RFPNO2~4.DOC

Michigan.gov/MiProcurement RFP No. 240000002704 Schedule A – Statement of Work Request for Proposal (RFP) No. 240000002704 Certification of Lottery Draw Game Software Hardware This schedule identifies the anticipated requirements of any Contract resulting from this RFP. The term “Contractor” in this document refers to a bidder responding to this RFP, as well as the Contractor who is awarded the contract. The term “bidder” is used to identify where specific responses to the RFP are required.

The Contractor must respond to each requirement or question and explain how it will fulfill each requirement. Attach any supplemental information and appropriately reference within your response.

IMPORTANT NOTE TO CONTRACTORS/BIDDERS: There are specific requirements for which acceptance must be simply acknowledged through a checkbox(es), and others that require further explanation. Click one checkbox and complete the entries as identified.

BACKGROUND

The Michigan Lottery Drawing Systems are responsible for generating winning draw numbers for certain Lottery games and promotional drawings. Lottery uses computer systems (servers and/or laptops) with random number generator software (RNG) to conduct these drawings.

SCOPE

The Michigan Lottery seeks to contract with a qualified, independent Contractor to physically review random number generator source code and design documentation, inspect and test random number generator software, and certify the software and hardware. The certification process will be used to evaluate the randomness of the drawing equipment used in drawings.

Requirements Testing of Random Number Generator(s) and software utilizing a Random Number Generator (RNG). Testing may include the associated equipment utilized by the Lottery for the selection of winning numbers in a variety of lottery drawings. Such testing shall determine whether a Lottery drawing meets the following requirements:

a) That each combination of possible winning numbers is equally likely to be selected and cannot be predicted.

b) That the software contains no computer code that will intentionally alter the selection results or other output to produce a predetermined combination of numbers.

All testing of the software using a RNG and the associated equipment will be performed at the vendor's place of business or at any other site that is mutually agreeable between the parties. The software provided by the Lottery may be loaded onto deliverable hardware or uploaded to vendor’s secure FTP site. The hardware may be made available to the· vendor for testing and certification purposes. The vendor shall provide the Lottery with detailed reports of all tests performed on the software and the associated equipment submitted by the Lottery for testing. The vendor shall maintain accurate accounting records and reports of all approved software and associated equipment and provide to the Lottery upon completion of the testing. Provide written certification upon successful completion of testing.

General Requirements Performance Measures The following sections will detail the specific tests, reviews, and deliverables that the Michigan Lottery requires the vendor to provide.

Source Code and Design Documentation Review

The vendor shall analyze the source code and design documentation provided by the Lottery. The analysis shall include the following:

a) Tracing the path of the RNG and the path of the software that utilizes the RNG application from the initiation of the draw to the selected output of random numbers.

b) Review of all design documentation to assess the existence of any potential conflicts with the rules and parameters of the games.

c) Assess the ability of the RNG to produce all numbers within the desired range.

d) Provide a method to electronically validate the RNG program and the software that utilizes the RNG.

e) Inspect the source code and object code to ensure that there are no undisclosed switches or parameters having an influence on randomness and fair play.

f) Validate Operating System version and configuration.

g) Capture Forensic Baseline (validate hashes)

h) Execute forensic analysis for rogue programs

i) Perform Application Control analysis

j) Perform Application Logging Analysis

k) Review Software and Gameset Configuration Management

l) Provide Any other controls vendor would recommend

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

Statistical Analysis

The vendor shall perform such statistical tests as required to ensure the requirements of this statement of work. The following National Institute of Standards and Technology (NIST) standard tests may be utilized to perform the statistical analysis of the RNG data:

a) Frequency (Monobits) Test

b) Frequency Test within a Block

c) Runs Test

d) Test for the Longest Run of Ones in a Block

e) Binary Matrix Rank Test

f) Discrete Fourier Transform (Specral) Test

g) Non-Overlapping Template Matching Test

h) Overlapping Template Matching Test

i) Maurer's Universal Statistical Test

j) Linear Complexity Test

k) Serial Test

l) Approximate Entropy Test

m) Cumulative Sums (Cusum) Test

n) Random Excursions Test

o) Random Excursions Variant Test

p) Vendor Recommendations

Vendors shall describe, in detail, which tests will be conducted and what would be the expected results of conducting said tests. In addition, vendors offering an alternative or variant to the above referenced tests shall provide a detailed explanation of the offered test and expected outcome for performing the said test.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

Verification Signatures

In addition to the above listed tests, the vendor shall provide the software verification method suitable for the Lottery to verify that the software delivered for installation is identical to the software tested and certified by the vendor where possible.

