State of Maine RFP# 202512163 IT-RFP Rev. 8/3/2026 – DAFS/Office of State Procurement Services

STATE OF MAINE

Department of Administrative and Financial Services

Bureau of Alcoholic Beverages and Lottery Operations

RFP# 202512163

Lottery Gaming System and Instant Ticket Printing

RFP Coordinator NAME: Kevin Gagnon TITLE: Lottery Field Supervisor EMAIL: LotteryRFP.BABLO@maine.gov

Submitted Questions Round 1 Due Date

October 16, 2026, no later than 4:00 p.m., local time

Submitted Questions Round 2 Due Date

November 13, 2026, no later than 4:00 p.m., local time

Proposal Submission Deadline

DATE: December 18, 2026, no later than 4:00 p.m., local time

TO: Vendor Self Service System

Physical Submission Deadline (Retailer Terminals)

DATE: February 1, 2027, no later than 4:00 p.m., local time

TO:

Maine State Lottery 19 Union Street, 3rd floor Augusta, ME 04330 https://www.maine.gov/dafs/bbm/procurementservices/vendors/vendor-self-service-system

TABLE OF CONTENTS

PUBLIC NOTICE 4

RFP DEFINITIONS/ACRONYMS 5

PART I INTRODUCTION 11

A. PURPOSE AND BACKGROUND

B. GENERAL PROVISIONS

C. ELIGIBILITY TO SUBMIT BIDS

D. CONTRACT TERM

E. NUMBER OF AWARDS

PART II SCOPE OF SERVICES TO BE PROVIDED 15

PART III KEY RFP EVENTS 92

A. VENDOR SELF SERVICE SYSTEM (VSS)

B. QUESTIONS

C. AMENDMENTS

D. PROPOSAL SUBMISSION

PART IV PROPOSAL SUBMISSION REQUIREMENTS 95

PART V PROPOSAL EVALUATION AND SELECTION 99

A. EVALUATION PROCESS – GENERAL INFORMATION

B. SCORING WEIGHTS AND PROCESS

C. NEGOTIATIONS

D. SELECTION AND AWARD

E. APPEAL OF CONTRACT AWARDS

PART VI CONTRACT ADMINISTRATION AND CONDITIONS 101

A. CONTRACT DOCUMENT

B. STANDARD STATE CONTRACT PROVISIONS

PART VII RFP APPENDICES AND RELATED DOCUMENTS 103

APPENDIX A – PROPOSAL COVER PAGE

APPENDIX B – RESPONSIBLE BIDDER CERTIFICATION

APPENDIX C – BIDDER CORPORATE CAPABILITY FORM

APPENDIX D – SUBCONTRACTORS FORM

APPENDIX E – TECHNICAL ASSESSMENT FORM

APPENDIX F – COST PROPOSAL FORM

APPENDIX G – DEMONSTRABILITY OF SYSTEM

APPENDIX H – MANAGEMENT AND ADMINISTRATIVE REPORTS

APPENDIX I – RETAILER TERMINAL REPORTS

APPENDIX J – LOTTERY SALES HISTORY

APPENDIX K – SAMPLE INSTANT TICKETS

APPENDIX L – INSTANT TICKET BAR CODES

APPENDIX M – LOYALTY PROGRAM DESCRIPTION

APPENDIX N – DRAW GAME MATRIX

APPENDIX O – INSTANT TICKET ORDER QUANTITY

APPENDIX P – INSTANT TICKET CUSTOMER SPECIFICATIONS

APPENDIX Q – INSTANT TICKET WORKING PAPERS

APPENDIX R – FAST PLAY GAME INFORMATION

APPENDIX S – TERMS AND CONDITIONS

APPENDIX T – BIDDER RESPONSE FORM

APPENDIX U – INVITED AND OFFERED OPTIONS

PUBLIC NOTICE

State of Maine Department of Administrative and Financial Services

The State of Maine is seeking proposals for the implementation of a Lottery Gaming System (“System”) including associated hardware, gaming products, communications network, marketing, sales, Retailer and support services and instant ticket printing, warehousing, and distribution.

A copy of the RFP and all related documents can be obtained through Vendor Self Service (VSS):

https://mevss.hostams.com/PRDVSS1X1/AltSelfService

This RFP includes both electronic and physical proposal submission requirements. Electronic proposals must be submitted to the Office of State Procurement Services, via Vendor Self Service (VSS) and be received no later than 4:00 p.m., local time, on December 18, 2026. Proposals will be opened the following business day. Physical proposal submissions (retailer terminals) must be delivered to Maine State Lottery, 19 Union Street, 3rd floor, Augusta, ME 04330 no later than 4:00 p.m. local time, on February 1, 2027.

https://mevss.hostams.com/PRDVSS1X1/AltSelfService

RFP TERMS/ACRONYMS with DEFINITIONS

The following terms and acronyms, as referenced in the RFP, have the meanings indicated below:

Term/Acronym Definition

Availability Ensures that information, systems, and services are operational and accessible when needed by authorized users, even under stress, attack, or failure conditions.

