CSL_1499_Generative_AI_Impact_Assessment_Form.pdf

CSL 1499 (N04/25)

EXEC/ISO

Classification: SENSITIVE

GenAI Impact Assessment Form For all California State Lottery (Lottery) procurements, the Lottery’s Information Security Office (ISO) requires a complete review of any Generative Artificial Intelligence (GenAI) software solution that may be provided to the Lottery as a contract deliverable or used to complete any portion of the contract deliverables. This form shall be completed by the bidder or contractor and submitted to ISO to allow for an assessment of risk to the Lottery. Additional information may be requested by the Lottery, if ISO determines that clarification of bidder/contractor responses is needed to complete the assessment.

If multiple GenAI solutions are being provided or utilized in performance of the contract services by a bidder/contractor, a separate form must be submitted for each solution.

An informational Glossary and Definitions section is provided at the end of this document. All defined terms are capitalized throughout this form.

Part 1: Mandatory Assessment Complete the assessment below. For any response checked “Yes”, please identify the question/statement by number and explain your response on the last page of the document.

Vendor Name:

1. Identify the GenAI software solution name, including related developed software and/or applications built within a larger program or service:

2. Please describe the features of the GenAI solution, how it is utilized, and how it will be utilized to provide the deliverables identified in the Lottery’s Statement of Work (SOW).

Page | 1

Classification: SENSITIVE

GenAI Impact Assessment Form

3. Does the GenAI solution use, or is it built from, a third-party GenAI tool or toolkit (e.g., ChatGPT, Google Gemini, Microsoft Copilot, etc.)?

4. Provide a general description of the AI model(s) that the GenAI solution uses or has been trained on (e.g., Large Language Model, Natural-Language Model, etc.)?

5. Does the GenAI solution share its data with any other state entity or third-party ☐Yes organization?

☐No

6. Does the GenAI solution store, transmit, or process any of the following data ☐Yes element descriptors: Personally Identifiable, Confidential, Sensitive, and Financial

☐NoInformation?

7. Does the GenAI solution store, transmit, or process any user or system ☐Yes information, including Lottery data, outside of the Continental United States?

☐No

8. Does the GenAI solution not include Data Loss Prevention (DLP) system ☐Yes functionality?

☐No

Page | 2

Classification: SENSITIVE

GenAI Impact Assessment Form

9. Is the GenAI solution known to produce any Hallucinations or biased ☐Yes information? (If yes, please identify this item by number and explain your

☐Noresponse on the last page of the document; include any safeguards that you provide [such as review by subject matter experts].)

10. Does the GenAI solution not include updates on a pre-defined cadence, including ☐Yes critical security updates and system patches?

☐No

Part 2: Required Quality, Security, and Safety Controls You are required to complete this section if you responded “Yes” to any of the questions in Part 1. If you agree with statements below, mark the “Yes” box next to the control; if you disagree or believe the control is inapplicable to your product, mark “No”; for all “No” responses, please identify the statement letter and explain your response on the last page of the document.

a. The GenAI solution informs the user they are engaging with an Artificial ☐Yes Intelligence solution and provides disclaimers of its actions and processes.

☐No

b. The GenAI solution will not adversely impact the performance or security of any ☐Yes of the Lottery’s physical equipment (e.g., draw machines, terminals, servers, etc.).

☐No

c. The GenAI solution will not adversely impact the availability of resources and ☐Yes services provided by the Lottery.

☐No

d. The GenAI solution monitors and logs all access and activities associated with ☐Yes Lottery information for audit purposes.

☐No

e. In the event of a GenAI solution outage, the Lottery’s business operations and/or ☐Yes service levels will not be disrupted.

☐No

f. The GenAI solution adopts the most recent version of the National Institute of ☐Yes Standards and Technology (NIST) Special Publication (SP) 800-53 as minimum information security control requirements, to support implementation and ☐No compliance with the Federal Information Processing Standards (FIPS).

Page | 3

Classification: SENSITIVE

GenAI Impact Assessment Form ☐Yes g. The GenAI solution does not allow remote access from outside the Continental

United States. ☐No

h. The GenAI solution requires multi-factor authentication for remote access. ☐Yes

☐No

i. All data collected by the GenAI solution is encrypted, including in transit and at ☐Yes rest.

☐No

j. The GenAI solution complies with a Zero Trust Architecture model. ☐Yes

☐No

k. All data collected by the GenAI solution in connection with the contract is subject ☐Yes to California Civil Code sections 1798.99.80 through 1798.99.89 and will not be sold or advertised to any third parties. ☐No

l. All generated output from the GenAI solution will be owned by the Lottery. ☐Yes

☐No

m. The GenAI solution will not collect and/or utilize Lottery data for the use of ☐Yes training any instances of a GenAI solution.

☐No

n. The GenAI output will not infringe on any copyright or intellectual property rights ☐Yes and is compliant with open-source licenses, as applicable.

☐No

o. GenAI output will include citations (from credible sources) if any statements used ☐Yes as facts are generated for potential publication to consumers.

☐No

p. All contractor generated images and videos will cite any GenAI used in their ☐Yes creation, even if the images are subsequently altered.

