UKGC RTS Section 4 Security Audit | CREST-Accredited

Years of experiences

Test your environment. Secure your licence.

Most firms treating RTS Section 4 as a documentation review miss the point. It is an annual security audit. The controls in ISO 27001:2022 Annex A are testable. We test them against your live environment

Critical System Scoping

Assessment boundary defined against RTS Section 4.3: player accounts, payment systems, RNG components, game back-end platforms, and all connected third-party integrations. If you hold ISO 27001 certification, your certified scope is mapped first and only the delta is assessed.

ISO 27001:2022 Gap Analysis

Every applicable Annex A control assessed across your implemented environment: cryptography (8.24), network security (8.20 to 8.22), privileged access (8.2), secure development lifecycle (8.25 to 8.31), cloud services (5.23). Each finding referenced to its RTS control number and classified by severity.

CREST-Accredited Penetration Testing

VAPT scoped to the same RTS critical system boundary as the gap analysis. Web application testing covers player authentication, session management, and gaming API endpoints. Internal network testing validates segmentation between critical and non-critical systems. Cloud configuration and third-party integrations are assessed for exposure. Every finding maps to the Annex A control it relates to.

Remediation Planning and Support

Each finding produces a remediation action with enough technical detail for your engineering team to implement directly. Actions are prioritised by severity and mapped to the specific RTS control they close. We provide implementation support throughout, not just a report to act on independently.

Verification and Retest

Remediated findings retested under the same conditions as the original assessment. Retest closes the finding formally in the evidence pack. Unretested remediations are among the most common sources of UKGC audit findings.

Audit Report and Ongoing Monitoring

Audit report meets the UKGC testing strategy standard: lead auditor named, all systems documented, every finding referenced to its RTS control number. Between cycles, UKGC standard revisions are mapped to your environment before each effective date.

Unbreakable Environments, impeccable engineering

ISO/IEC 27001:2022

UKGC RTS Section 4 Security Audit | CREST-Accredited | Crossbow

Learn more

OWASP (Open Web Application Security Project) Testing Guide

OWASP is not part of the RTS standard. It is the methodology applied when testing web applications within the RTS critical system boundary. Player-facing interfaces, authentication flows, and gaming API endpoints are assessed against the OWASP Testing Guide, providing structured coverage of web vulnerabilities that map back to ISO 27001:2022 Annex A control 8.8.

Learn more

CREST (Council of Registered Ethical Security Testers)

The UKGC requires the annual RTS Section 4 audit to be conducted by a CREST-accredited auditor. Unlike ISO 27001 consultancies that subcontract technical testing, all VAPT work here is conducted by CREST-accredited security professionals in-house.

Learn more

MITRE ATT&CK Framework

Testing scenarios reference real-world attacker techniques mapped to the MITRE ATT&CK framework to simulate threats targeting gambling infrastructure and online gaming platforms.

Learn more

RBI Tokenization

RBI's Card Data Tokenization guidelines ensures secure transaction processing and protect card-on-file data for recurring transactions. They replace sensitive card data with unique tokens and manage risks associated with card data storage and processing.

Learn more

CONTINUOUS MONITORING

CTEM Platform for Enterprise

See your exposure in one place with our continuous monitoring platform, purpose built for the full Gartner CTEM lifecycle across cloud, applications and identities. Have the single view you always needed for attack surface, validated findings and remediation progress. Track assets, exposure discovery, validation results, remediation status and reporting across your whole environment on one continuous platform.

RTS-Focused Security Testing

Every assessment is scoped and executed against the UKGC RTS Section 4 requirements. Controls are tested, not self-declared. Findings are referenced to specific Annex A control numbers. The output is audit-grade evidence, not a gap report.

SOC Integration

Assessment findings are integrated into your SOC for continuous threat detection across RTS critical systems between annual audit cycles.

Automated and Manual Testing

Scanning identifies the attack surface across RTS critical systems. Manual penetration testing confirms exploitability and validates segmentation under adversarial conditions. ISO 27001:2022 control 8.8 requires evidence of both.

Annual and Continuous Monitoring

Annual RTS engagements structured across each audit cycle. UKGC standard revisions tracked and mapped to your environment before effective dates. Vulnerability states monitored between cycles so each annual engagement starts from a current baseline.

Frequently Asked Questions

What is the UKGC RTS Section 4 security audit requirement?

Under Licence Condition 2.3.1, every UK remote gambling and gambling software licence holder must pass an annual independent security audit aligned to ISO/IEC 27001:2022. The auditor must hold CREST accreditation and be fully independent. Non-compliance is a licence condition breach with direct enforcement consequences.

We already hold ISO 27001 certification. Do we still need a separate RTS audit?

Yes. The UKGC requires an independent third-party audit specifically against your RTS critical systems. ISO 27001 certification reduces scope significantly. Your certified scope is mapped to the RTS boundary and only the delta is assessed.

What does the engagement deliver?

Gap analysis report with findings referenced to RTS control numbers, a remediation roadmap prioritised by severity, VAPT reports scoped to your RTS critical systems, and the formal annual audit report meeting UKGC testing strategy documentation requirements. All deliverables are ready for the Commission, your board, or regulatory review.

UK Gambling Commission

Test your environment. Secure your licence.

Unbreakable Environments, impeccable engineering

CTEM Platform for Enterprise

RTS-Focused Security Testing

SOC Integration

Automated and Manual Testing

Annual and Continuous Monitoring

Frequently Asked Questions

Get Cybersec

Let's Discuss together.