Virginia Lottery iLottery RFP.pdf

Commonwealth of Virginia

Request for Sealed Proposals

Title: iLottery System, Services, and Support

Due Date: July 28, 2026

Contact Information:

Michael Gerdes, CPPB Procurement Manager mgerdes@valottery.com, 804-955-5758

Request for Proposals (RFP) #: ................................................................................................................................ 13179MG

RFP Issue Date: ....................................................................................................................................................... April 28, 2026

Contract Term: ..................................................................................................... Five Years with Three 3-year Renewals

Proposal Due Date and Time: ................................................................................................. July 28, 2026; 3:30 PM EST

The Virginia Lottery does not discriminate against faith-based organizations or against an Offeror because of race, religion, color, sex, national origin, age, disability or any other basis prohibited by state law relating to discrimination in employment. The Virginia Lottery encourages firms to provide for the participation of small businesses and businesses owned by minorities and women through partnerships, joint ventures and subcontracting opportunities.

Complete Legal Name of Offeror’s Firm:

Virginia Lottery iLottery System, Services, and Support

RFP#13179MG

TABLE OF CONTENTS

I. PURPOSE:

II. BACKGROUND:

III. STATEMENT OF NEEDS:

A. INFORMATION TECHNOLOGY REQUIREMENTS

B. PLAYER ACCOUNTS

C. GAMES

D. PAYMENTS

E. CUSTOMER ENGAGEMENT

F. STAFFING AND SUPPORT

G. OPTIONAL REQUIREMENTS

H. STRATEGIC RECOMMENDATIONS

I. ONGOING MAINTENANCE AND SUPPORT

IV. PROPOSAL PREPARATION AND SUBMISSION REQUIREMENTS:

A. GENERAL REQUIREMENTS:

B. SPECIFIC PROPOSAL REQUIREMENTS:

C. SOLICITATION QUESTIONS AND PROCUREMENT TIMELINE:

V. EVALUATION AND AWARD CRITERIA:

A. EVALUATION CRITERIA:

B. AWARD OF CONTRACT:

VI. SPECIAL TERMS AND CONDITIONS

VII. GENERAL TERMS AND CONDITIONS:

VIII. METHOD OF PAYMENT AND INVOICING:

IX. ADDENDA:

X. SIGNATURE AND OFFEROR PROFILE SHEET:

XI. OFFERORS CHECKLIST:

RFP#13179MG

I. PURPOSE:

The Virginia Lottery (“Lottery”) is seeking a vendor partner to provide a best-in-class iLottery program and related services (the System) with the following key objectives:

• Maintain the Lottery’s position as the highest grossing U.S. iLottery program.

• Continue to produce annual growth in iLottery sales and profits.

• Provide innovative solutions and strategies to expand the Lottery’s gaming market share against other online gaming options.

• Drive acquisition and retention of Lottery players.

II. BACKGROUND:

The current version of the Lottery’s iLottery program was introduced on July 1, 2020 when eInstants and single ticket draw game purchases became available to Virginia players in addition to existing draw game subscriptions. In FY2025 (July 1, 2024 to June 30, 2025), the Lottery had sales of approximately $5.77 billion and generated more than $901 million for K-12 education. The iLottery program accounted for approximately 60% of the sales. For a breakdown of sales, prizes, retailer compensation, operational expenses, and proceeds by fiscal year, and to access the most recent annual report and more, please visit:

https://www.valottery.com/playingmatters/givingback. For additional statistics specifically on the iLottery program’s performance in FY25, please review Attachment One – Current iLottery Program Information.

The iLottery program is composed of multiple conjoining parts that are supported by various partners.

The following is a brief description of the most significant parts of the iLottery program. Offerors are recommended to register and review the iLottery program offerings.

1. Platform with Player Account Management o Vendor: NeoPollard Interactive (NPi) o Description: The digital platform is the software, service, and hardware that permits Lottery players to securely purchase lottery games, account for associated wagers and winnings, and manage their player account in a user-friendly manner. The platform provides the ability for players to deposit and withdraw funds.

2. Player-facing Website and Mobile App o Vendor: Lottery managed with support from WillowTree.

o Description: The website and mobile app are platforms where players navigate to engage with their player account, Lottery games, Lottery Rewards, and additional features and information. Players utilize the mobile app for scanning tickets to determine if they have a winning ticket along with entering it into Lottery Rewards or other promotional drawings.

