Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · las vegas

Hotel desk, gaming floor, payments and loyalty: in a Las Vegas resort one stolen login can reach them all.

Nevada's gaming rules require a call to the Board Chair within 24 hours of a serious cyber incident, and the 2023 attack on MGM Resorts showed what a shutdown costs in a single September. Most Las Vegas conversations we have start at the help desk and end at the loyalty database.

Talk to an engineer
work in las vegas7 services
4 local rules covered below
in short·15-second read

For Las Vegas casino operators, hotels, convention venues and their suppliers we work on workforce and guest identity, help desk verification, privileged access and governed guest data.

Regulation 5.260 asks licensees for risk assessments and incident reporting, and NRS 603A makes PCI DSS state law for card acceptors. We serve Nevada remotely from our Frisco, Texas office and travel to Las Vegas for workshops and launches.

We have no Las Vegas office. Cohash runs Nevada engagements remotely from Frisco, Texas, and flies in for discovery, tabletop exercises, design workshops and go-live nights, which on a casino floor usually means overnight.

Ask an engineer facts checked 2026-10-21 · 5 sources
rules
Nevada breach notification, NRS 603A.220NRS 603A.215, PCI DSS and encryptionNevada Gaming Commission Regulation 5.260, cybersecurityNRS 603A.340 to 603A.345, online privacy notice and sale opt-out
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
las vegas by the numbers

What's specific about Las Vegas

Each figure comes from a public source, linked on the card.

01 38,545,700

Las Vegas drew 38,545,700 visitors in 2025, down from 41,676,300 in 2024, according to the LVCVA's historical tourism statistics.

source ↗ 02 150,300

For 2025 the LVCVA counted 150,300 hotel rooms, 5,988,200 convention attendees and $13,688,228,000 in Clark County gaming revenue.

source ↗ 03 1,190

Leisure and hospitality account for 302.8 thousand of the Las Vegas-Henderson-North Las Vegas metro's 1,190.5 thousand nonfarm jobs, per BLS figures for September 2026 (preliminary).

source ↗ 04 $100 million

In an October 2023 SEC filing, MGM Resorts estimated its September cybersecurity issue cut Adjusted Property EBITDAR by about $100 million, mostly in Las Vegas, and said attackers took personal data of some customers who transacted before March 2019.

source ↗
who and what

Who we work with in Las Vegas, and the rules they work under

industries

  1. Casino resorts and gaming operators

    Dealers, cage staff, surveillance, hotel and food teams all sign in somewhere, often on shared terminals, and the help desk resets passwords for thousands of them. That desk is the soft spot. We set up caller verification that does not rely on facts an attacker can look up, move admins to phishing-resistant MFA, and keep directory and cloud admin roles apart.

  2. Hotels, loyalty and guest data

    Loyalty programs hold years of guest records, and old data is still exposed data, as MGM's disclosure about records from before March 2019 showed. We inventory where guest records live, agree retention with counsel, tokenize what analytics needs and purge the rest. Guest-facing sign-in gets its own customer identity platform.

  3. Conventions and event venues

    A big show brings temporary staff, exhibitors and production crews who need accounts for days, not months. We issue time-boxed accounts, federate partner companies instead of creating local logins, and make sure event apps and exhibitor portals do not share credentials with core systems.

  4. Sports betting and online gaming

    Sports pool and interactive gaming licensees are covered by the same cybersecurity regulation as the casino floor. Their platforms call odds feeds, payment processors and identity verification services through API keys. We move those keys into a vault, set rotation and watch for use from unexpected places.

regulations

  1. Nevada breach notification, NRS 603A.220 ↗

    Data collectors notify affected Nevada residents in the most expedient time possible and without unreasonable delay. Notifying more than 1,000 people at one time also triggers notice to the nationwide consumer reporting agencies, and a party maintaining data for another must tell the owner immediately.

  2. NRS 603A.215, PCI DSS and encryption ↗

    A data collector that accepts payment cards must comply with the current PCI DSS. Others must encrypt personal information sent outside their secure systems or carried on devices beyond their control. Meeting the section shields a collector from breach damages absent gross negligence or intentional misconduct.

  3. Nevada Gaming Commission Regulation 5.260, cybersecurity ↗

    Covers nonrestricted licensees, race books, sports pools and interactive gaming. Licensees run a risk assessment, keep their chosen practices current, notify the Board Chair within 24 hours of activating incident response and file an initial report within 5 days. Group I licensees also need annual internal and independent reviews.

  4. NRS 603A.340 to 603A.345, online privacy notice and sale opt-out ↗

    Website and online service operators post a privacy notice and must honor verified requests not to sell covered information, answering within 60 days. Nevada has no comprehensive consumer privacy act. The Attorney General enforces these sections, with civil penalties up to $5,000 per violation.

services

Most requested in Las Vegas

The services clients in Las Vegas ask us for most.

you are hereLas Vegas
01What does Regulation 5.260 expect from our identity program?

It does not list controls. It asks you to assess risk and adopt practices you judge appropriate, naming CIS Version 8, COBIT 5, ISO/IEC 27001 and NIST SP 800-53 as examples. We map your identity controls to whichever framework you pick. The annual attestation for Group I licensees comes from an independent accountant or similar firm, not from us.

02How do we stop a caller talking our help desk into resetting an admin's MFA?

Take admins out of phone-based resets entirely and require an in-person or video check with a manager's approval. For everyone else, verify with a push to a registered device or a callback to the number on file, never with employee ID or birth date alone.

03Do we have to keep loyalty records going back a decade?

Retention is a decision for your counsel and compliance team, weighing gaming record rules and tax needs. Our part is finding every copy, including old data warehouses and vendor extracts, and making sure whatever you decide to delete is actually gone.

04Is Nevada's PCI requirement different from what the card brands ask?

The standard is the same, but NRS 603A.215 turns it into state law for card-accepting data collectors and links it to a liability limit. On the identity requirements, such as unique IDs, MFA into the cardholder environment and access reviews, we do the build. We are not a QSA.

05Do sports betting apps fall under the same cybersecurity rule?

Yes. Regulation 5.260 lists sports pool and interactive gaming licensees as covered entities, so the risk assessment, 24-hour notice and record keeping apply to the betting platform as well as the casino.

elsewhere

Other cities we cover

All 82 cities
AtlantaPayments & payers ChicagoTrading & healthcare New YorkNYDFS-regulated finance AustinTech & state government Dallas–FriscoBanking, fintech, telecom (HQ) HoustonEnergy & pipelines
sources 5 sources linked last checked 2026-10-21 content fingerprint c5960bd2
  1. 01LVCVA, historical visitation statistics 1970 to 2025lvcva.com ↗
  2. 02BLS, Las Vegas-Henderson-North Las Vegas economy at a glancebls.gov ↗
  3. 03MGM Resorts International, Form 8-K (5 October 2023)sec.gov ↗
  4. 04Nevada Gaming Control Board, Regulation 5 (rev. 09/26)gaming.nv.gov ↗
  5. 05NRS chapter 603Aleg.state.nv.us ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it