Guide to Certification
for the WLA Security Control Standard

Part A of the GtC contains principles, requirements, and procedures that are involved in the WLA-SCS certification process. It is meant to support WLA members seeking WLA-SCS certification, auditors that have been selected to perform the WLA-SCS assessment, and for the ASEs that employ the selected auditor.

WLA-SCS certification

The GtC presupposes familiarity with the WLA-SCS.

WLA-SCS certification is open to WLA members pursuant to the WLA By-Laws. The WLA-SCS certification is also open to WLA Associate Members and approved subsidiaries.

The WLA-SCS certificates are valid for a three-year period.

WLA-SCS certification specifies the essential requirements necessary for the effective management of security in lottery and sports betting operations. Compliance with the WLA-SCS enables WLA members to ensure the integrity, availability, and confidentiality of information vital to their secure operation.

WLA-SCS certification attests only to the existence of a set of security and integrity procedures that, at the time of certification, correspond to the objective of managing the inherent risks associated with the operations of gaming operators.

WLA-SCS certification does not guarantee in any manner the results obtained in the matters that they deal with.

WLA-SCS certification programs

There are two different approaches to WLA-SCS cer­tification that WLA Regular Members can choose to follow according to their needs: WLA-SCS Level 1 certification and WLA-SCS Level 2 cer­tification.

WLA Associate Members can only be certified under the WLA-SCS Level 2 scheme.

To be granted the WLA-SCS Level 1 certificate, the WLA Regular Member must successfully pass the assessment against the applicable controls of the WLA-SCS. For a period of three years, extending until October 31, 2026, MUSL lotteries certified to MUSL Rule 2 automatically qualify for WLA-SCS:2024 Level 1 certification.

To be granted the WLA-SCS Level 2 certificate, a WLA Member must successfully pass assessment against the applicable controls of the WLA-SCS and hold a current and valid ISO/IEC 27001 certificate with a global scope including the ISMS related requirements.

WLA Members that hold a WLA-SCS:2020 certificate are considered to be at Level 2. Transition to WLA-SCS:2024 Level 2 certification can occur during an annual review or recertification assessment.

WLA Member’s responsibilities

The WLA Member recognizes the WLA-SCS and the GtC as written at the time of certification or recerti­fication.

The WLA Member is solely responsible for the choice of procedures and methods used to render the WLA-SCS operational.

The WLA Member recognizes that the WLA, the WLA affiliated ASE, and the selected auditor are in no way responsible for any claim/s or damage/s in regard to Part A, Section 3.2.

The WLA member is responsible for making all pertinent information and any changes to the supplied information available to the WLA affiliated ASE and the selected auditor in a timely manner.

The WLA member will provide all the required as­sistance to the WLA affiliated ASE and the selected auditor.

WLA-SCS certification is open solely to WLA Members in good standing pursuant the WLA By-Laws and can only be used in conformity with the WLA Code of Conduct and other WLA directives.

Preparation for WLA-SCS certification

Gap analysis and pre-assessment

Prior to the certification audit, the WLA member seeking to obtain the WLA-SCS certification may conduct a gap analysis or a pre-assessment of their security, integrity, and risk management systems, to identify any discrepancies between their current security and integrity arrangements and the requirements of the WLA-SCS and ISO/IEC 27001.

Typically, the gap analysis or a pre-assessment is carried out by the internal staff or consultants.

The gap analysis or a pre-assessment is not man­datory, but it can help in evaluating the organization’s readiness for an external assessment.

Selection of the ASE and the auditor

In accordance with Part B, Section 1.1, the WLA member must select an auditor that is an employee, agent, or subcontractor of an ASE affiliated to the WLA.

The official list of affiliated ASEs is published on the WLA website or can be obtained by contacting the WLA office.

In accordance with Part B, Section 1.3, it is advised that the WLA member makes sure the ASE selected is affiliated with the WLA.

In accordance wih Part B, Section 3, the WLA member must make sure the auditor selected, or designated by the ASE to conduct the WLA-SCS assessment, has valid and current credentials.

Certification assessment procedures

Principles

ASEs and auditors must act in a fair and objective way, guaranteeing impartiality.

ASEs and auditors must demonstrate competence and knowledge of the WLA-SCS documents.

The procedures followed by ASEs and the auditors conducting WLA-SCS assessments must be clear and openly available.

All information and documents that are not covered by confidentiality must be made available by ASEs and the auditors.

