IGB CCS IFB.docx

The following information will become the contract between the awarded vendor and the Illinois Gaming Board. Instructions and requirements to submit a bid response are found in the attachment titled “Invitation for Bid Vendor Instructions and Requirements”.

State of Illinois Contract v.25.4

Illinois Gaming Board Contract Video Gaming Central Communication System B49823 The Parties to this contract are the State of Illinois acting through the undersigned Agency (collectively the State) and the Vendor. This contract, consisting of the signature page and numbered sections listed below and any attachments referenced in this contract, constitute the entire contract between the Parties concerning the subject matter of the contract, and in signing the contract, the Vendor affirms that the Certifications and Financial Disclosures and Conflicts of Interest attached hereto are true and accurate as of the date of the Vendor’s execution of the contract. This contract supersedes all prior proposals, contracts and understandings between the Parties concerning the subject matter of the contract. This contract can be signed in multiple counterparts upon agreement of the Parties.

1. SCOPE OF WORK

1.1. OVERVIEW AND PURPOSE:

The Illinois Gaming Board’s (“IGB”) central communication system (“CCS”) connects 48,400 video gaming terminals (“VGTs”) and other associated video gaming equipment for regulatory monitoring, oversight, and enforcement actions in 8,700 locations across the state of Illinois. Vendors should refer to the Video Gaming Act (“VGA”), (230 ILCS 40/1, et seq.), the Board’s Rules (Part 1800 Video Gaming) and published Technical Standards for more information about video gaming in Illinois (available at https://www.igb.illinois.gov/VideoLaw.aspx).

Specific services include, but are not limited to:

· Support during the 24-month transition and upgrade phase to manage the transfer of data and hardware between service vendors

· Monitoring and reporting gaming activity on all VGTs

· Calculating, collecting, and distributing revenue

· Access to reports that do not require an extensive amount of time to download in various formats (i.e., excel, pdf)

· Data updated in five-minute windows The Vendor will provide the IGB with a CCS that, at a minimum, can monitor, communicate with, and activate or deactivate VGTs and other related technological components utilized in the video gaming industry.

The contract will have a term of 10 years. Under no event will the total term of the contract shall exceed ten (10) years. 30 ILCS 500/20-60.

All information requested as part of this solicitation shall be submitted in the format stipulated in this contract within the State’s eProcurement portal, BidBuy. Please refer to the invitation for bid vendor instructions for more information. Submissions must be signed by the person(s) duly authorized to bind the Vendor to contracts.

1.2. SUPPLIES AND/OR SERVICES REQUIRED:

The specifications shown herein are minimums. They are prepared by the Agency for the purpose of having the Vendor provide prompt service, in accordance with the terms and conditions contained in this Contract. Failure by the Vendor to comply with the specifications listed herein may result in cancellation of the Contract.

1.2.1. Prior to the end of the transition and upgrade period Vendor shall be able to provide all services and staff, and otherwise meet the requirements listed herein.

1.2.2. Vendor shall perform all services to the sole satisfaction of the State.

1.2.3. The State makes no guarantee as to a minimum or maximum number of services required, as detailed in this contract.

1.2.4. Vendor shall provide two copies of the CCS to be used for ongoing testing by an independent test laboratory or laboratories to test for CCS compatibility and security.

1.2.5. The Reporting solution shall meet all the requirements listed in Section 1.2.112 through 1.2.124. The Vendor shall include a Reporting & Dashboard Solution with the following minimal functionality:

1. Web-based portal presenting a dashboard of pre-configured and fully populated standard reports, including but not limited to accounting and operational functionality, terminal operator billing and auditing reports.

a. Reports shall include, but need not be limited to, ‘Reports’ listed in sections 1.2.109 through 1.2.133 of this contract.

b. Data fields shall include, but not be limited to, ‘Data Fields’ in subsection 1.2.125.

c. Reports calculations shall include, but not be limited to, ‘Report Summations and Calculations’ in section 1.2 subsection C of this contract.

d. Data retention for reports, report data and report calculations must be from inception of video gaming to date at all times.

e. A data warehouse, which shall have the capability and capacity to be refreshed hourly.

f. Response times shall be dynamically responsive and reliable at ALL times with no noticeable degradation.

2. Ad Hoc Reporting & Dashboard Solution with an appropriate front-end application interface for accessing production data housed in a centralized vendor data warehouse.

a. Data fields shall include, but not be limited to, ‘Data Fields’ table provided in 1.2.125.

b. Data retention for ad hoc reporting data shall be from inception of video gaming to date at all times.

c. The data warehouse shall have the capability and capacity to be refreshed hourly.

d. Response times shall be reasonable and reliable at all times with no noticeable degradation.