Awarded Bidder The Bidder with whom the Lottery executes a contract pursuant to this

RFP.

Baseline The System, including all features and capabilities for an offered price, without additional pricing for options.

BI Business Intelligence Bidder The entity submitting a Proposal in response to this RFP.

Bond A bond, cashier’s check, or alternative security in form and substance and issued by a company acceptable to the Lottery.

Business Day A working day occurring Monday through Friday except legal holidays observed by the State of Maine.

Business Week or Accounting Week

The period begins at start of day on Sunday and running through the end of the day the following Saturday. This is also known as the accounting week.

Capability A feature or capacity of the System as offered for delivery within the System baseline, not to include items that are theoretical or available following a future separate development or purchase effort. Also referred to in the RFP in terms such as “ability,” “able to,” and “capacity.”

Confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting confidential or sensitive information. A loss of confidentiality is the unauthorized disclosure of information.

Consumables Play slips, ticket stock, printer paper, and any other operational supplies required by Retailers to operate their terminals. The term "Consumables" does not include point of sale promotional items or instant tickets.

Contract

The written agreement resulting from the successful proposal and subsequent negotiations, which shall incorporate, among other things, this RFP and the awarded Bidder’s Proposal, and all modifications hereto and thereto, and in addition shall contain such other terms and conditions as may be required by the Lottery.

Contract Manager A member of the Lottery’s technical management staff, designated by the Lottery Executive Director, who will provide oversight for the deliverables and performance of the Contract on a day-to-day basis.

Conversion The phase of the implementation project during which the existing System used by the Lottery for games sales and management is replaced. During the conversion, data and files from the existing System must be transferred, for continuity, to the new System.

Corporate Account Lottery Retailer accounts with a minimum of four (4) or more distinct Maine Lottery retail locations.

CSV File A file with records whose data fields are delimited by commas (Comma- Separated Values), and each record is a separate input line.

Data Classification The process of risk assessment of data. See Appendix E for the Data Classification process (see also “PII Confidentiality Impact Level”).

Day A calendar day unless otherwise stated as a business day.

Deliverable A defined product or feature required by the RFP and/or proposed by the awarded Bidder.

Department Department of Administrative and Financial Services, Bureau of Alcoholic Beverages and Lottery Operations.

Draw and Fast Play Games

Games sold through a computer network at Retailer locations. The tickets are generated on demand of the customer.

Eastern Time Eastern Standard or Eastern Daylight time, as applicable.

EFT Electronic Funds Transfer through a bank employing the Automated Clearing House (ACH) network.

Facilities The facilities required to provide and support Lottery Retailer operations, including data centers, warehouses, repair depots, and any other such locations.

FCC Federal Communications Commission

File

A related collection of records containing a consistent set of data fields that describe an entity. A file can be processed by software representing an authorized user to add, modify, or delete records, or to generate a report or display of useful information. A file can be operated on as an object itself, for example to move it from one location to another, or to delete it.

First Read Rate

A measure of reader performance. The measure indicates what proportion of times the reader returns a successful read of a legitimate code on the first try. The "first read" event is defined as the initial effort of an experienced user to read a ticket or document, occurring within approximately a two (2) second time window.

Hash Total of Plays

The hash total of plays is a security measure used to ensure the integrity and randomness of the lottery drawings It involves creating a unique numeric value that represents the combined data of all the plays made for a particular drawing. It can be used later to verify that the winning numbers were drawn fairly and without manipulation. It can also be used to validate plays and winners.

Instant Games Pre-printed tickets containing play and validation data under a coating as may be approved by the Lottery. Instant games will be administered through the terminals and workstations provided by the awarded Bidder.

Integrity Ensure that information, software, and systems are accurate, consistent, and trustworthy - protected from unauthorized modification, deletion, or corruption.

Intellectual Property Rights

Any rights with respect to inventions, discoveries, or improvements, including patents, patent applications and certificates of invention; trade secrets, know-how, or similar rights; the protection of works of authorship or expression, including copyrights and future copyrights;

and trademarks, service marks, logos, and trade dress; and similar rights under any laws or international conventions throughout the world, including the right to apply for registrations, certificates, or renewals with respect thereto, and the rights to prosecute, enforce and obtain damages.

Intermediate Company An intermediate company is one that is owned by a larger company but the intermediate also has subsidiary companies.

ISO 9000

A series of standards for manufacturing and service quality promulgated by the International Standards Organization. Organizations can be independently certified by ISO standards.

ISO 27001 A best practices information security standard from the International Standards Organization. ISO 27001 replaces ISO 17999.

Lottery The Maine Lottery Lottery Executive Director

The Executive Director of the Lottery, or an employee authorized to act on behalf of the Lottery Executive Director.

Lottery LAN A local area network (LAN) serving the offices of the Maine Lottery.

LSR Sales Representative of the Lottery.

Major Part Major Part is a large part of any system and services contract, which without that part the success of the contract would diminish.

Major System Element

A component that supports the functions of the System on a mission critical basis. Lacking a major element, delivery of the System would be impractical or severely compromised. Examples include, but are not limited to, Retailer terminals, games management software, accounting reports, and communications for the Retailer network.