Certification (basic procedures)

The WLA-SCS certification foresees three different types of assessments: initial certification, annual review, and recertification – where not specified, collectively referred to as “certification assessment” or “assessment”.

WLA member must identify the type of WLA-SCS certification program, according to Part A, Section 2 of this guide.

The assessment is conducted by the selected auditor employed by an ASE affiliated with the WLA, or by an independent contractor affiliated with the WLA (collectively referred to as “auditor”).

As soon as any type of certification assessment is scheduled, and in any case before it starts,
the selected auditor must complete the Declaration of Assessment Form (hereinafter DoAF), and send it to the WLA, notifying the intention to conduct a WLA-SCS certification assessment of a WLA member. An example of the DoAF and the instructions on how to fill it out can be found in Annex B of this guide.

The duration of the assessment depends on the type of assessment and the size of the WLA member. While the ASE bears full responsibility for establishing the needed resources and for defining the timeframe for adequately conducting a WLA-SCS assessment, the WLA SRMC provides some guidance on the expected number of days required to complete the assessment (see Annex A of this guide).

On completion of the certification audit, the auditor selected completes a detailed certification assessment report, the Assessment Form (hereinafter AF), and any other documents deemed useful for clari­fying the outcome of the assessment.

The assessment report serves to document the certification assessment and its outcome. Given its confidentiality, it should be sent directly to the concerned WLA member and not to the WLA or any other third party. The content and the format of the report are at the discretion of the auditor.

The AF contains:
• All the applicable controls and the sites that have been audited;
• The auditor’s recommendations;
• References to the ISO/IEC 27001 certificate held by the WLA member (only for WLA-SCS Level 2).

The completed AF must be sent to the WLA. An example of the AF and instructions on how to fill it out can be found in Annex C of this guide.

Upon completion of the assessment, the auditor must send the WLA the AF and, if required by the WLA-SCS certification program selected, a valid copy of the ISO/IEC 27001 certificate held by the WLA member audited, and any other relevant document related to the certification process.

Any major non-conformity found during the assessment must be communicated to the WLA in the recommendation field of the AF and resolved within six months. Until the major non-conformity is resolved, the issuing or validation of the certificate remains pending.

Multiple sites assessments

If during the same WLA-SCS certification process different premises are audited against different controls, the auditor must clearly clarify in the recommendations field of the AF which controls have been audited for each premises.

In complying with Part A, Section 5.3.1, a separate document can be prepared by the auditor
and attached to the AF, if necessary. In such cases, reference to the additional document must be included in the recommendations field of the AF. The format of the additional document is at the discretion of the auditor.

If during the same WLA-SCS assessment different premises are audited by different auditors, each auditor must complete one AF, specifying in the recommendation field that the AF is partial and provide the name of the other auditor/s involved in the same WLA-SCS audit.

With due regard to Part A, Sections 5.4.4, 5.5.5, and 5.6.5, if the scope of a WLA-SCS certification involves multiple sites, and not all sites are physically covered by the present assessment, the reason for exclusion of these sites must be clearly stated in the recommendation field of the AF.

Initial certification

Before the initial certification procedure begins, it is recommended that the WLA member informs the WLA office.

WLA Regular Members and WLA Associate Members that are also lottery operators must be
audited against all the controls of Annex A (Organizationl controls, known as the G Controls)
and all the applicable controls of Annex B (Controls for the operation of games, known as the L Controls), and Annex C (Controls for the development of gaming systems and the provision of gaming services, known as the S Controls).

WLA associate members that are not lottery operators must be audited against all the controls of Annex A and any applicable controls of Annex C. Any additional L controls included in the assessment are not mandatory.

During the initial certification all the premises to be covered by the WLA-SCS certificate must be physically visited and assessed against all the applicable controls. If it involves multiple sites that perform the same function, the auditor can decide on how best to gain his own confidence on compliance on the number of premises to be physically assessed.

The certification procedure to follow for the initial certification is contained in Part A, Section 5.2.

Annual review

In order to ensure that the certified WLA member remains compliant with the WLA-SCS throughout the three-year certification period, two annual review assessments must be scheduled and completed.

The annual review assessments are also to focus on any changes that may have occurred within the WLA member since the previous assessment.

The two annual review assessments must be scheduled by the auditor in agreement with the WLA member and be performed in a reasonable time according to the certification period, ideally 12 months after the previous assessment.

During mandatory annual review assessments, the applicable controls shall be sampled. However, for WLA-SCS Level 2 certified members, the current validity of the ISO/IEC 27001 certifi­cation and its global scope must be verified at each annual assessment. All applicable controls shall have been audited at least once during the three-year assess-ment cycle.