1.2.6. All mission-critical CCS functions shall be supported by a comprehensive business continuity plan and configuration. The primary site shall consist of at least two (2) logically and geographically separate systems. The CCS shall provide real-time communication, processing, and storage redundancy. A component failure in one primary site system must not cause a failure in the other system(s). Vendor shall explain its recovery time objective (RTO) and recovery point objective (RPO) in the event of a failure of one or both the systems. Vendor shall be in compliance with Illinois Department of Innovation and Technology (“DoIT”) requirements and protocols documented in attachment 5.5 State Security Requirements. Vendor shall be solely responsible for the quality of the system and all software releases. Although Agency approval is required for the implementation of software it does not change the Vendor’s responsibility for the continued quality and effectiveness of the software.

1.2.7. Vendor’s CCS shall at all times be in compliance with the VGA and Agency rules, regulations, standards, and policies. In the event a non-compliance is discovered, Vendor shall take immediate action to bring the CCS into compliance. Vendor shall provide any changes or enhancements to the CCS as requested by the Agency, State, or Legislative Body. All requests for system support, management and changes are a requirement and shall be completed timely.

1.2.8. If requested by the Agency, Vendor shall perform on-site field inspections at its sole cost and expense and provide a report in an automated format as approved by the Agency.

1.2.9. Vendor shall be available to travel and provide the services at any location within the State of Illinois and at any location associated with the CCS.

1.2.10. Where applicable, and upon request, Vendor shall submit proof that equipment associated with the CCS or Vendor’s facility has been inspected for safety and approved by an independent testing laboratory, and that all equipment’s are in compliance with the regulations applicable.

1.2.11. Vendor shall verify that all proposed processing computers, networking equipment and diagnostic equipment are new and unused unless explicitly allowed otherwise by the Agency. Equipment proposed shall be compliant with current electronic technology manufacturing standards and be manufactured by the Vendor or its suppliers. All replacement equipment shall represent the then-current equivalent or better standard in case a proposed device is phased out or replaced.

1.2.12. Vendor shall provide a twenty-four (24) hours per day, seven (7) days per week (including state and federal holidays), 365 days per year support to ensure regulatory compliance with the Act, the Board’s rules, and this contract. The 24-hour, 7-day a-week requirement can be met through any combination of telephone, email, or live chat support. Vendor shall develop a support process for handling CCS related problems and provide the process to the Agency for review and approval. Vendor has a continuing duty to annually evaluate any advances in technology that would aid in the furtherance of communication between IGB licensees and Vendor.

1.2.13. Agency employees can inspect each facility where CCS services for the Agency are conducted, with or without prior notice, to ensure the integrity of work is maintained and for review of new technology being considered for approval. Vendor shall be responsible, annually, for all travel costs incurred by up to two (2) agency employees, including out-of-state airfare, in-state mileage, out-of-state car rental and associated costs including car rental insurance and lodging to inspect each facility.

1.2.14. Vendor shall supply or provide 24/7 access and support to a test system including all hardware and software to the Agency and a licensed independent testing laboratory for the duration of the contract. This test system will be used to test system upgrades and conduct interoperability testing on VGTs, and redemption devices designed to communicate with the central communications system. The test system shall run the identical software that exists on the production system. It may utilize similar but not identical hardware. It is understood that there may be some functionality that the test system may not be able to support that shall be tested on the production system.

1.2.15. Vendor shall provide the Agency with real-time remote access to Vendor’s database(s), reports, and documents generated by the CCS and its supporting technologies, infrastructure. Pursuant to the information/data created by requirements stated in the contract, and available via a secure communication channel. Vendor shall maintain a quality assurance mechanism to ensure uniform data and data entry processes. The database shall be updated no less than hourly and be able to produce any reports for the IGB in a timely manner upon request.

1.2.16. Vendor’s online database shall allow the Agency to view updated reports and dashboards of all equipment, software, all items associated with the CCS, IGB Self-Exclusion Program (SEP) lists, all items associated video gaming equipment, progressive jackpot meters, including third-party redemption devices, or connected to the CCS. Such updated reports shall be current, and in an automated format approved by the Agency. The database shall meet all minimum requirements stated within the contract and contract and shall be able to be modified as needed by the IGB.

1.2.17. The CCS shall be capable of importing a text file containing Terminal Operator and video gaming location license information including name, license number, and expiration date. The CCS shall also be capable of associating a Terminal Operator or video gaming location license with one or more terminals owned by that Terminal Operator. Furthermore, the CCS shall have the capability to immediately disable individual VGTs, Video Games, redemption devices, or all VGTs associated with a license number and automatically disable terminals based upon the expiration of a license and provide a manual solution for the State to turn on, turn off, enable, disable at the Agencies discretion. Additionally, if a VGT is disabled, the IGB shall be able run a report that will identify the current number of active and disabled VGTs across the State and all data related VGTs including audit records.

1.2.18. Licensed Terminal Operators shall be allowed real-time access to Vendor’s data, including but not limited to active/inactive status of VGTs and meter data via secure communication channel. Vendor shall maintain a quality assurance mechanism to ensure data security and data entry processes. Terminal Operators can submit requests for their data to be displayed through the secure internet portal and if those requests are approved by the IGB then the Vendor can publish the data on the secure internet portal. All data available to the any party including Terminal Operators shall be documented and approved by the State. Access to all data from any party shall be logged, stored, and auditable at all times.