Minor A person who has not attained the age of 18 years.

MUSL Multi-State Lottery Association.

MUSL Rule 2 A series of security and control standards obligatory for MUSL association states. MUSL conducts audits to ensure compliance.

NASPL North American Association of State and Provincial Lotteries

NIST

National Institute of Standards and Technology. Publisher of NIST Cyber Security Framework (CSF) and NIST 800-53 Rev5, Security and Privacy Controls for Information Systems and Organizations.

Net Game Pool The net game pool refers to the total amount of money accumulated from the sale of lottery tickets or entries after subtracting prizes and operating expenses.

Net Instant Sales Gross sales minus free tickets and adjustments for instant games.

Net Draw Game Sales Gross sales minus cancellations, promotional free tickets and adjustments for draw games.

Network The communications technology that connects Retailers to the gaming system for processing transactions, or as more narrowly identified in the

RFP.

OIT Office of Information Technology, State of Maine

Option(s)

A system feature or capability for which the Lottery makes no schedule or quantity commitments, but which may, at the Lottery's sole discretion, be included in or added to the System. Invited Options are identified by the Lottery as of interest but may be proposed at the discretion of the Bidder. Offered Options may be proposed at the discretion of the Bidder. Options may have additional cost quoted or may be included in the baseline price.

OSHA Occupational Safety and Health Administration

Pack A bundle of instant game tickets, with individual tickets uniquely numbered by virtue of game/pack/ticket identifiers. Packs contain varying numbers of tickets, depending on the game.

PCI Peripheral Connect Interface, a standard for attaching peripheral control cards to a motherboard in a personal computer.

Person An individual, a partnership, a joint venture, a registered limited liability partnership, an association, a corporation, a limited liability company, a trust, an unincorporated organization or any other entity, business or enterprise, authorized to do business in the State of Maine.

PII (Personally Identifiable Information)

Data that is maintained by an agency that could potentially identify a specific individual and needs to be protected in accordance with state and/or federal law, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

PII Confidentiality Impact Level

The PII confidentiality impact level—low, moderate, or high—indicates the potential harm that could result to the subject individuals and/or the organization if PII were inappropriately accessed, used, or disclosed.

(NIST SP 800-122). See Appendix E. PII is evaluated to determine its confidentiality impact levels, so that appropriate safeguards can be applied to the PII.

Play A single set of numbers for a Lottery drawing. A ticket may contain multiple plays, depending on the game.

POS Point of Sale

Proposal All materials submitted by a Bidder in response to this RFP, together with all addenda, clarifications, and demonstrations.

Report Information produced by the System that is viewed via display, printed, or saved to a file depending on the needs of the Lottery.

Responsible Bidder A Bidder judged by the Lottery to have the capability in all respects to perform fully the Contract requirements and to have the integrity, security, reliability, and financial condition that will ensure good faith performance.

Responsive Proposal Timely and conforming in all material aspects to stipulations of the RFP.

Retailer A business under contract with the Lottery to sell tickets.

Retailer Master File The authority file containing the official list and data defining Retailers.

RFID

Radio Frequency Identification, a unique tagging technology to identify objects, in which the object responds to an inquiry radio signal from a reader by broadcasting its identification tag value.

RFP Request for Proposals

RS-232 A common standard for attaching peripherals to an information technology device such as a personal computer

Sales Day The period of time the Lottery's gaming systems support transactions from terminals at Retailer locations, currently 12:15 in the morning to midnight, seven (7) days a week, subject to future change.

SST Self-Service Vending Terminal State State of Maine and its departments, officers, and employees.

State Data

Any information originating with the State, regardless of form or medium of disclosure (e.g., verbal, observed, hard copy, or electronic) or source of information. It includes any information concerning the State’s information technology infrastructure, systems and software and procedures; and information originating with the State in the course of using and configuring the Services provided under the contract. It includes any sensitive information held by the State that may be protected from disclosure pursuant to a federal or state statutory or regulatory scheme intended to protect that information, or pursuant to an order, resolution or determination of a court or administrative board or other administrative body.

Subcontractor For purposes of this RFP, where creating obligations or bearing restrictions, the term "subcontractor" refers to a firm retained by the Bidder to provide a contribution to the completion of the project.

Substantial Subcontractor

A subcontractor performing major and critical activities specific to and customized for the Contract, including hardware development, production or support, software development, production, or support, and Retailer servicing. This does not include purchase of consumer-tariffed communication services, suppliers of “off the shelf” (available to the general public) hardware, or suppliers of “off the shelf” software when those firms perform only these roles under the Contract. This does not include routine service providers such as landscapers or janitorial firms.

System

The entire infrastructure outlined in this RFP, including the hardware, software, databases, facilities, products, programs, and procedural elements that provides useful services and produces useful outputs associated to the delivery of this contract. In this RFP there are numerous references to systems, inclusive of references to systems that are subsystems of other referenced systems. The immediate context and adjectives or labels define which system is being discussed. When used without other qualification, "System" refers to the comprehensive gaming system (instant ticket and online system) proposed by the Bidder.

