Appendix 5 - 2026 RFP Information Technology - Addendum (1).docx

REQUEST FOR PROPOSALS (RFP) 2026-XX

LOTTERY CENTRAL MONITORING AND CONTROL SYSTEM AND RELATED SERVICES

APPENDIX 5

Information Technology (IT) ADDENDUM

1. General

A. Contractors shall comply with and adhere to the State IT Security Policy and Standards. These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

B. The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor-owned equipment to a State LAN/WAN.

The Contractor shall:

0. Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.7.5);

0. Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

0. The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information Systems and Information Technology and (ii) comply with and adhere to the State IT Security Policy and Standards as each may be amended or revised from time to time. Updated and revised versions of the State IT Policy and Standards are available online at:

https://doit.maryland.gov/policies/Pages/default.aspx

2. Data Protection and Controls A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”). Such Security Best Practices shall comply with an accepted industry standard, such as the NIST cybersecurity framework.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the Contractor may augment this list with additional controls):

1. Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in Section 3.7.5.

2. Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides https://www.cisecurity.org/, Security Technical Implementation Guides (STIG) https://public.cyber.mil/stigs/, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3. Ensure that State data is not comingled with non-State data through the proper application of compartmentalization Security Measures.

4. Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

5. For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

6. Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

7. Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including Maryland Department of Information Technology’s Information Security Policy.

8. Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The Agency shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

9. Ensure system and network environments are separated by properly configured and updated firewalls.

10. Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11. By default, “deny all” and only allow access by exception.

12. Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

13. Perform regular vulnerability testing of operating system, application, and network devices. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The Agency shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

14. Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information Security Policy (https://doit.maryland.gov/policies/Pages/default.aspx), including specific requirements for password length, complexity, history, and account lockout.

15. Ensure State data is not processed, transferred, or stored outside of the United States (“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its Contractor Personnel to access State data remotely only as required to provide technical support.

16. Ensure Contractor’s Personnel shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State, which may be revoked at any time for any reason. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor -owned equipment to a State LAN/WAN.

17. Ensure that anti-virus and anti-malware software is installed and maintained on all systems supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The Contractor shall perform routine vulnerability scans and take corrective actions for any findings.

18. Conduct regular external vulnerability testing designed to examine the service provider’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter. Evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effect on the service’s security and integrity and remediate the vulnerability promptly or document why remediation action is unnecessary or unsuitable. The Agency shall have the right to inspect these policies and procedures and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

19. Ensure all operating systems and firmware are kept up to date, including all manufacturers updates and security patches. All hardware and software shall be licensed with current maintenance contracts in place at all times.

3. Security Logs and Reports Access

1. The Contractor shall provide reports to the State in a mutually agreeable format.

1. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all State files related to the Contract.

4. Security Plan

1. The Contractor shall protect State data according to a written security policy (“Security Plan”) no less rigorous than that of the State, and shall supply a copy of such policy to the State for validation, with any appropriate updates, on an annual basis.

1. The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract.

E. The Security Plan shall address compliance with the PCI DSS for payment card processing.

5. PCI Compliance A. Contractor shall at all times comply, and ensure compliance with, all applicable Payment Card Industry ("PCI") Data Security Standards (“DSS”), including any and all changes thereto. Contractor shall provide the Agency with documented evidence of current compliance to PCI DSS within 30 days of an Agency request.

B. The Contractor shall annually furnish to the State evidence of the PCI Security Standards Council’s (“SSC”) acceptance or attestation of the Contractor’s conformance to the relevant PCI DSS requirements by a third party certified to perform compliance assessments.

C. The Contractor shall ensure that the scope of the annual SOC 2 Type II Report specified under Section 3.9 includes testing to confirm the PCI assessment results.

6. Security Incident Response A. The Contractor shall notify the Agency in accordance with Section 3.7.9A-D when any Contractor system that may access, process, or store State data or State systems experiences a Security Incident or a Data Breach as follows:

1. Notify the Agency as soon as practicable, but no later than within twenty-four (24) hours of the discovery of a Security Incident by providing notice via written or electronic correspondence to the Contract Monitor, Agency chief information officer and Agency chief information security officer;

2. Notify the Agency within two (2) hours if there is a threat to Contractor’s Solution as it pertains to the use, disclosure, and security of State data; and

3. Provide written notice to the Agency within one (1) Business Day after Contractor’s discovery of unauthorized use or disclosure of State data and thereafter all information the State (or Agency) requests concerning such unauthorized use or disclosure.

B. Contractor’s notice shall identify:

1. The nature of the unauthorized use or disclosure;

2. The State data used or disclosed,

3. Who made the unauthorized use or received the unauthorized disclosure;

4. What the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

5. What corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure.

6. The Contractor shall provide such other information, including a written report, as reasonably requested by the State.