1.2.19. Licensed Terminal Operators shall be allowed secure, encrypted, read-only access to the CCS to obtain any required financial information for their VGTs or other information authorized by the Agency including game level data. If Vendor intends to charge licensed Terminal Operators a fee for access to the central communications system, the Vendor must provide an explanation on the fee to the IGB.

1.2.20. Vendor shall notify the Agency within 30 minutes of any situation or incident involving the integrity of the CCS or any VGTs or associated gaming equipment connected to the system.

1.2.21. Vendor shall employ a staff of full-time skilled professionals to afford a separation of responsibilities that provides independent work product verification and fulfills the requirements stated herein to the satisfaction of the Agency, Acts, Laws, this contract and subsequent contracts. Vendor shall provide all services using competent and properly trained personnel in accordance with the highest standards of the gaming industry. Vendor shall employ sufficient numbers of qualified and trained personnel to implement and operate the CCS and as needed, travel throughout the State of Illinois and to any location associated with the CCS in order to meet the needs of the Agency regarding the implementation and regulation of video gaming, and services or functions of the subsequent contract.

1.2.22. Vendor shall only utilize personnel in the performance of the services rendered in the United States who are authorized to work in the United States in accordance with applicable federal and state laws and regulations.

1.2.23. All CCS hardware and system software shall be replaceable at any time by more modern models or versions simply by means of system upgrades. All CCS hardware and system software shall be fully supported by the respective manufacturer or supplier at all times during the contract. In the event where support for any hardware module, component, or system software is discontinued by the manufacturer or supplier, Vendor shall replace, if required by the Agency, the respective hardware modules, components, or system software modules at its own cost prior to the support being discontinued. Vendor shall without delay inform the Agency of any such support discontinuation that it may become aware of.

1.2.24. The CCS shall provide the ability to deny access upon a failed attempt to access and resource. CCS security features to ensure this shall align with State Security Standards. Levels of security and password shall be continuously documented, managed, and audited and available to the Agency at all times including management of user roles and assignment. Access to every aspect of the system shall be restricted to only authorized personnel.

1.2.25. Each level of infrastructure, operating system, software shall have multiple security controls and distinct access levels. Sign on and Access shall be in accordance with State Security Requirements protocols documented attachment 5.5 subsections A, B, C, E, F, and any future security updates by the State.

1.2.26. There shall be no capability to connect into any gaming system from a remote, non-gaming terminal without Agency approval. Any dial-in capability, such as for remote diagnosis of equipment or software, shall employ stringent security mechanisms such as modems with dial-back, modems with on/off key locks, message encryption, and logging of sessions. Connections to other remote systems and terminals shall be protected by firewalls, encryption, or other means. The acceptability of any such security approach will be subject to IGB approval.

1.2.27. The Vendor shall provide a continuously updated list of all users of the CCS that includes privilege and access levels and to what part of the CCS.

1.2.28. The CCS shall include approved procedures for Intrusion Protection, Intrusion Detection, Virus Protection, and Virus Detection, in accordance with State Security Requirements documented in attachment 5.5 subsections A-F and any future security updates by the State.

1.2.29. Vendor shall ensure all CCS technologies are dedicated and not shared such as shared cloud services. The IGB shall approve all programs, data files and operating system files may reside on the CCS technologies. If hosted in a public cloud it shall be in a FedRAMP compliant environment.

1.2.30. All non-routine access alerts and alarm events shall be logged in a SIEM and archived for future retrieval. These alerts and events shall have the capability to be sent by the Vendor to the relevant Terminal Operator in real time. Events shall be displayed and available for printout for IGB or Vendor intervention, auditing purposes, and in accordance with State Security Requirements documented in attachment 5.5 subsections A-F and any future security updates by the State.

1.2.31. Software signatures shall be collected on all devices at all locations and be validated by "higher level" devices on the CCS network. ‘Devices’ includes Gaming Equipment, site controllers, third party redemption devices and/or cashier stations but excludes off-the-shelf, "non-gaming" devices such as "dumb" terminals.

1.2.32. The CCS shall support the necessary protocol levels to perform validation of “receipt tickets” and communicate with third-party redemption devices.

1.2.33. The CCS audit trail functions shall be capable of tracking system changes in a “before and after” format (i.e., what was the system setting before the change? what was the system setting after the change?). All audit trail entries shall be time and date stamped.

1.2.34. The gaming software shall be maintained under an approved software change control system.

1.2.35. Performance of the CCS shall not degrade noticeably during ordinary functionality. This includes all daily, weekly, monthly, and yearly operations and report generation.