Tri-State The lottery association encompassing Maine, New Hampshire, and Vermont.

UAT User Acceptance Testing UL Underwriters Lab

Unsuccessful Bidder A Bidder who submitted a proposal to the Lottery but did not obtain a contract pursuant to this RFP.

USB Universal Serial Bus, a standard for interfacing to an information technology device.

Validation Process by which winning tickets are checked against computer files, to ensure that the ticket presented is valid, and that it has not been redeemed previously. Validations apply to both draw and instant tickets.

Validation Code A security feature of instant tickets printed under the latex (or other coating). Also known as a VIRN (Void If Removed Number).

Vendor A firm with whom the Lottery may execute or already has executed a contract pursuant to this RFP. A firm that has capabilities the Lottery is seeking.

Vendor Self Service System (VSS)

The Vendor Self Service System (VSS) web portal provides vendors with a single-entry point to register, identify the commodities/services that their company provides, look for business opportunities, and respond to solicitations.

XML

Extensible Markup Language, a standard for encoding documents and serializing data for interchange between information technology systems.

State of Maine Department of Administrative and Financial Services

Bureau of Alcoholic Beverages and Lottery Operations

PART I INTRODUCTION

A. Purpose and Background

The Department of Administrative and Financial Services, Bureau of Alcoholic Beverages and Lottery Operations (“Maine State Lottery,” “Maine Lottery,” "Lottery") is issuing this Request for Proposals (“RFP”) to invite interested Bidders to submit Proposals for the implementation of a Lottery Gaming System (“System”) including associated hardware, gaming products, communications network, marketing, sales, Retailer and support services and instant ticket printing, warehousing and distribution. This document provides instructions for submitting proposals, the procedure and criteria by which the awarded Bidder will be selected, and the contractual terms which will govern the relationship between the State of Maine (State) and the Awarded Bidder.

In the RFP, the Lottery has defined objectives, requirements, and a proposal evaluation approach that are designed to select the bidder best meeting its interests in conformance with Lottery policies and Maine Statutes.

An existing base of approximately one thousand two hundred (1,200) Retailer terminals, together with all related computer and network hardware, software, and support services, must be replaced through this RFP. All proposed System hardware, software, facilities, programs, staffing, and operations necessary for optimal, secure, and responsible daily game deliveries, sales, validation, and tracking and overall operations of the Lottery must be delivered, installed, implemented, through Lottery acceptance testing, and be ready to be operational by the agreed-upon schedule. Additional deliverables as defined in the following must also adhere to delivery timelines as defined.

The new System must be capable of supporting the current gaming products and programs offered to the public by the Lottery. Also, the Awarded Bidder must be able to incorporate additional games, software, programs, communications, hardware, controls, and promotions into the System to support the evolving needs of Lottery stakeholders including Retailers, players, partners, and the State. The System must also support the needs associated with the Lottery’s participation in the Tri-State Lotto Commission with New Hampshire Lottery and Vermont Lottery, the Lottery’s participation in the Multi- State Lottery (MUSL) and plans and commitments made locally, regionally, and nationally with independent and corporate retail accounts and other partners.

Lottery Objectives

The Lottery has the following objectives for issuing this RFP and entering into a Contract for the implementation and operation of a System that, throughout the life of the contract:

• Delivers the capabilities, capacity, scalability, and flexibility necessary for the Lottery to securely and responsibly maximize net revenue for the State of Maine.

• Incorporates operationally sound Retailer capabilities, including plans, programs, communications, promotions, merchandising, terminals, and services, aligned with the needs and make-up of Maine’s retail landscape, are operationally sound, and support the delivery of responsible, efficient, and sustainable growth.

• Includes Draw Game, Fast Play and Instant Ticket planning, products, programs, distribution and support that responsibly maximizes current and future player and Retailer appeal and satisfaction while optimizing operational efficiency and revenue growth.

• Ensures the Conversion of the existing System, including all associated capabilities, with minimum player, Retailer, and State disruption.

• Features comprehensive privacy and security capabilities in compliance with local, state, Tri- State, Multi State Lottery Association (MUSL), and federal legislation and regulation, in align with lottery best practices and reflective of lottery, games, player, and Retailer practices and preferences.

• Offers leadership and proven capabilities and programs necessary to meet the demands of a digital economy, including data strategy and business intelligence, expansive digital tools, and new game and program concepts.

• Is capable of responsible gaming expansion as the Legislature allows and market demands support.

B. General Provisions

1. From the time the RFP is issued until award notification is made, all contact with the State regarding the RFP must be made through the RFP Coordinator. No other person/ State employee is empowered to make binding statements regarding the RFP. Violation of this provision may lead to disqualification from the bidding process, at the State’s discretion.

2. Issuance of the RFP does not commit the Department to issue an award or to pay expenses incurred by a Bidder in the preparation of a response to the RFP. This includes attendance at personal interviews or other meetings and software or system demonstrations, where applicable.