☐No

q. The GenAI solution will not spoof or conduct acts of fraud, including deepfake ☐Yes creation, impersonation, phishing, social engineering, or manipulation of other AI solutions. ☐No

Page | 4

Classification: SENSITIVE

GenAI Impact Assessment Form

r. The GenAI solution is designed to avoid generating controversial or illicit content. ☐Yes

☐No

s. The Vendor will provide sufficient training to Lottery personnel for the use of the ☐Yes developed GenAI solution.

☐No

t. The GenAI solution will cite its sources and knowledge bases when presenting ☐Yes information for Lottery use.

☐No

By signing this document, I confirm that I am an authorized representative of the Vendor, that I have exercised due diligence in preparing these responses, and that the information that I have provided is true and correct to the best of my knowledge.

Vendor Representative Name: ________________________________ Title: _____________________

Vendor Representative Signature: _____________________________ Date Signed:_______________

Page | 5

Classification: SENSITIVE

GenAI Impact Assessment Form

Glossary and Definitions:

• Artificial Intelligence (AI): Artificial Intelligence (AI) is the development of algorithms and systems that enable machines to perform tasks that typically require human intelligence. It encompasses a broad range of applications and processing, from machine learning, deep learning, automated decision-making, generative AI, and natural language processing.

• Confidential Information: Information maintained by the California State Lottery (Lottery), which is privileged or which, if released could potentially cause harm to the State of California, the Lottery, its business partners, its employees, customers, or the public.

• Data Loss Prevention (DLP): Data Loss Prevention (DLP) refers to tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users.

DLP is designed to detect and prevent data breaches, exfiltration, or unwanted data destruction by monitoring, detecting, and blocking sensitive data while in use (endpoint actions), in motion (network traffic), and at rest (data storage).

• Generative AI Models:

o Closed AI Model: Training data that has been concealed or closed as opposed to open-source models to protect the underlying data an IP.

o Computer Vision Model: A field of Artificial Intelligence that enables computers and systems to derive meaningful information from digital images, videos, and other visual inputs, and to act on or understand that information.

o Deep Learning Model: A subset of machine learning, which in turn is a subset of AI. It refers to the use of neural networks with multiple layers—hence the term "deep"—to model complex patterns in data. Deep learning has been responsible for many of the recent advancements in AI, particularly in tasks that involve recognizing patterns or making predictions based on large and complex datasets.

o Large Language Model (LLM): An advanced Artificial Intelligence system designed to understand, generate, and sometimes translate human language. These models are "large" both in terms of the size of the neural network and the amount of data they have been trained on.

o Natural Language Processing (NLP) Model: A branch of Artificial Intelligence that focuses on the interaction between computers and humans through natural language, enabling systems/computers to understand, interpret, and generate human languages in a valuable and meaningful way.

o Open-Source Model: Refers to a machine learning or Artificial Intelligence model where the underlying code, algorithms, and in some cases, the trained model weights (parameters) are made available to the public under an open-source license.

o Supervised Learning Model: An algorithm is trained on a labeled dataset, which means the input data is paired with the correct output. The goal of supervised learning is for the algorithm to learn a mapping from inputs to outputs and be able to make predictions on new, unseen data based on that learned mapping.

Page | 6

Classification: SENSITIVE

GenAI Impact Assessment Form o Transformer Model: A specific type of neural network architecture that has become the foundation of many state-of-the-art natural language processing (NLP) systems. The transformer model is known for its ability to handle sequences of data, such as text, and its reliance on a mechanism called "attention" to draw global dependencies between input and output.

• Generative Artificial Intelligence (GenAI): Generative AI refers to an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio that emulates the structure and characteristics of the system’s training data.

• Hallucination: Refers to instances where the AI system generates information or responses that are not based on factual data or reality. This can occur when the AI produces plausible-sounding content that is incorrect, misleading, or entirely fabricated.

• Personally Identifiable Information (PII): A type of confidential information that is subject to special statutory protections and requirements. Personal information is any information that identifies or describes an individual. This includes, but is not limited to name, physical description, address, telephone number, social security number, driver's license or identification card number, account number, credit or debit card number.

• Public Information: Information maintained by the Lottery that is open to the public. This includes, but is not limited to, annual reports, press statements, and documents posted on the Lottery's website, and other public information.

• Sensitive Information: Information not approved for general distribution outside of the Lottery and intended solely for internal use by Lottery employees. This includes, but is not limited to, business plans, internal memoranda, minutes of meetings, and internal project reports. This information may or may not be subject to disclosure under the provisions of the Public Records Act (PRA) or other applicable laws. If data is not classified as confidential, personal, or public, this classification applies.

• Zero Trust Architecture: A cybersecurity concept and framework that operates on the principle of "never trust, always verify." Unlike traditional security models that rely on perimeter defenses to keep threats out of a network, Zero Trust assumes that threats could be both outside and inside the network.

Page | 7

Classification: SENSITIVE

GenAI Impact Assessment Form

Response Explanations:

For all responses that require additional explanation, please identify the number or letter for each question/statement and provide the related explanation. Attach additional pages as needed.

Page | 8

Classification: SENSITIVE

GenAI Impact Assessment Form

Response Explanations:

For all responses that require additional explanation, please identify the number or letter for each question/statement and provide the related explanation. Attach additional pages as needed.

Page | 9

g. The GenAI solution does not allow remote access from outside the Continental United States.