1.2.36. Vendor shall annually review advanced technology options that may further improve the reliability and/or performance of the CCS beyond the baseline design. Examples include, but are not limited to retailer last mile connections, backbone communications, and/or gaming network to IGB communications. Vendor is encouraged to utilize a range of technologies that may advance the IGB network infrastructure while continuing to provide reliable, cost-effective service to retailers. Any changes to move to a more advanced technology will address key factors such as security, availability of the service, reliability, maintainability, openness and standardization, performance, and cost. Changes shall be approved at the sole discretion of, and in a manner determined to be in the best interest of, the State.

1.2.37. Upon expiration of a contract, Vendor at its sole expense, shall assist in the full transition of historical video gaming data, other information and all necessary processes and procedures as determined necessary by the IGB to the successor Vendor in a timely manner to ensure there is no loss of video gaming revenue and no risk to the integrity of gaming in the state of Illinois.

1.2.38. Scheduled VGT location changes shall be communicated and tracked to the IGB video licensing system and video gaming location change process.

1.2.39. Ad Hoc Consulting: As part of Vendor’s commitment to update and support the CCS to align with statutory, regulatory or Agency changes and advancements in gaming technology, Vendor shall, at no additional cost, consult for the Agency on an as needed basis. Such consulting services may include, but not necessarily be limited to, the following:

1. Providing consultation and advice to the Agency and assist the Agency in drafting rules, technical standards, and procedures regarding video gaming.

2. Provide expert testimony on behalf of the Agency as requested.

1.2.40. The primary CCS shall be hosted at a location in Illinois and approved by the Agency and always be in compliance and accordance with State Security Requirements in attachment 5.5 subsection A, B, C, E, F and any future security updates by the State. To ensure redundancy all secondary location(s) shall be located within the United States, to ensure operations down time is at or near zero and approved by the Agency

1.2.41. Vendor shall adhere to and comply with all security requirements listed under subsection A, Standard Security Requirements, in attachment 5.5.

1.2.42. Vendor shall adhere to and comply with all the requirements listed under subsection B, Minimum Logging Requirements, in attachment 5.5.

1.2.43. Vendor shall adhere to and comply with all security control requirements listed under subsection C, Security Controls for Vendors, in attachment 5.5.

1.2.44. Vendor shall adhere to and comply with all the requirements listed under subsection F - Vulnerability Assessment, in attachment 5.5.

1.2.45. Vendor shall manage day-to-day operations of the CCS. The company oversees the system’s performance, maintenance, and service throughout the state.

1.2.46. Vendor shall have and maintain capabilities to supply virtual services as part of the IT infrastructure, including virtual servers, storage, and networks, to enhance flexibility, scalability, and efficiency of IT operations.

1.2.47. Vendor shall have and maintain the capabilities to establish a comprehensive PII protection strategy covering all aspects of data handling, from administrative communications to sensitive personal records. They shall implement a multi-layered security approach, including encryption, access management, and anomaly detection, to protect against evolving cyber threats.

1.2.48. Vendor shall have and maintain the capabilities to implement strict network segmentation for PHI data, ensuring that sensitive information is isolated from general network traffic. They shall utilize advanced monitoring to detect and respond to unauthorized access attempts, ensuring the highest level of data integrity and protection.

1.2.49. Vendor shall have and maintain the capabilities to establish robust network segmentation policies for PII, minimizing risk by segregating sensitive data from the broader network. They shall apply strict access controls and monitoring to maintain security while ensuring data accessibility for authorized users.

1.2.50. Vendor shall have and maintain the capabilities to develop a comprehensive data migration strategy that ensures data integrity, minimizes downtime, and supports seamless transition between systems.

1.2.51. Vendor shall have and maintain the capabilities to create dynamic reporting and visualization tools for complex data presentation.

1.2.52. Vendor shall have and maintain the capabilities to employ an Agile development methodology for rapid, iterative product development cycles.

1.2.53. Vendor shall have and maintain the capabilities to develop robust APIs, scripts, and procedures, along with comprehensive documentation.

1.2.54. Vendor shall have and maintain the capabilities to manage content creation and migration projects with integrity and minimal disruption.

1.2.55. Vendor shall have and maintain the capabilities to provide comprehensive system and user documentation for all stakeholders.

1.2.56. Vendor shall have and maintain the capabilities to conduct comprehensive cybersecurity audits, assessing systems and processes to identify vulnerabilities and recommend corrective actions to strengthen security posture.

1.2.57. Vendor shall have and maintain the capabilities to perform detailed risk analyses, identifying potential security threats and developing strategies to mitigate these risks.

1.2.58. Vendor shall have and maintain the capabilities to manage IT inventory, tracking hardware and software assets to ensure efficient utilization and compliance.

1.2.59. Vendor shall have and maintain the capabilities to formulate a performance test plan, including load and stress testing, to evaluate the system's behavior under normal and anticipated peak load conditions.

1.2.60. Vendor shall have and maintain the capabilities to provide comprehensive test results reports for cutover/deployment, documenting testing outcomes, issues encountered, and corrective actions taken.

1.2.61. Vendor shall have and maintain the capabilities to specifically manage software licenses under support and maintenance contracts, ensuring legal compliance and operational efficiency.

