting documentation)

Description of work performed?

41. If remote dial-up to any associated equipment is allowed for software support, does the gaming operation maintain an access log that includes: (Inquiry and review supporting documentation)

Date and time?

42. If remote dial-up to any associated equipment is allowed for software support, does the gaming operation maintain an access log (computerized or manual) that includes: (Inquiry and review supporting documentation)

Duration of access?

(f) **Document storage.**

43. If the gaming operation scans or directly stores documents to an unalterable storage medium, are the following conditions met:

Does the storage medium contain the exact duplicate of the original document? (Review other- sample current documents)

 542.16(e)(1)(iii)

 542.16(e)(1)(iv)

 542.16(e)(1)(v)

 542.16(e)(1)(v)

 542.16(f)(1)(i)

the following conditions met:

Have original documents been retained until the books and records have been audited by an independent certified public accountant? (Inquiry)