3. All proposals must adhere to the instructions and format requirements outlined in the RFP and all written supplements and amendments (such as the Summary of Questions and Answers), issued by the Department. Proposals must follow the format and respond to all questions and instructions specified below in the “Proposal Submission Requirements” section of the RFP.

4. Bidders will take careful note that in evaluating a proposal submitted in response to the RFP, the Department will consider materials provided in the proposal, information obtained through interviews/presentations (if any), and internal Departmental information of previous contract history with the Bidder (if any). The Department also reserves the right to consider other reliable references and publicly available information in evaluating a Bidder’s experience and capabilities.

5. The proposal must be signed by a person authorized to legally bind the Bidder and must contain a statement that the proposal and the pricing contained therein will remain valid and binding for a period of 180 days from the date and time of the bid opening.

6. The RFP and the awarded Bidder’s proposal, including all appendices or attachments, will be the basis for the final contract, as determined by the Department.

7. Following announcement of an award decision, all records and documents regarding this RFP, including bid submissions, will be public records, available for public inspection pursuant to 5 M.R.S. §1825 B (6 &15) and the State of Maine Freedom of Access Act (FOAA) (1 M.R.S. § 401 et seq.). State contracts and information related to contracts, including all records, documents, supporting documents, and bid submissions, are public records unless otherwise https://www.mainelegislature.org/legis/statutes/5/title5sec1825-B.html https://www.mainelegislature.org/legis/statutes/5/title5sec1825-B.html http://www.mainelegislature.org/legis/statutes/1/title1sec401.html http://www.mainelegislature.org/legis/statutes/1/title1sec401.html excepted by statute (Id).

8. Subject to the above and pursuant to applicable law, in the event that a Bidder believes any information that it submits in response to this RFP is confidential, it must mark that information accordingly, and include citation to legal authority in support of the Bidder’s claim of confidentiality. In the event that the Department receives a FOAA request that includes submissions marked as confidential, the Department shall evaluate the information and any legal authority from the Bidder to determine whether the information is an exception to FOAA’s definition of public record. If the Department determines to release information that a Bidder has marked confidential, it shall provide advance notice to the Bidder to allow for them to seek legal relief.

9. The Department, at its sole discretion, reserves the right to recognize and waive minor informalities and irregularities found in proposals received in response to the RFP.

10. ACCESSIBILITY: All IT applications are required to comply with the Digital Accessibility Policy.

In addition, all IT applications and content delivered through web browsers are required to comply with the State Web Standards.

11. STATE IT POLICIES: All IT products and services delivered as part of this Agreement shall conform to the State IT policies, standards, and procedures effective at the time this RFP is published.

12. If awarded a contract resulting from this RFP, vendors shall be required to disclose, in writing and in accordance with applicable Maine law, any actual or potential conflicts of interest. Such disclosure must include any financial, professional, or personal relationships that could give rise to a conflict of interest or the appearance of a conflict of interest. Failure to disclose a known conflict or appearance of conflict may result in disqualification, contract termination, or other remedies as provided by law.

13. All applicable laws, whether or not herein contained, are included by this reference. It is the Bidder’s responsibility to determine the applicability and requirements of any such laws and to abide by them.

C. Eligibility to Submit Bids

Any Bidder submitting a Proposal must have one (1) or more current NASPL clients to whom it has supplied a Lottery Gaming System, including central systems, Retailer terminals, Retailer network, and operations services. The System must support both instant and draw games.

D. Contract Term

The Department is seeking cost-efficient proposals to provide services, as defined in this RFP, for the anticipated contract period defined in the table below. The dates below are estimated and may be adjusted, as necessary, in order to comply with all procedural requirements associated with the RFP and the contracting process. The actual contract start date will be established by a completed and approved contract.

Contract Renewal: Following the initial term of the contract, the Department may opt to renew the contract (in whole or in part) for three (3) two-year (2) renewal periods, as shown in the table below, and subject to continued availability of funding and satisfactory performance.

The term of the anticipated contract, resulting from the RFP, is defined as follows:

Period Start Date End Date

Initial Period of Performance July 1, 2028 June 30, 2038 https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/DigitalAccessibilityPolicy.pdf https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/WebStandards.pdf https://www.maine.gov/oit/policies-standards

Renewal Period #1 July 1, 2038 June 30, 2040 Renewal Period #2 July 1, 2040 June 30, 2042 Renewal Period #3 July 1, 2042 June 30, 2044

E. Number of Awards

The Department anticipates making one (1) award as a result of this RFP process.

PART II SCOPE OF SERVICES TO BE PROVIDED

A. Introduction

This section describes the systems and services specifications for the Lottery Gaming System, Software, Programs and Services (the “System”).

1. Overview of System. The proposed system must be fully deployed for a NASPL customer.

2. Flexibility of the System. The System must be flexible, scalable, and customized to suit the business needs and rules of the Maine Lottery. Flexibility and adaptability are critical as the gaming environment can be expected to evolve over the course of the Contract due to changes in technology.

3. Hardware and Software Installations, Modifications and Updates. The Awarded Bidder, at no cost to the Lottery, shall maintain stable and secure central gaming system software/application, keeping current with software upgrades, patches, and security vulnerability updates.