1.2.62. The CCS shall hold all data related to the system and be usable for any Reporting or Audit tools.

1.2.63. The CCS provides comprehensive financial management tools to facilitate accurate tracking, reporting, and analysis of all transactions and financial activities associated with the video gaming network. This includes the ability to capture and reconcile funds entered into and disbursed from every licensed video gaming terminal, ensure proper allocation and distribution of revenue according to state regulations, and support financial auditing requirements. The system shall offer detailed financial reporting capabilities to monitor the economic health of the video gaming operations, including net terminal income, tax contributions, and operator fees. Additionally, the CCS shall enable seamless financial operations, such as the efficient transfer of funds between operators, establishments, and regulatory bodies, ensuring transparency and compliance with financial standards and legal requirements.

1.2.64. IaaS: Vendor shall have and maintain the capability to provide Infrastructure as a Service (IaaS) solutions in the public cloud, offering scalable and flexible hardware resources to support solutions IT infrastructure needs effectively.

1.2.65. Compliance with the Video Gaming Act, Illinois Administrative Rules, and Technical Requirements: Vendor shall have the capabilities to ensure all data and reporting capabilities adhere to legal and technical requirements, providing comprehensive regulatory compliance.

1.2.66. Reporting for accounting and operational aspects, terminal operator billing, and auditing: Vendor shall have and maintain the capabilities to provide comprehensive reporting features for operational, billing, and auditing purposes, facilitating thorough management of gaming activities.

1.2.67. Vendor shall, at its sole cost, design, develop, implement, operate and maintain the CCS in accordance with the VGA, the Board’s Rules, Technical Standards, and the provisions and requirements in this contract and contract. Vendor shall provide the agency with a CCS which will connect, monitor, communicate with and be able to turn on, turn off, and activate, deactivate VGTs, video games within, and associated video gaming equipment used in the video gaming industry. This system shall be capable of supporting no fewer than 120,000 VGTs and no fewer than 16,000 licensed establishments. The CCS shall include, at a minimum:

1. Primary and Secondary site(s) to house the CCS;

2. 24 hour, seven days a week, 365 days per year, online real time communication with all VGTs;

3. Perform a technology review at least every twelve (12) months during the term of the contract in order to ensure that the CCS is not antiquated or outdated.

4. Update and support the CCS to align with statutory, regulatory, or Agency changes and advancements in gaming technology;

5. Data center operations;

6. Field services support;

7. Call center support to assist and resolve issue, and how it will be accessible to Board licensees;

8. Training and support, and how it will be accessible to Board licensees;

9. Agency training and documentation shall be in accordance with standards, criteria and subject matter specified by this contract but not be limited to the following;

a. System functionality;

b. Audit capabilities;

c. Backup and disaster recovery procedures;

d. Security features;

e. Complete CCS user access;

f. Reporting;

1.2.68. The CCS shall be designed in such a way that the daily tasks of system operators including VGT data entry, enrolling, configuring, moving and deactivating VGTs is simple, efficient, and requires a minimal number of steps. The ability to select multiple terminals for each operation and the ability to intuitively copy information must be provided.

1.2.69. Vendor shall establish testing procedures for software changes and implementation to ensure continuous quality.

1.2.70. The Vendor shall provide and maintain software engineering support services for the CCS, error correction procedures, changes required due to amendments to the VGA or the Agency’s rules and requirements, a process for how game changes will be communicated to VGTs and how the CCS will activate and deactivate VGTs on demand or by program.

1.2.71. Vendor shall support releases of software batches at no less frequency than quarterly. Vendor must establish a process, timeline, and approach for installation of the quarterly batches including notification of changes to the Agency. Vendor shall also support emergency software releases and establish a process and approach for installation of emergency software releases including notification of changes to the Agency.

1.2.72. Vendor shall provide and maintain, at no additional cost, engineering support for CCS changes including application enhancements, operating system upgrades, vulnerability patches, and updates and upgrades. Vendor shall establish a process for monitoring application enhancements, operating system upgrades, vulnerability patches and updates and upgrades as well as establishing a methodology for determining whether to install or not install an enhancement, upgrade or update.

1.2.73. In fulfillment of joint responsibilities of Vendor and the Agency to request and make changes in a timely and correct manner, Vendor shall provide the Agency access to change request and tracking system.

1.2.74. Vendor shall provide and maintain a project request database management system, dedicated to the Agency, to be used by the Agency for making any type of requests including but not limited to new protocols, revoked media, system enhancements, problem resolution, research, ad hoc reports or any new management, audit or investigative reports. Vendor shall employ at least 1 employee whose sole job responsibility is to generate and respond to any and all inquiries from the IGB. This includes information, reports, queries, maintenance of the video gaming self-exclusion program list, and any other information the agency needs to meet it regulatory responsibilities. This employee shall possess no less than 2 years of project management experience. The system must also be used by Vendor’s development and/or management team to update and keep current the status on all the requests. For any rejected requests, the explanations and notes for the rejections must be provided directly by Vendor’s dedicated employee and be recorded in the system. For any open active requests, implementation estimations and status must be updated daily or ad hoc reports as requested in the system The IGB shall have access to the project request database to monitor projects in real time.