All the premises to be covered by the WLA-SCS certificate during a first and/or second annual assessment should be physically visited and assessed against the relevant applicable controls. Remote visits can be conducted in accordance with the policies of the National Accreditation body and ISO/IEC 27001. If there is a scope, process, and or organizational change, the premises related to those changes must be physically visited and assessed against all applicable controls. If it involves multiple sites that perform the same function, the auditor can decide on how best to gain his/her own confidence on compliance on the number of premises to be physically assessed.

The certification procedure to follow for the annual review assessment is contained in Part A, Section 5.2.

Recertification

The WLA member can maintain its certification valid by repeating the certification process every three years.

To avoid any disruption to the certification, the recertification process should begin prior to the expiration of the WLA-SCS certificate.

When multiple sites are audited for the same WLA-SCS certificate, it is recommended that all the sites are audited not later than four months before the expiry date of the WLA-SCS certificate. In this case, where needed, multiple auditors can be selected to perform the assessment in time.

All the applicable controls shall be covered in the recertification assessment.

During the recertification assessment, all the premises to be covered by the WLA-SCS certificate, must be physically visited and assessed against all the applicable controls. If it involves multiple sites that perform the same function, the auditor can decide on how best to gain his own confidence on compliance on the number of premises to be physically assessed.

The certification procedure to follow for the recertification assessment is contained in Part A, Section 5.2.

Certification procedure for MUSL lotteries

MUSL lotteries certified to MUSL Rule 2 automatically qualify for the WLA-SCS:2024 Level 1 certificate until October 31, 2026. From November 1, 2026 onwards, MUSL lotteries that wish to keep their WLA-SCS certificate must refer to the regular certification procedures contained in Part A, Section 5 of this guide.

To receive the WLA-SCS Level 1 certificate, MUSL lotteries must complete the Certificate Request Form and send it to the WLA together with a copy of the MUSL certificate. An example of the Certificate Request Form can be found in Annex E of this guide.

Once the required documents are received and verified, the WLA will issue a WLA-SCS Level 1 certificate with a validity period of three years.

To receive the WLA-SCS Level 2 certificate, MUSL lotteries must follow the regular certification procedure contained in Part A, Section 5 of this guide. Additionally, MUSL lotteries must be audited against Annex D (controls for multi-juris­dictional games, known as the M Controls).

Issue of the WLA-SCS certificate

The WLA is the only entity that can issue WLA-SCS certificates.

The decision to either grant or decline WLA-SCS certification, is based on the auditor’s recommendation and all the documents submitted by the auditor (DoAF, AF, copy of the ISO/IEC 27001 certificate, and any other additional documents).

The WLA informs the WLA member and the auditor by email of the WLA-SCS certificate release status.

If approved, the WLA publishes the result on the WLA website and issues the WLA-SCS certificate, by providing the WLA member with the digital version and the WLA-SCS logo.

A sample of the WLA-SCS certificate can be found in Annex D of this guide.

ISO/IEC 27001 certificate conformity

The ISO/IEC 27001 certificate is independent and separate from the WLA-SCS certificate and it follows its specific rules and regulations.

The WLA-SCS assessments and the ISO/IEC 27001 assessments can be performed in different periods or in parallel. The WLA encourages the alignment of the two certification periods.

The WLA-SCS assessment and the ISO/IEC 27001 assessment can be performed by two different auditors or by the same auditor. If the auditor performing the assessments is the same for both certificates, Part A, Section 4.2 of this guide must be taken into consideration.

At the time the AF is being reviewed by the WLA for WLA-SCS Level 2 certification, the WLA member must must have a valid and current ISO/IEC 27001 certificate, issued from an entity which is accredited for ISO/IEC 27001 certifications.

Remote assessment

Remote assessments are considered as such when:
a. The auditor never physically visits the auditee premises.
b. The auditor checks only some controls remotely.
c. The auditor is on-site but conducts interviews with employees in smart/home-office, or visits some premises remotely using videocam support.

In each of the preceding cases, the present section applies.

Requirements for remote assessments

The ASE shall provide evidence to the WLA about the internal procedures and rules its auditors must take into consideration to evaluate, schedule, and perform remote audits.

According to the documentation received from the ASE in relation to Part A, Section 8.1.1, the WLA releases a notice of validity to the ASE. Only after receiving the notice of validity for remote auditing, the ASE and its auditors are allowed to schedule and perform WLA-SCS assessments remotely.