The vendor will utilize standard methods and software tools to determine if the code has been altered or modified. These tools are to be currently used in the regulated gaming jurisdictions and by Lottery security and audit personnel around the world. The algorithms are to be validated as being secure and the program does not modify or change the files in any way.

Provide proof that the software delivered for installation is identical to the software tested and certified by the vendor and provide your methodology.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

Service Requirements Timeframes All Contract Activities must be delivered within the timeframe agreed upon at the time-of-service request for contract services. The receipt of order date is pursuant to Section 2, Notices, of the Standard Contract Terms.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

Reporting The Contractor must submit to the Program Manager written reports as agreed upon at the time-of-service request.

List all exception(s):

The Contractor must explain any reporting that is included in its proposal and any additional reporting capabilities:

Staffing Contractor Representative The Contractor must appoint one Contractor Representative/ Key Personnel, specifically assigned to State of Michigan accounts, that will respond to State inquiries regarding the Contract Activities, answering questions related to ordering and delivery, be knowledgeable on the contractual requirements, , etc. (the "Contractor Representative / Key Personnel"). The Contractor must notify the Contract Administrator at least 30 calendar days before removing or assigning a new Contractor Representative / Key Personnel.

List all exception(s):

Key Personnel The Contractor must appoint one (1) individual who will be directly responsible for the day-to-day operations of the Contract (“Key Personnel”). Key Personnel must be specifically assigned to the State account, be knowledgeable on the contractual requirements, and respond to State inquiries within 24 hours.

The Contractor may not remove or assign Key Personnel without the prior consent of the State. Prior consent is not required for reassignment for reasons beyond the Contractor’s control, including illness, disability, death, leave of absence, personal emergency circumstances, resignation, or termination for cause. The State may request a résumé and conduct an interview before approving a change. The State may require a 30-calendar day training period for replacement personnel.

The bidder must identify the Key Personnel, indicate where they will be physically located, describe the functions they will perform, and provide current chronological résumés.

List all exception(s):

Key Personnel

- Program Manager:

- Contractor Representative:

- Attorney(s):

- Trainer(s):

Physical Location of Key Personnel:

Functions each Key Personnel will perform:

Current Chronological Résumés (attach):

Non-Key Personnel The Contractor must notify the Contract Administrator at least 10-calendar days before removing or assigning non-key personnel.

List all exception(s):

Organizational Chart The Bidder must provide an overall organizational chart that details staff members, by name and title, and subcontractors - either in this response box or identified here as an attachment to this RFP labelled as Organizational Chart.

Disclosure of Subcontractors If the Contractor intends to utilize subcontractors, the Contractor must disclose the following:

· The legal business name; address; telephone number; a description of subcontractor’s organization and the services it will provide; and information concerning subcontractor’s ability to provide the Contract Activities.

· The relationship of the subcontractor to the Contractor. Of the total bid, the price of the subcontractor’s work. Whether the Contractor has a previous working experience with the subcontractor. If yes, provide the details of that previous relationship.

· A complete description of the Contract Activities that will be performed or provided by the subcontractor.

GDBE definition: "Geographically Disadvantaged Business Enterprise" also known as GDBE, is a Michigan-based business that satisfies one or more of the following: (i) Is certified as a Michigan HUBZone Small Business Concern by the United States Small Business Administration. (ii) Has a principal place of business located within a Qualified Opportunity Zone within Michigan. (iii) More than half of its employees either work at a secondary location or have a principal residence located within a Qualified Opportunity Zone within Michigan, or both.

Additional information on GDBEs can be found here:

Michigan GDBE Website Bidder must provide detailed information as requested in the above requirement(s).

The legal business name, address, telephone number of the subcontractor(s).

A description of subcontractor’s organization and the services it will provide and information concerning subcontractor’s ability to provide the Contract Activities.

The relationship of the subcontractor to the Bidder.

If yes, provide the details of that previous relationship.

A complete description of the Contract Activities that will be performed or provided by the subcontractor.

Of the total bid, the price of the subcontractor’s work.

Bidder must provide information based on the work performed by all subcontractors

Total percentage of work that will be performed by subcontractors:

Total percentage of subcontracted work that will be performed by GDBE subcontractors:

Security The Contractor will be subject the following security procedures:

Prior to operations under the Contract, the Contractor may be asked to provide Lottery with a written description of Contractor's security program for Lottery approval. As part of this requirement the Contractor must maintain an approved operations security plan.

The security program shall include the following procedural, administrative, and physical elements:

A. Methods and procedures for conducting background checks on all personnel and compliance with requirements for compilation of information for background checks. .

B. Security measures and systems which preclude unauthorized persons from accessing all facilities and supplies, and equipment within the facilities. The Lottery reserves the right to prohibit physical access to operations areas by non-operations personnel.

C. Security measures which preclude the unauthorized use of equipment and materials, without written authorization from the Lottery.