4. Vendor Facilities. All vendor facilities are required to be fully built out according to lottery specifications, including but not limited to, interior finishing, office furnishings, carpeting, plumbing, lighting, electrical service, networking and privileged terminals. The facilities must be provided at no cost to the Lottery.

5. Certified Equipment. The proposed equipment must be inspected for safety and approved by a reputable testing laboratory. All proposed equipment must comply with FCC regulations suitable for devices of the types proposed. Alternatively, if the devices proposed are new models and not yet inspected and/or certified, Bidders must commit to providing (and the Awarded Bidder must provide) a document showing certification as of the Contract signing.

6. New and Unused Equipment. All proposed transaction processing computers, front-end processors, networking equipment, Retailer terminals, diagnostic equipment, etc. must be new and unused and fully skinned as per Lottery marketing requirements. The equipment proposed must be compliant with current electronic technology manufacturing standards and be of current manufacture by the Awarded Bidder or their suppliers. All hardware models and software versions installed at start-up must represent the then-current equivalent or better version if a proposed offering has been phased out or superseded, or if a proposed product has been upgraded to a new model at an equivalent or better price.

7. OSHA Standards. All products offered for purchase and installation at the Lottery shall meet all OSHA safety standards as required.

8. Readiness for Manufacture and Delivery. All proposed items that are required to be operational on the contract start date must be ready for delivery at proposal submission time.

The Lottery acknowledges and accepts that items that are not due on the contract start date, and that are subject to cooperative development and further negotiations with the Lottery, may not be manufactured or ready for delivery at proposal submission time.

9. Technical Assessment. The State of Maine requires Bidders to demonstrate that they (and the products proposed by them) have the appropriate Architecture and Security controls to protect the State’s information assets and meet all appropriate compliance mandates. A Technical Assessment form is included in Appendix E of this RFP. Bidders should pay particular attention to the requirements in any section’s heading appearing in blue font when completing the Technical Assessment form.

a. As part of the Technical Assessment process, Bidders are to submit architectural diagrams and full SOC 2 Type 2 audit results for all IT products described in the proposal.

b. Additionally, the selected ICS provider must successfully complete the Technical Assessment process at the time of contract negotiations resulting from a conditional award made under this RFP.

B. Invited and Offered Options

1. An Invited Option, as noted in this RFP, is identified as being of specific interest to the

Lottery, although the Lottery makes no commitment to any quantity or timing for the acquisition. Bidders are not obligated to include any Invited Options in the Proposal. If proposed, Invited Options may be detailed in the Bidder’s Appendix T (Bidder Response Form) response and prices may be provided in Appendix U (Invited and Offered Options), Table 1. Bidders shall identify a timeline of availability for each option to the Lottery.

2. An Offered Option is not identified in this RFP but may be identified by the Bidder and included in the Proposal. This is an opportunity for Bidders to offer options that the Lottery may not have been aware of at the time the RFP was written. Bidders may describe and provide pricing for offered options in Table 2 of Appendix U (Invited and Offered Options). These options will not be scored as part of this RFP. The Lottery makes no commitment to quantity or timing or acquisition of Offered Options.

C. Central Configuration The Lottery requires a configuration capable of handling the immediate and long-term needs of the Lottery that has been in operation for at least one (1) NASPL customer, as defined in the following sections.

1. Gaming Configuration at the Primary Site

a. Mission Critical Servers. At the primary site, the processing complex must consist of at least two (2) separate systems, networked or coupled for high availability processing and storage redundancy. The Lottery’s preference is for an active/active solution. At the primary site, each critical system shall have a live backup ready to take over within thirty (30) to sixty (60) seconds after a failure of the primary has occurred. A single failure shall not trigger failures within the sub-systems.

b. Takeover. Backup systems within the primary site must be able to perform a takeover and become active. The Awarded Bidder’s solution must ensure this occurs without loss or corruption of data or degradation of security controls while ensuring transactions are received prior to the time of the failure. The Lottery will accept zero (0) data loss during these failures. Takeovers shall occur automatically without intervention from the Lottery or the Awarded Bidder’s staff members.

c. Operations Procedures. Procedures for computer operations staff, especially regarding failure situations, must be straightforward and highly effective. In the event of operator-prompted failover, the System must be able to recover from failures without operator intervention (“auto-failover”).

d. Secure Connections. There must be no capacity to logically or physically connect to any gaming system from a remote non-Retailer terminal without Lottery approval. Any such capability, such as for remote monitoring or diagnosis of equipment or software, must employ security controls compliant with the policies and procedures identified in Part II, Section T (Technical Requirements) of this RFP. Connections to other remote systems and terminals must be protected by appropriate network and system security capabilities to include, but not limited to next generation firewalls, data and transmission encryption, and robust identity and authentication access controls. Any routers must route traffic only to addresses defined in their routing tables as valid. The acceptability of any such security approach will be subject to Lottery approval.