3. eInstant Games o Vendors: Direct contract with Instant Win Gaming (IWG) with direct integration into the platform. Through the NPi agreement, NeoGames Studio content is directly integrated into the platform. Through the NPi agreement, content from EQL, Scientific Games (SGI), Inspired Entertainment, Pollard Banknote (Pollard), and Brightstar Lottery are currently available through Pariplay aggregation services. AGS and Allodium are planned to be available through Pariplay aggregation services prior to the end of the current contract.

o Description: eInstant Games (called Online Games to players) are instant-win style games available for players to purchase using funds deposited to their account. New games are launched at least twice monthly, and the theoretical payout is between 85% and 90%.

https://www.valottery.com/playingmatters/givingback

4. Draw Games o Vendor: NPi o Description: Through platform widgets, players may purchase online tickets for the following draw games: Powerball, Mega Millions, Cash 5 with EZ Match, Pick 5 with Fireball, Pick 4 with Fireball, Pick 3 with Fireball, Millionaire for Life, and online-only raffles. Players may select their own numbers and purchase tickets as either a one-time purchase or using deposited funds. Players may select to auto-renew a draw game purchase so that it will automatically be purchased on a biweekly basis.

5. Lottery Rewards (Loyalty) o Vendor: Zeta o Description: Using a registered online account, players accumulate points, either through online play or by scanning a retail-purchased ticket, to redeem for retail coupons, online credit, promotional drawings, or other prizing. Lottery Rewards supports multiple tiers and badges for players based on participation.

6. Customer Relationship Management (CRM) o Description: Using a customized version of the Bloomreach platform, the Lottery team communicates directly with players through both automated and customized SMS and emails that can include a number of different promotional offers.

7. iLottery Customer Service o Description: To support the Lottery’s internal customer relations team, the NPi Player

Support Center (PSC) works directly with players specifically on iLottery account management and/or game issues.

8. Affiliate Program o Vendor: Income Access through the NPi agreement o Description: As a player acquisition tool, the Lottery has an affiliate program that compensates partners that sign up and then advertise the iLottery program to their customers.

In addition to the list above which highlights direct support of the iLottery program, the Lottery’s retail system partner, Brightstar Lottery, is a relevant contributor to initiatives that crossover from online to retail and vice versa. For technical development and integrations, the Lottery uses the Microsoft stack of technologies.

More information about the Lottery’s current iLottery program can be found in Attachment One – Current iLottery Program Information.

III. STATEMENT OF NEEDS:

As the current highest grossing and highest per capita iLottery program in the United States, the Lottery wants to build upon its existing success to continue to grow the iLottery program in the face of increasing online gaming competition. Given the Lottery’s existing success, the Lottery is looking to expand upon its capabilities through innovation in technology, products, and partnerships while maintaining the current iLottery program functionality and offerings that have been instrumental to player satisfaction. The Lottery is not looking for an existing turn-key solution; rather a solution custom designed to match the Lottery’s current robust capabilities and improve upon them. While Offerors shall have the ability to collaboratively work with the Lottery to identify opportunities to grow the program, Offerors should highlight and explain new opportunities in detail that can keep the Lottery as the best performing iLottery program in the United States.

To minimize tech stack complications and improve technical performance, the Lottery wishes to integrate Lottery Rewards into the iLottery program as a native solution that can handle unique Lottery purchasing behavior online and at retail. To ensure continuity with the existing program, the awarded Offeror shall be the contracting body for any third-party programs or offerings until an alternative is developed (if necessary) that does not remove functionality from the current iLottery program.

The Lottery does not view players as either “online” or “retail” players but rather Lottery players;

therefore, Offerors shall demonstrate willingness to work with the Lottery’s existing retail system provider to maintain current crossover functionality as well as establish a direct connection between the retail system and the iLottery program as defined by the Lottery.

Offeror shall be able to deliver all existing functionality, features, and games of the Lottery’s iLottery program at time of start of implementation at no additional cost or development hours to the Lottery.

In the event that any additional development time is required by the Offeror to fulfill any existing requirement of the iLottery program, the Offeror shall not invoice, charge, or otherwise seek compensation from the Lottery for any such hours or costs necessary to meet said requirement.