C. The Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Contract. Discussing Security Incidents with the State should be handled on an urgent as-needed basis, as part of Contractor communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract.

D. The Contractor shall comply with all applicable laws that require the notification of individuals in the event of unauthorized release of State data or other event requiring notification, and, where notification is required, assume responsibility for informing all such individuals in accordance with applicable law and to indemnify and hold harmless the State (or Agency) and its officials and employees from and against any claims, damages, and actions related to the event requiring notification.

7. Data Breach Responsibilities A. If the Contractor reasonably believes or has actual knowledge of a Data Breach, the Contractor shall, unless otherwise directed:

1. Notify the appropriate State-identified contact as soon as practicable, but no later than within 24 hours by telephone in accordance with the agreed upon security plan or security procedures unless a shorter time is required by applicable law;

2. Cooperate with the State to investigate and resolve the data breach;

3. Promptly implement commercially reasonable remedial measures to remedy the Data Breach; and

4. Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services.

B. If a Data Breach is a direct result of the Contractor’s breach of its Contract obligation to encrypt State data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause; all [(1) through (5)] subject to the Contract’s limitation of liability.

8. Right to Review Compliance The State shall, at its discretion, have the right to review and assess the Contractor’s compliance to the security requirements and standards defined in the Contract.

9. Surviving Provisions Provisions in Sections 3.7.1 – 3.7.10 shall survive expiration or termination of the Contract. Additionally, the Contractor shall flow down the provisions of Sections 3.7.4-3.7.10 (or the substance thereof) in all subcontracts.

10. Required Project Policies, Guidelines and Methodologies (See section 2.3.20) The Contractor shall be required to comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically. Offeror is required to review all applicable links provided below and state compliance in its response.

It is the responsibility of the Contractor to ensure adherence and to remain abreast of new or revised laws, regulations, policies, standards and guidelines affecting project execution. These include, but are not limited to:

A. The State of Maryland System Development Life Cycle (SDLC) methodology at: https://doit.maryland.gov/MITDP-Oversight/Pages/SDLC.aspx;

B. The State of Maryland Information Technology Security Policy and Standards at: https://doit.maryland.gov/policies/ci/Pages/IT-Security-Policy.aspx- keyword: Security Policy;

C. The State of Maryland Information Technology Non-Visual Standards at: https://doit.maryland.gov/policies/Accessibility/Pages/Nonvisual-Access-Regulatory-Standards.aspx;

D. The State of Maryland Information Technology Project Oversight at Thttps://doit.maryland.gov/MITDP-Oversight/Pages/MITDP-oversight.aspx Problem Escalation Procedure General The Contractor must provide and maintain a Problem Escalation Procedure (PEP) for both routine and emergency situations. The PEP must state how the Contractor will address problem situations as they occur during the performance of the Contract, especially problems that are not resolved to the satisfaction of the State within appropriate timeframes.

Contact Information The Contractor shall provide contact information to the Contract Monitor, as well as to other State personnel as directed should the Contract Monitor not be available.

When to Provide and Contents of PEP The Contractor must provide the PEP no later than ten (10) Business Days after notice of recommended award. The PEP, including any revisions thereto, must also be provided within ten (10) Business Days after the start of each Contract year and within ten (10) Business Days after any change in circumstance which changes the PEP. The PEP shall detail how problems with work under the Contract will be escalated in order to resolve any issues in a timely manner. The PEP shall include:

1. The process for establishing the existence of a problem;

G. Names, titles, and contact information for progressively higher levels of personnel in the Contractor’s organization who would become involved in resolving a problem;

H. For each individual listed in the Contractor’s PEP, the maximum amount of time a problem will remain unresolved with that individual before the problem escalates to the next contact person listed in the Contractor’s PEP;

I. Expedited escalation procedures and any circumstances that would trigger expediting them;

J. The method of providing feedback on resolution progress, including the frequency of feedback to be provided to the State;

K. Contact information for persons responsible for resolving issues after normal business hours (e.g., evenings, weekends, holidays) and on an emergency basis; and L. A process for updating and notifying the Contract Monitor of any changes to the PEP.

No Limitation of Rights Nothing in this section shall be construed to limit any rights of the Contract Monitor or the State which may be allowed by the Contract or applicable law.

Annual SOC 1 Type 2 and SOC 2 Type 2 Audit Reports SOC 1 Type 2 Audit An annual SOC 1 Type 2 audit conducted by an independent CPA firm is required for the MLGCA’s GAPP financial statements. The SOC 1 Type 2 audits will include functions performed by subcontractors, as appropriate. A SOC 1 Type 2 Audit includes both a review of the internal controls placed in operation as well as tests of operating effectiveness. Prior to contracting with the independent CPA firm, the Contractor shall obtain the MLGCA's approval of the firm. In addition, prior to the start of each audit, the Contractor in conjunction with the MLGCA shall jointly determine the control objectives to be tested. Controls to be tested shall include both those over financial reporting and data security.