D. Security measures that ensure the integrity of the preparation, storage, distribution, or use of any data subject to privacy laws.

E. Personnel Security. The Lottery may initiate investigations into the backgrounds of any officers, principals, investors, owners, Subcontractors, employees, or any other associates of the Contractor it deems appropriate.

Such background investigations may include fingerprint identification by Michigan State Police, Federal Bureau of Investigation, and any other appropriate public or private agencies selected by the Lottery.

F. Personnel who will be performing services under the Contract and as determined by the Lottery will be required to undergo a background investigation by the Lottery. This Lottery background check does not relieve the Contractor of their responsibility to conduct their own background investigations. After an employee being considered for work on the Lottery Contract has been cleared by the Contractor's background checks, the person shall be submitted to Lottery for clearance. The results of the background check by the Contractor shall be shared with Lottery.

The Contractor consents to cooperate with such investigations, and to instruct its employees to cooperate. The Lottery may terminate the Contract or require the Contractor to remove an employee from the Lottery project based upon adverse results of background checks if the Lottery determines that its integrity, security, or goodwill may be in jeopardy. The Lottery may disapprove any employee or Subcontractor of the Contractor who is assigned to this project, either at Contract inception or at any time during the Term of the Contract.

The Contractor shall not allow the engagement of unfit or unqualified persons not skilled in the tasks assigned to them with respect to the Contract and shall always employ sufficient personnel for carrying out work to full completion in the manner and time prescribed by the Contract. The Contractor shall be responsible to the Lottery for the acts and omissions of the Contractor's employees. or Subcontractors.

Any person employed by the Contractor shall, at the written and reasonable request of the Lottery, be removed forthwith by the Contractor from work relating to the Contract. The Contractor's Subcontractors are in this respect considered employees of the Contractor.

The ability to conduct such investigations is a continuing right of the Lottery throughout the Contract.

The Contractor shall at the start of the Contract, and for each new employee prior to their assignment on Michigan Contract work, submit to the Lottery the name, address, date of birth, social security number, driver license number, or fingerprint cards and/or other release forms bearing the person's signed authorization to allow criminal justice agencies to release to the Lottery any criminal history that pertains to such person, of all officers and employees of the Contractor and of any Subcontractor, who are involved in any phase or aspect of the Contract Activities. The Lottery reserves the right to review and approve or disapprove any persons prior to or during their assignment to this Contract. No employee is to be given access to facilities or assigned to work on this Contract until the employee has been cleared by the Lottery. The Lottery reserves the right to review all security clearances and to disapprove any Contractor. or Subcontractor employee.

The Contractor shall notify the Lottery of departures of persons who are involved in the Contract and shall provide a roster of current employees to the Lottery at least every six (6) months during the term of the Contract.

G. Security Violation Reporting. The Contractor shall immediately report to the Lottery any security procedural violation, System compromise, potential violation of law, or compromises of equipment, software, or materials used or to be used in the performance of this Contract.

H. Security Information (Disclosure) Updates. The Contractor shall report any change in, addition to, or deletion from, the information disclosed to the Lottery. The report shall be in the form of a letter addressed to the Lottery and shall be delivered to the Lottery's Security Director immediately but no longer than thirty (30) days from the effective date of the change, addition, or deletion. In particular the Contractor must report the involvement of any of the Contractor's employees, owners, or agents in any known criminal arrest (exclusive of minor traffic violations) or investigation.

I. Disclosure. The Contractor must disclose any criminal litigation, investigations or proceedings involving the Contractor (and each Subcontractor) or any of its officers or directors or any litigation, investigations or proceedings under the Sarbanes-Oxley Act. In addition, each Contractor (and each Subcontractor) must notify the Lottery of any civil litigation, arbitration or proceeding which arises during the Term of the Contract and extensions thereto, to which the Contractor (or, to the extent the Contractor is aware, any Subcontractor hereunder) is a party, and which involves: (i) disputes that might reasonably be expected to adversely affect the viability or financial stability of the Contractor or any Subcontractor hereunder; or (ii) a claim or written allegation of fraud against the Contractor or, to the extent the Contractor is aware, any Subcontractor hereunder by a governmental or public entity arising out of their business dealings with governmental or public entities. Any such litigation, investigation, arbitration or other proceeding (collectively, "Proceeding") must be disclosed in a written statement to the Lottery Security Director within thirty (30) days of its occurrence. Details of settlements which are prevented from disclosure by the terms of the settlement may be annotated as such. Information provided to the Lottery from the Contractor's publicly filed documents referencing its litigation will be deemed to satisfy the requirements of this section.