1.2.75. Vendor shall establish and maintain security policies and practices that will be used to protect the CCS against the introduction of intentional or unintentional malicious code. The policies and practices shall conform to the requirement in compliance with the State Security Requirements documented in attachment 5.5. Policy must be provided to the State prior to go-live.

1.2.76. Vendor shall utilize a Game to System (“G2S”) protocol that has the functionality to enable the Agency and Vendor to activate or deactivate VGTs from the CCS. This would include a capability for the IGB to disable VGTs through its own internal video gaming management system.

1.2.77. Vendor shall agree to and possess the ability to seamlessly convert from the use of a G2S protocol to the use of another standard industry protocol, as defined by the Gaming Standards Association, within six (6) months of written direction to convert by the Agency.

1.2.78. The CCS shall be able to communicate with and verify the signature of programs located in each VGT. The CCS shall have the functionality to autonomously disable VGT software if it does not pass the signature verification process. The CCS shall prevent the software from becoming enabled until it has successfully passed the signature verification process. Furthermore, the event shall trigger an alert on the application used by designated Agency staff and shall be logged in the database. The CCS shall be capable of generating reports by date and location of these events.

1.2.79. Vendor shall submit, prior to award, submit a formula for the reduction of payment(s) to Vendor or for Liquidated Damages for its failure to comply with agreed upon timelines, system failure, failure to assign qualified or adequate resources, failure to interface with VGTs, or failure to switch from the primary CCS to the secondary CCS as required in this contract, without compromising any other service provided above and beyond any SLA, SLRs, and Pricing in this contract.

1.2.80. The CCS shall have the functionality to turn on, turn off, enable, and disable VGT software by manufacturer, operator, software version, location, or software image and to prevent previously disabled software from becoming enabled. This functionality shall also possess the ability to disable VGTs by municipality, county, or any other designation determined by the IGB.

1.2.81. The CCS shall allow Illinois staff the ability to/ enable / disable/ turn on-off the machines and specific games directly on the machines (VGTs).

1.2.82. The CCS shall have the functionality to disable a game or games on one or more VGTs by game name or identifier or prevent the game from becoming enabled. The CCS shall be able to perform this task on a statewide, manufacturer, program or site basis.

1.2.83. Vendor shall have and maintain the ability to support Amber alert messages or other broadcast notices to be displayed on VGTs.

1.2.84. The CCS shall be capable of generating all daily, weekly, monthly, and yearly reports and invoices as well as ad hoc reports as requested by the Agency and as specified in Sections 1.2.109 to 1.2.133.

1.2.85. The CCS shall be capable of monitoring the operation of each VGT and it shall, at a minimum, be capable of creating reports and maintaining reports for the duration of this contract, the following information for each VGT and for each game where applicable:

1. The number of cents wagered;

2. The number of cents won;

3. The number of cents paid out by a printed ticket;

4. The number of cents accepted via bill;

5. The number of cents transferred to the VGT electronically, if applicable;

6. The number of cents transferred from the gaming machine electronically, if applicable;

7. The number of cents paid out via jackpot, if applicable;

8. The number of cumulative credits representing money inserted by a player;

9. The number of cents on the credit meter;

10. The number of games played;

11. The number of games won;

12. The number of times the logic area was accessed;

13. The number of times the cash door was accessed;

14. The number of games played per game theme;

15. The amount wagered per play, per game theme.

16. Reports related to Receipt Tickets, including, at a minimum:

a. Receipt Ticket Issuance Report;

b. Receipt Ticket Redemption Report;

c. Receipt Ticket Liability Report;

d. Transaction Detail Report. This report shall be available from the CCS and show all receipt tickets issued by a particular VGT and all receipt tickets redeemed at a particular payout terminal;

e. Receipt Ticket Rejection Report;

f. Expired Voucher Detail Report;

g. Undue economic concentration reporting;

h. Progressive jackpot reporting;

i. Other reports as needed.

See Sections 1.2.109 to 1.2.133 of this contract for other reporting requirements and sample reports.

1.2.86. Vendor shall be able to track and report on any or all meters in the G2S V3 protocol document or other industry standard protocol as approved by the State.

1.2.87. Vendor shall support tracking of promotions or bonusing within the system. The system shall, always, support all of the meters used to track the particular transaction. The system shall have the capability to monitor and audit the promotion itself on the system and ensure compliance with the maximum award. The system shall have the ability to audit a promotion. The system must have the ability to monitor and report suspicious activity to the IGB.

1.2.88. The CCS shall be capable of monitoring and tracking all G2S events defined in the G2S V3 protocol and all future updates. The CCS shall be capable of polling the VGTs for the event, assigning an accurate timestamp to the event and transmitting and storing it in the host database. The CCS shall be capable of generating event reports, by event(s), by terminal(s), by location(s), by operator(s), by time and date range or any combination thereof. These reports must be updated daily and available at the request of the IGB.