e. Time Synchronizing. Multiple systems in the configuration must have a time-synchronizing mechanism to ensure consistent time recording and reporting for events and transactions. Synchronization with an external time standard is required.

f. Location. The primary site must be located in the continental United States. The Lottery is open to secure cloud-based solutions; however, locations must meet all applicable MUSL, WLA and Maine Lottery security standards.

g. Resources. All operational staff, including field service, operations, warehousing, ticket distribution and tel-sell, must reside within the State of Maine.

h. Disaster Recovery. In the event of irreparable damage at the primary site, or of an unplanned, extended abandonment of the primary site, the Awarded Bidder shall provide at no additional cost the host processors, facilities, and other components necessary to resume Lottery sales under a two-site operational scenario. Such host processors, facilities, and other components shall be furnished, installed and operational within thirty

(30) days after the disaster. Until a permanent primary site can be re-established, substitute facilities must meet Lottery-approved environmental and security measures. The Lottery will accept zero (0) data loss during these failures.

2. Remote Backup Site Configuration

a. Remote Backup System. The remote backup systems must be of the same processing capacity, configuration, storage capacity and architecture as the primary data center systems. It must be located in a geographical location distinct from the primary site. The Awarded Bidder’s solution shall incorporate the following failover features.

i. Two types of failover must be supported:

(1) An automatic failover feature where if the primary location is lost and no communication is received within thirty (30) to sixty (60) seconds, the backup system shall automatically takeover primary functions and begin to communicate to remote locations. This solution shall be capable of full takeover and system restoration within thirty (30) minutes. The Bidder’s solution shall be fault tolerant similar to the primary system.

(2) The solution shall be capable of failover during upgrades, maintenance, and issue repair times. This type of failover shall be available to allow the Lottery to test and validate the operation of the failover and ensuring the systems are fully functional and meeting all contractual obligations. The manual failover shall be available and ready to validate at the Lottery’s convenience. This shall occur two (2) to four (4) times per year.

ii. The Awarded Bidder’s solution must include redundant equipment along with identical installations at both a primary and geographically diverse backup data center, which allows for independent operations from either data center.

iii. The Awarded Bidder’s solution must include data storage redundancy solutions along with data protection strategies at the backup data centers.

iv. The Awarded Bidder’s solution must include a plan to facilitate auditing of data centers, servers, associated equipment and their policies to industry best practice certification standards. Regarding Secure Connections, these systems have the same specification as the primary site systems, given in PART II, Section C 1 d (Secure Connections) and the response may reference that section, if identical.

v. Bidders must be prepared to explain and demonstrate, during a site visit, a system failover that meets all requirements.

b. Remote Backup Location. The remote backup systems and their facility may be located at the Bidder’s discretion, though not in proximity to the primary site.

c. Central System Monitoring. The Awarded Bidder’s solution shall have the capability to continuously monitor each piece of equipment within both primary and backup sites. This includes, but is not limited to, transaction servers, data storage environments, administrative services, and network devices such as routers, switches, and firewalls. The Awarded Bidder shall be responsible for reporting equipment failures to the Lottery and remediating these issues, based on criticality of the failure and within the time period, as identified with the SLAs.

d. Operations Procedures. The Awarded Bidder shall include operational procedures and processes for the computer operations staff. These procedures shall be easy to locate and cover each aspect of the central system in an easy to follow, step-by-step format.

A takeover process within the primary system shall be automatic with an alert generated.

The procedures must define the alert and the steps needed to address such an issue.

e. Disaster Recovery Plan. The Awarded Bidder shall commit to working with the Lottery to construct an annual disaster recovery (DR) plan in conjunction with the Lottery’s business continuity plan. This plan shall be used to execute against when testing various disaster recovery scenarios from the smallest to largest of scale.

3. Testing and Development Configuration The Awarded Bidder must provide and fully support the following development and test systems to be used exclusively for the Maine Lottery: Development, QA (Quality Assurance), and UAT (User Acceptance Testing). The UAT system will be used only by the Lottery for testing. The Lottery will work with the Awarded Bidder to identify and assess any possible risks or impacts on production operations.

a. User Acceptance Test System. The Awarded Bidder must provide a system for user acceptance testing by the Lottery. The User Acceptance Testing (UAT) system must be located at the primary operational site for Lottery use, with access from Lottery designated sites. Components of the testing system must be identical in architecture and security to the production systems and must include a database as well as transaction processing components, as does live production. The test system is intended for use only by the Lottery and will not be used by the Awarded Bidder as a development environment. In the event of multiple failures of active production systems, components of the test system must be able to be updated and activated for production in case of further hardware or software failure.

b. User Acceptance Test Retail Terminals. At least three (3) of each type of Retailer terminal configurations deployed, including all communications mechanisms, must be permanently installed at the Lottery designated testing area and operational at all times. At times the Lottery may require the installation of more terminals for specialized tests. All these terminals will be supplied within the base System price. The testing terminals must support testing of all features and options available on the production System, thus the test terminals must be configured in all logical configurations (e.g., Retailer, privileged Retailer) with all peripherals that represent configurations at Retailer locations. The Awarded Bidder must provide and support connectivity for at least two (2) management terminals and a printer for testing. The management terminals (personal computers) must be supplied by the Awarded Bidder as part of the test system and included in the base System price.

c. User Acceptance Testing System Communications. The testing terminals must be supplied with all communications mechanisms employed in the field. The testing system must be able to connect to the Lottery’s test ICS.

d. Secure Connections. The system has the same specifications as the primary systems.

e. Bidder’s Development and Test System. The Awarded Bidder must not conduct software development or its own quality assurance activities on any of the production systems nor on the Lottery test systems identified above, but rather must employ separate development and Quality Assurance (QA) system(s), located at either site or at a location convenient for the Awarded Bidder.