J. Assurances. In the event that any such Proceeding disclosed to the Lottery pursuant to this section, or of which the Lottery otherwise becomes aware, during the Term of this Contract would cause a reasonable party to be concerned about:

a. The ability of the Contractor ( or a Subcontractor hereunder) to continue to perform this Contract in accordance with its terms and conditions.

b. Whether the Contractor (or a Subcontractor hereunder) in performing services for the State is engaged in conduct which is similar in nature to conduct alleged in such Proceeding, which conduct would constitute a breach of this Contract or a violation of Michigan law, regulations or public policy, then the Contractor shall be required to provide the State all reasonable assurances requested by the State to demonstrate that (a) the Contractor and/or its Subcontractors hereunder will be able to continue to perform this Contract and any Statements of Work in accordance with its terms and conditions, and (b) the Contractor and/or its Subcontractors hereunder have not and will not engage in conduct in performing the services similar in nature to the conduct alleged in such Proceeding.

K. Notifications. The Contractor shall make the following notifications in writing:

a. Within thirty (30) days of the Contractor becoming aware that a change in its ownership or officers has occurred, or is certain to occur, the Contractor shall notify the Lottery Contract manager.

b. The Contractor shall notify the Lottery Contract manager within thirty (30) days whenever changes to company affiliations occur.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

Pricing Price Term Pricing is firm for the entire length of the Contract.

List all exception(s):

Price Changes Adjustments will be based on changes in actual Contractor costs. Any request must be supported by written evidence documenting the change in costs. The State may consider sources, such as the Consumer Price Index; Producer Price Index; other pricing indices as needed; economic and industry data; manufacturer or supplier letters noting the increase in pricing; and any other data the State deems relevant.

Following the presentation of supporting documentation, both parties will have 30 days to review the information and prepare a written response. If the review reveals no need for modifications, pricing will remain unchanged unless mutually agreed to by the parties. If the review reveals that changes are needed, both parties will negotiate such changes, for no longer than 30 days, unless extended by mutual agreement.

The Contractor remains responsible for Contract Activities at the current price for all orders received before the mutual execution of a Change Notice indicating the start date of the new Pricing Period.

List all exception(s):

Ordering Authorizing Document The appropriate authorizing document for the Contract will be a Direct Order (DO).

Invoice and Payment Invoice Requirements All invoices submitted to the State must include: (a) date; (b) direct order; (c) quantity; (d) description of the Contract Activities; (e) unit price; (f) shipping cost (if any); (g) vendor-generated invoice number and (h) total price.

List all exception(s):

Payment Methods The State will make payment for Contract Activities via EFT.

List all exception(s):

Licensing Agreement The Contractor must provide a copy of any applicable licensing agreement.

Bidder must provide a copy of any applicable licensing agreement either in this response box or identified here as an attachment to this RFP.

Required Functionality Relating to Data Retention, Disposal, and Retrieval The State has legal obligations to retain, dispose, and retrieve State Data along with obligations to manage and secure State Data. To meet these obligations, the Solution must allow the State to:

1) retain all data for the entire length of the Contract.

2) delete its data or request the deletion of its data, even data that may be stored offline or in backups.

3) transfer its data back to the State or to a new vendor or new solution.

4) transfer its data to the Archives of Michigan as may be required by a retention and disposal schedule.

5) retrieve data, even data that may be stored offline or in backups.

Except as otherwise stated in the Contract, Contractor will not dispose of, delete, or destroy State Data without the prior written approval of the State.

List all exceptions:

Bidder must review and explain how the data retention, disposal, and retrieval requirements will be met by the solution and describe its data management capabilities (storage limitations, duration, etc.). If the Solution does not allow the State to perform these activities itself, the bidder must explain how it will support the State’s compliance with these requirements.

Service-Level Agreements (SLAs) A. The Contractor will be held accountable to meet the requirements and the service level requirements established in this Contract.

B. The State reserves the right to reconsider or amend SLA amounts for split awards should they occur.

C. Please Note: Should bidders require clarification or have any questions with regard to the SLAs, they should submit them during the Question and Answer Period of this solicitation; please see the Proposal Instructions for the timeline.

Service Level Agreements for this Contract will be as follows:

Throughout the life of this contract, the SOM will require meetings and reports provided timely. Deadlines will be established and agreed upon by the SOM and the Contractor.

The Contractor must meet all deadlines for meeting attendance, reporting, and document review. Depending on the selected pricing structure for this RFP, the Contractor must provide Service Level Credits for delays for which they are responsible.

1. The Contractor will provide a credit of five (5) % of their next invoice when deadlines are exceeded by five (5) business days.

2. For each business day beyond five (5), the Contractor will provide an additional credit of 1% per day.

Established deadlines will be recorded via correspondence between the SOM and the Contractor.

List all exception(s):

Version 2024-2 Page 2 of 2 image1.png