1.2.89. VGTs: The CCS shall be capable of supporting at least 120,000 VGTs without any noticeable loss in performance.

1.2.90. Sites: The CCS shall be capable of supporting at least 16,000 sites without any noticeable loss in performance.

1.2.91. Cashless payment systems: The Vendor shall have and maintain the ability to assist with the implementation and continued monitoring of cashless payment systems.

1.2.92. Ticket in Ticket Out (TITO): The CCS shall allow for TITO technology on a per video gaming establishment basis, including all reporting, monitoring, accounting, and tracking as required in this contract.

1.2.93. Self-Exclusion Program: The CCS shall be able to accept and process participants of the IGB voluntary self-exclusion list. The CCS shall possess the functionality to disable a VGT if an IGB voluntary self-excluded person attempts to play on a terminal after the person has scanned into a VGT his or her State issued driver’s license, State ID card, or other method designated by the IGB. The CCS shall also possess the ability to cross reference the SEP list before any payout can be initiated with third party redemption terminals (“RTs”).

1.2.94. Progressive Jackpots: Vendor shall support tracking, reporting, accounting, and monitoring of progressive jackpots and meters including those meters manufactured by a third-party. At a minimum, the system shall support all of the G2S meters used to track the particular progressive jackpot transaction. The CCS shall monitor and audit the progressive jackpot itself on a third-party system and ensure compliance with the maximum award. Please describe the ability to communicate with another third-party system and the ability to audit a progressive jackpot. The CCS shall have the ability to support tracking, reporting, accounting and monitoring of linked area progressives, standalone progressives, and wide area progressives. The CCS shall be able to remotely disable standalone and linked area progressive jackpots for any reason.

1.2.95. Vendor shall comply with all compliance requirements specified in Sections 1.2.109 to 1.2.133

1.2.96. Vendor shall ensure that all reporting requirements listed under Parts 1.2.125 through 1.2.131 will be addressed as part of the reporting solution.

1.2.97. Vendor shall meet the mandatory qualifications as identified in section 1.4 of this response document.

1.2.98. Vendor shall meet the NIST and FISMA Compliance Requirements as detailed in attachment 5.6.

1.2.99. Vendor shall provide a system that is flexible, scalable, and be tailored to the needs and requirements of the Agency. Flexibility and adaptability are critical as the gaming environment will evolve over the course of the contract.

1.2.100. Vendor must develop and establish an escalation policy and organization change management process.

1.2.101. After the notice of award, the Vendor must propose a timeline for implementing services following the Section 1.3. transition overview of the contract.

1.2.102. A detailed explanation of the methodology and plan for implementing all requested services shall be submitted to the IGB within 30 days of a notice of award.

1.2.103. The Vendor must ensure that each CCS location is secure to the satisfaction of the Agency and shall be accessible to the Agency at all times. Secure building, camera security system, redundant energy systems, fire protection system, and other physical security requirements approved by the IGB and always in compliance with the State Security Requirements documented in attachment 5.5 State Security Requirements.

1.2.104. The CCS shall provide data and reporting capabilities sufficient to meet requirements in the Video Gaming Act (230 ILCS 40), Illinois Administrative Rules (Title 11 (D) (I) 1800), Technical Standards for Video Gaming Technical Standards for Video Gaming Terminal VGTs v. 1.4 dated August 2019, and Video Gaming Terminal Operator Account Sweep Schedule (Procedures) per the IGB public website.

1.2.105. The CCS shall provide data and reporting compliance of rules, statutory and references to the following current or future Acts and Rules in the Video Gaming Act (230 ILCS 40), Illinois Administrative Rules (Title 11 (D) (I) 1800), Technical Standards for Video Gaming Terminal v.1.5 dated June 2024Technical Standards for Video Gaming Terminal v.1.5 dated June 2024, and Video Gaming Terminal Operator Account Sweep Schedule (Procedures) per the IGB public website.

1.2.106. The CCS and Vendor shall comply with SOC reporting standards, transitioning from the previously required ISO certification to align with the Illinois Auditor General’s Office preferences needed for fulfilling the requirements of the resulting contract. Upon request, vendor shall submit SOC 1, Type 2, and SOC 2 reports to the State prior to award and once per year after that upon request.

1.2.107. Access: All reports shall be available for licensees and Board staff using role-based access.

1.2.108. Formatting: All reports shall be applicable and available in detail and summary form as necessary to support licensee and Board operations. Reports shall be exportable in the following formats XML, CSV, PDF, MHTML, Excel, TIFF, Word, and Common Database Formats.

Dates: reports shall support data being searched, run, or scheduled by dates or a range of dates from the inception of the current CCS system to current.

1.2.109. The Vendor shall provide training and support to IGB staff to ensure they can effectively utilize the new system. This training shall include documentation, help desk support, and ongoing training opportunities to keep staff updated on new features or best practices.