4. Internal Control System (ICS) Configuration All components and services for the ICS systems shall be approved by the Lottery and provided as part of the Contract, by the Awarded Bidder. ICS Vendor selection shall be approved by the Lottery. The three (3) ICS systems will be located as follows: one (1) “primary” at the in-State offices of the Lottery, and two (2) at the in-state, local general office of the Awarded Bidder (secondary and development/test ICS). The Awarded Bidder must supply data communications to connect the three (3) ICS systems. The primary ICS must receive a near real-time feed of gaming transactions from the System. Refer to PART II, Section F 10 (Internal Control System) of the RFP for specific ICS requirements.

5. Quantitative Performance Criteria The response time specifications of this section shall be considered met if greater than 95% of the transactions of particular types comply with the specifications.

a. The System must initially support a network of one thousand five hundred (1,500) Retailer terminals at a minimum.

b. The ability to expand the System to accommodate up to three thousand five hundred

(3,500) active Retailer terminals must be available, should such an expansion opportunity be desired by the Lottery.

c. The System as delivered must be capable of continuously handling up to sixty-six thousand (66,000) sales transactions per minute.

d. The System must have the ability to sell a minimum of fifty (50) single-play quick-pick tickets without requiring operator re-entry.

e. The System as delivered must be capable of continuously processing up to five thousand (5,000) combined validation and cancel transactions per minute. Additionally, tickets, reports, and transactions must be produced within the following time frames. All time frames are from the completion of data entry or bet slip insertion to completion of printing:

i. Variable length, multi-play (up to ten (10) boards) draw game tickets shall be produced in a maximum of six (6) seconds. after completion of data entry ("Send" is pressed or play slip is inserted) to availability of the ticket for the Retailer.

ii. All other transactions (e.g., instant pack transactions, winning ticket validations, cancels, and draw game and instant ticket reports, etc.) shall be produced in a maximum of five

(5) seconds after completion of data entry ("Send" is pressed) to availability of the ticket or report to the Retailer.

f. Primary site system recovery in auto-failover mode from a one-system failure must be accomplished in a maximum of one (1) minute while still maintaining current transactions.

This includes the ability to fully service the communications network supporting the Retailer terminals.

g. Backup site system recovery from a primary site failure in auto-failover mode must be accomplished in a maximum of one (1) minute without any data loss. This includes the ability to fully service the communications network supporting the Retailer terminals and supplying management terminal functions.

h. The System must have the as-delivered capacity in all hardware and software aspects to accommodate five hundred (500) concurrent instant and fast play games being in any status (e.g., loaded, distributed, settled, activated, disabled, returned), a draw game sales day of at least one hundred million dollars ($100,000,000) and a draw game jackpot over ten billion dollars ($10,000,000,000).

i. The System must accommodate large game volumes. The Lottery typically has fifty (50) instant games for sale at one time, ranging from approximately five hundred thousand (500,000) to three million (3,000,000) tickets per game. The Lottery requires that the System accommodate games of up to twenty (20) million (20,000,000) tickets.

Approximately fifty (50) new games are introduced annually.

6. Operating Hours The ability to accommodate near twenty-four (24) hour-a-day operation is required by the Lottery. This requirement is defined as full operational capabilities from no later than 12:30 a.m. until midnight Eastern time every day of the year.

D. Terminals for Retailers and Games Management The Awarded Bidder is required to supply the Lottery with terminals as specified in this section. The initial terminal counts are set forth below and the Awarded Bidder must be able to deliver, install, and support additional terminals as ordered by the Lottery under the terms defined in the Contract.

1. Retailer Terminal Hardware, Features and Function. The Awarded Bidder is required to supply the Lottery with both Retailer Point of Sale (POS) terminals, full-service vending terminals, draw kiosks, and peripherals. The Awarded Bidder must be able to deliver, install, and support additional terminals as ordered by the Lottery under the terms defined in the Contract. All terminals must have a first read rate exceeding ninety-five percent (95%) for all draw, scratch game ticket barcodes, and matrix codes for validating or canceling a ticket.

The Lottery prefers that all Retailer terminals reside on the same software platform.

Requirements include, but are not limited to, the following Retailer operated terminal features and functions:

a. Point of Sale (POS) Terminals and Full-Service Vending Terminals. The following applies to both POS and full-service vending terminals:

i. Identification. No manufacturer's or Awarded Bidder's logo or identification shall be attached.