The anticipated contract term is a five (5) year base contract with a potential for up to three (3) 3-year renewals. iLottery requirements are listed below:

A. INFORMATION TECHNOLOGY REQUIREMENTS

1. System Overview a.) Industry Standards The Offeror shall have the ability to commit to updating all major hardware, software, and other components to be equivalent to or better than current industry standards. This includes, without limitation, transaction processing, payment processing, networking, testing, diagnostics, programming formats, servers, and methods of integration. Updates shall follow recognized frameworks such as ISO/IEC 20000 for IT service management and NIST SP 800- 53 & VITA SEC530 for security controls, where applicable.

Additionally, the Offeror shall have the ability to ensure that all equipment has been or will be inspected for safety, approved by a reputable testing laboratory, and is in compliance with applicable regulations and certifications, including but not limited to FCC (U.S.), CE (EU), TÜV (Germany), UL (U.S.), and PCI DSS for payment systems. All new components shall meet these standards prior to deployment.

Offeror may be required to provide documented proof of certification, inspection, or other documentation deemed appropriate by the Lottery, including but not limited to SOC 2 Type II reports, ISO certifications, or independent lab testing results. The Lottery reserves the right to audit such documentation and request remediation if standards are not met.

b.) System Hardware and System Software Upgrades

All system hardware and system software shall be replaceable at any time by more modern models or versions through system upgrades, provided such upgrades do not disrupt ongoing operations. All system hardware and system software shall be fully supported by the respective manufacturer or supplier throughout the Contract term and for a period of twelve (12) months thereafter.

In the event that support for any hardware module, component, or system software is discontinued by the manufacturer or supplier, the Offeror shall have the ability to notify the Lottery immediately upon announcement of such discontinuation. If required by the Lottery, the Offeror shall have the ability to replace the affected hardware or software components prior to the end of support, at no cost to the Lottery.

Upgrades necessary to maintain minimum performance standards or service level agreements (SLAs) shall not be charged to the Lottery. Similarly, upgrades required to replace outdated, unsupported, or defective equipment or software shall not be charged to the Lottery. The only upgrades that may be charged to the Lottery are those that enable functionality not originally required under the Contract, and only to the extent that the upgraded equipment or software directly supports the new functionality. If the upgraded component supports both required and new functionality, the cost shall be prorated based on the approximate percentage of use attributable to the new function.

All upgrades shall be approved in writing by the Lottery prior to implementation. The Offeror shall provide a schedule of planned upgrades for equipment located at data centers. All equipment shall be refreshed within five (5) years of being placed into service, or prior to reaching end-of-life or warranty expiration, whichever occurs first.

c.) Time Zones

All Lottery-facing and customer-facing functionality in the system and related support from the Offeror shall be aligned with Virginia local time (Eastern Time).

d.) Time Alignment

The system shall be able to adjust to any Lottery designated business start and end times, days, weeks, months, quarters, and years to align reporting and balancing with other vendors as directed by the Lottery. Additionally, Offeror shall be available during Lottery designated business hours (Monday through Friday from 8:00am to 5:00pm, Eastern Time Zone).

2. Infrastructure a.) Primary Data Center

The primary data center shall conform to all federal, state, and gaming regulatory requirements, and shall be located in the continental United States. The primary data center shall also conform to any relevant Payment Card Industry (PCI) requirements and all security requirements as directed by the Lottery and any associations [e.g., Multi-State Lottery Association (MUSL)] that provide game oversight. Offerors are advised that placing equipment in co-location facilities is permissible. Any cloud proposal shall conform to VITA SEC 530 standards.

Further, any proposed solution shall provide geographically distributed availability zones across multiple U.S. regions to ensure redundancy and resiliency. These regions may include, but are not limited to, East, West, Central, or South. The architecture shall support an Active/Active configuration across at least two distinct regions to maintain continuous operations and minimize downtime in the event of a regional failure.

b.) Backup Data Center

i. The backup data center shall conform to all federal and state regulatory requirements and shall be located in the continental United States. The backup data center shall also conform to any relevant PCI requirements or security requirements imposed by the Lottery and any associations (e.g., MUSL) that provide game oversight.

ii. The backup data center shall be located in an area that minimizes and separates risk of concurrent failure with the primary data center such as isolation on separate power grids.

Additionally, the backup data center shall be tested every six (6) months for readiness in a planned failover. The backup systems shall be of the same processing capacity, configuration, storage capacity, and architecture as the primary data center systems. They shall be a “mirror” of the primary data center system.