1.2.110. The CCS shall provide reports and dashboards of critical data identified by IGB staff. Data must include (e.g., tampering, outages, resources such as receipt paper or cash being full or empty) and provide such data in a way that is actionable. These reports and dashboards shall consume and present data immediately and not on a regular basis or scheduled data refresh.

1.2.111. The Vendor shall provide integration methods and support of data and reports to Third Party and State systems, software, and solutions identified by the State for fulfilling the requirements of this contract. This could include IGB video gaming licensees or integration into the IGB’s internal case management, licensing, or other gaming internal systems or solutions.

1.2.112. Vendor shall provide reliable and functional reporting required to manage data required for comprehensive monitoring, including anti-money laundering efforts of machine and game level data.

1.2.113. The CCS shall, at a minimum, capture and organize data fields essential for fulfilling the requirements of this contract. The below data fields are examples derived from the current CCS’s architecture and functionalities. The below data fields represent the minimum fields that the CCS must provide.

Table 1: Data Fields

1.2.114. The system must, at a minimum, capture and organize the following Financial Metrics and Performance Indicators. Financial Metrics and Performance Indicators include, but are not limited to, the following:

1. Net Terminal Income (“NTI”) -- money put into a VGT minus credits paid out to players

2. Net Play — amount played less amount won by wagerer

3. Administrative Share — CCS vendor administrative fee as a percentage of NTI

4. State Share — tax imposed on NTI and collected by the Board

5. Total Bill — (by terminal operator) calculated as tax imposed on NTI plus central system administrative fee

6. Average NTI (Revenue) for Days Revenue posted by Establishments by Terminal Operator (for a range of days)

7. Total Days NTI Earned by Terminal Operator (for a range of days)

8. Average NTI by Establishment by Terminal Operator (for a range of days)

9. Total Days NTI posted for a Terminal Operator for all Establishments for a date range

10. Total number of Establishments posting NTI (for a range of days)

11. Total number of live gaming days for all Establishment by terminal operator (for a range of days)

12. NTI Per VGT Terminal Per Day by Terminal Operator (for a range of days)

13. Statewide Average NTI Per VGT Per Day (for a range of days) Total Days NTI Earned by Each Establishment (for a range of days)

14. Total NTI revenue Earned for Each Establishment (for a range of days)

15. Average NTI per Establishment Per Day (for a range of days)

16. Average NTI per VGT per Day

17. Average Total Days of NTI revenue for each Establishment (for a range of days)

18. Average Establishment NTI Per Day (for a range of days)

19. Average Net Revenue per VGT per Day for each Establishment (for a range of days)

20. Summations/Counts

21. VGT Device

22. Establishment Count

23. Voucher Count

24. Total Days NTI Revenue Posted

25. Date First NTI Revenue Observed

26. Total Days NTI revenue.

1.2.115. The system shall provide reports required to fulfill by the State. The vendor shall provide appropriate calculations and reporting on video gaming activity at the individual game, game set level, VGT, establishment, and terminal operator level. Specific reporting scenarios are provided below:

1. Video gaming accounting and transaction activity

2. Game performance data and statistics

3. VGT, meter and event activity and monitoring, including non-reporting terminals information

4. All voucher activity, including Voucher Liability and Expired Vouchers reporting as outlined in 1800.110 and 1800.1410 (e) of the Administrative Rules

5. Meter adjustment reporting, including hard meter and soft meter adjustments

6. Undue Economic Concentration reporting as required in 230 ILCS 40/25(i) of the VGA and 1800.440 of the Administrative Rules

7. Progressive Jackpot Reporting as outlined 230 ILCS 40/20 and 1800.2010-2160 of the Administrative Rules

8. Other reports that are required over the duration of the contract.

1.2.116. Terminal Operator Billing Reports - the Vendor must provide appropriate summary terminal operator billing information at the establishment and terminal operator level. Specific billing report must at a minimum include the following:

1. Total NTI

2. State share of tax imposed on NTI

3. CCS vendor administrative fee

4. Billing adjustments

5. Total terminal operator billing, including file of EFT activity

6. Local government tax allocation and distribution reporting as required by 230 ILCS 40/60 and 230 ILCS 40/75 of the VGA and any other rule or statute. Reporting must include both detail and summary reports and a file extract that can be used in file transmission

7. Any other reports as necessitated by statute or rule.

1.2.117. Auditing Reports: The Vendor shall provide appropriate summary reporting at the VGT, meter, game and game set level. Example scenarios:

1. User activity

2. Inventory reporting, including hardware and software

1.2.118. Expired Vouchers Reporting: The CCS must maintain the capability to accurately track, report, and account for expired vouchers.

1.2.119. Policy and Procedural Resolutions: The Vendor must have and maintain the capacity to address the handling and reconciliation of facility pay voucher issues, acknowledging the technological limitations of some RTs.

1.2.120. The Vendor must be able to develop, implement, and…