The WLA may perform spot checks on the procedures for remote assessments identified by the ASEs and followed by the auditors.

Remote assessments are possible only for auditors employed by ASEs that meet the requirements of Part A, Sections 8.1.1, 8.1.2, and 8.1.3.

Partially remote assessments are considered remote assessments and must be scheduled, and performed, taking into consideration the requirements and procedures included in this guide.

Remote assessments or partially remote assessments differ from on-site assessments only in the means used to perform the audit. All other provisions and principles remain unaltered.

The decision to perform remote assessments must be taken by both the auditor and the WLA member, taking into account the requirements documented in this section.

Remote audits can be performed only by auditors that have already conducted at least one complete on-site assessment of the WLA member. The only exception being that cited in Part A, Section 8.4 (Specific instructions for initial assessments conducted remotely).

Remote audits are not allowed if one or more of the following cases apply:
a. The audit is for an initial certification assessment (see the exception in Part A, Section 8.4).
b. The audit involves a scope extension.
c. Significant changes in products, services, or processes have occurred since the last assessment.
d. Significant changes to the buildings or facilities have occurred since the last assessment.

To perform a remote audit, a suitable Information and Communication Technology (ICT) infrastructure shall be available, allowing access to relevant information required for the assessment and guaranteeing the feasibility and efficacy of the process.

Both the auditor and the WLA member representatives shall have sound competency in the use of the ICT tools and infrastructure.

Both the auditor and the WLA member shall have a clear understanding of, and be in full compliance with, the local legislation and regulations related to confidentiality, security, and data protection.

The ICT availability and the competency of human resources must be assessed by the auditor and the WLA member prior to the decision to schedule a remote assessment.

A documented feasibility and risk analysis shall be prepared by the ASE and the auditor and be made available at the request of the WLA.

Procedure for all remote assessments

The auditor and the WLA member shall explicitly inform the WLA office when a WLA-SCS
assessment is going to take place remotely, taking full responsibility for the requirements included in Part A, Section 8.1 of this guide.

The communication to the WLA shall be made through the Remote Assessment Request form (hereinafter RAR). An example of the RAR and instructions on how to complete it can be found in the Annex F of this guide.

Before a remote assessment can be performed, the auditor must receive an acceptance notice from the WLA business office. It is therefore strongly recommended that the WLA business office be informed in good time to allow all the necessary checks.

If the auditor is not satisfied with the remote audit findings, the audit shall be suspended, and an on-site assessment shall be organized.

Auditors shall add their comments in the recommendation field of the AF, regarding the extent to which ICT was used, and the effectiveness of its use in achieving the audit objectives. The report should ultimately indicate which processes could not be audited and should have been audited on-site.

Any major non-conformity found during the remote assessment must be communicated to the WLA in the recommendation field of the AF and resolved within six months. The auditor shall evaluate if an on-site visit is necessary to verify the resolution of the non-conformity. Until the non-conformity is resolved, the issuing or validation of the WLA-SCS certificate will remain pending.

Specific instructions for recertification assessments conducted remotely

WLA-SCS recertification can be performed remotely only in cases where a manifestly critical situation would preclude an on-site visit. In this case, the WLA-SCS certification shall only be a provisional certification until an onsite assessment has been performed to satisfaction.

During the three-year certification cycle at least one on-site visit shall be scheduled and performed.

Specific instructions for initial assessments conducted remotely

WLA-SCS initial certifications must be performed on-site. They can be performed remotely only in cases where a manifestly critical situation would preclude an on-site visit (see the “Crisis Management Guidance for the  WLA-SCS” for details) and there is a demonstrated urgency to obtain the WLA-SCS certificate. In this case, the WLA-SCS certification shall only be a provisional certification until an onsite assessment has been performed to satisfaction in the 3-year cycle.

Evidence of a critical situation or an urgency in obtaining the WLA-SCS certificate must be provided to the WLA. The WLA will then inform the auditor and the WLA member in writing as to whether the remote assessment of the initial certification is approved or denied.

The first annual review after a remote initial assessment shall be done on-site and the auditor shall audit, without exclusion, all applicable controls. If this condition is not met, the WLA-SCS certification shall remain a provisional certification until an onsite assessment has been performed to satisfaction. The second annual review after a remote initial assessment or a remote first annual review shall be done on-site and the auditor shall audit, without exclusion, all applicable controls. If this condition is not met, the certificate will be suspended.