SOC 2 Type 2 Audit A SOC 2 Type 2 Audit applies to the Contract. The applicable trust services criteria are: Security, Availability, Processing Integrity, Confidentiality, and Privacy – The Agency to choose which of the five trust services criteria apply as defined in the Guidance document identified in Section 3.9.3.

Additional Audits In the event the Contractor provides services for identified critical functions, handles Sensitive Data, or hosts any related implemented system for the State under the Contract, the Contractor shall have an annual audit performed by an independent audit firm of the Contractor’s handling of Sensitive Data or the Agency’s critical functions. Critical functions are identified as all aspects and functionality of the Solution including any add-on modules and shall address all areas relating to Information Technology security and operational processes. These services provided by the Contractor that shall be covered by the audit will collectively be referred to as the “Information Functions and Processes.” Such audits shall be performed in accordance with audit guidance: Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (SOC 2) as published by the American Institute of Certified Public Accountants (“AICPA”) and as updated from time to time, or according to the most current audit guidance promulgated by the AICPA or similarly-recognized professional organization, as agreed to by the Agency, to assess the security of outsourced client functions or data (collectively, the “Guidance”) as follows:

1. The type of audit to be performed in accordance with the Guidance is a SOC 2 Type 2 Audit (referred to as the “SOC 2 Audit” or “SOC 2 Report”). All SOC 2 Audit Reports shall be submitted to the Contract Monitor as specified in Section F below. The initial SOC 2 Audit shall be completed within a timeframe to be specified by the State. The audit period covered by the initial SOC 2 Audit shall start with the Contract Effective Date unless otherwise agreed to in writing by the Contract Monitor. All subsequent SOC 2 Audits after this initial audit shall be performed at a minimum on an annual basis throughout the Term of the Contract, and shall cover a 12-month audit period or such portion of the year that the Contractor furnished services.

1. The SOC 2 Audit shall report on the suitability of the design and operating effectiveness of controls over the Information Functions and Processes to meet the requirements of the Contract, including the Security Requirements identified in Section 3.7, relevant to the trust services criteria identified in 3.9.2, as defined in the aforementioned Guidance.

1. The audit scope of each year’s SOC 2 Report may need to be adjusted (including the inclusion or omission of the relevant trust services criteria of Security, Availability, Processing Integrity, Confidentiality, and Privacy) to accommodate any changes to the environment since the last SOC 2 Report. Such changes may include but are not limited to the addition of Information Functions and Processes through modifications to the Contract or due to changes in Information Technology or the operational infrastructure. The Contractor shall ensure that the audit scope of each year’s SOC 2 Report engagement shall accommodate these changes by including in the SOC 2 Report all appropriate controls related to the current environment supporting the Information Functions and/or Processes, including those controls required by the Contract.

1. The scope of the SOC 2 Report shall include work performed by any subcontractors that provide essential support to the TO Contractor or essential support to the Information Functions and Processes provided to the Agency under the Contract. The Contractor shall ensure the audit includes all such subcontractors operating in performance of the Contract.

1. All SOC 2 Audits, including those of the Contractor, shall be performed at no additional expense to the Agency.

1. The Contractor shall provide to the Contract Monitor, within 30 calendar days of the issuance of each SOC 2 Report, a complete copy of the final SOC 2 Report(s) and a documented corrective action plan addressing each audit finding or exception contained in the SOC 2 Report. The corrective action plan shall identify in detail the remedial action to be taken by the Contractor along with the date(s) when each remedial action is to be implemented.

1. If the Contractor currently has an annual, independent information security assessment performed that includes the operations, systems, and repositories of the Information Functions and Processes being provided to the Agency under the Contract, and if that assessment generally conforms to the content and objective of the Guidance, the Agency will determine in consultation with appropriate State government technology and audit authorities whether the Contractor’s current information security assessments are acceptable in lieu of the SOC 2 Report(s).

1. If the Contractor fails during the Contract term to obtain an annual SOC 2 Report by the date specified in Section 3.9.3.A, the Agency shall have the right to retain an independent audit firm to perform an audit engagement of a SOC 2 Report of the Information Functions and Processes utilized or provided by the Contractor and under the Contract. The Contractor agrees to allow the independent audit firm to access its facility/ies for purposes of conducting this audit engagement(s), and will provide the necessary support and cooperation to the independent audit firm that is required to perform the audit engagement of the SOC 2 Report. The Agency will invoice the Contractor for the expense of the SOC 2 Report(s), or deduct the cost from future payments to the Contractor.

1. Provisions in Section 3.9.2-2 shall survive expiration or termination of the Contract. Additionally, the Contractor and shall flow down the provisions of Section 3.9.2-2 (or the substance thereof) in all subcontracts.