The Offeror shall have the ability to provide two (2) or more remote backup systems that can take over for the primary data center systems, if necessary. Data transferred to and recorded at the remote backup systems shall always contain the most recent transactions, thereby allowing a takeover. The backup data center shall be configured to allow for an automated data center switch. The Wide Area Network (WAN) connection shall provide routing of transactions to the backup as well as the primary data center. Central gaming system functions shall be available at the backup data center, as well as being available remotely via communications from the primary data center. This includes, but is not limited to, Lottery (PDC and BDC) connectivity related to Back Office, Testing, Dashboard, Databases, SFTP, etc. Utilization of a Development, Quality Assurance (QA), User Acceptance Testing (UAT), or Customer Acceptance Testing (CAT) system shall not be an acceptable backup system.

c.) Mission Critical Servers

Servers providing mission-critical gaming and back-office support shall be supported by protective redundancy for high-availability processing. Data storage redundancy shall also be ensured. All operating systems and associated critical server software shall maintain or exceed a release posture of N-2 (not more than two (2) levels off the latest release level). All critical security software patches shall be applied in less than forty-eight (48) hours from release. A component failure in one (1) system shall not cause a failure in any other system. Additionally, a component failure in one (1) system shall not result in the loss of a transaction. To meet this requirement, records of transaction data sold on the Central Gaming System (CGS) exist in not fewer than two (2) distinct locations to process (i.e., minimally log) transactions as approved by the MUSL Committee [see MUSL Rule 2.18].

d.) Parallel Data Centers

As an alternative to a primary and backup solution, Offerors may propose using parallel data centers. Parallel data centers shall conform to all federal and Commonwealth of Virginia regulatory requirements and shall be located in the continental United States. Both data centers shall also conform to any relevant PCI requirements and all security requirements as directed by the Lottery and any associations (e.g., MUSL) that provide game oversight. If parallel data centers are used, both data centers shall be tested every six (6) months. The test shall include a planned failover to each data center to verify the system can run on either data center without loss of any functionality or performance.

e.) Failover and Disaster Recovery

The System shall be equipped with redundancy in a manner that mitigates risk (e.g., backup on different electric grid, hard copies of code kept securely within the continental United States, etc.) and ensures continuous operations. A disaster recovery plan shall be provided and approved by the Lottery prior to the startup date and on an annual basis. In case of a failure in an active server at primary, the remaining System(s) will immediately provide access to players and other System users, assuming the load without loss or corruption of any data and transactions received prior to the time of the failure. Should implementation of any portion of a disaster recovery or contingency plan become necessary, all costs required to restore the

System shall be borne by the Offeror.

In the event of irreparable damage at the primary data center or of an unplanned, extended abandonment of the primary data center, the Offeror shall have the ability to provide, at no additional cost, those servers, facilities, and other components necessary to resume operations under an operational scenario using backup data center(s). Such servers, facilities, and other components shall be furnished, installed, and operational at all times. Facilities shall meet the Lottery-approved environmental and security measures.

f.) System Performance and Scalability

The System shall have the ability to be designed to maximize performance and speed across a wide variety of devices and connection types. The System shall be scalable to meet the needs of the Lottery and shall not experience degraded performance.

g.) System Availability and Monitoring

The System and production software environment shall be available on an ongoing basis without interruption (i.e., 100% uptime, 24/7, all year). Offeror shall obtain written approval from the Lottery at least five (5) business days prior to any planned downtime for system maintenance or any other reason. If maintenance is required, it shall be done during predefined maintenance windows as defined by the Lottery.

h.) Communication Networks

System shall have the ability to secure connectivity between the data centers, the Internal Control System (ICS), and any player-facing sites or mobile apps.

i.) Time-Synchronizing

All servers shall have a time-synchronizing mechanism to ensure consistent time recording and reporting of events and transactions.

j.) Logging

Offeror shall have the ability to support the system and user logging to allow for troubleshooting of various issues to better support player issues and concerns. Logging shall be supported for security purposes, recording any user sessions (authorized or unauthorized) to allow the Lottery to validate any specific user sessions as required. The Offeror shall have the ability to provide Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) reports on attempted access to data. The Offeror shall have the ability to provide a Security Information and Event Management (SIEM) solution and grant access to Lottery designated team members. All logs, including audit logs, shall be available and archived. Active logs shall be available for a minimum of six (6) months. All logging shall meet MUSL Rule 2 requirements.

3. System Security a.) Risk Assessment and System Security Plan

Prior to system go-live and annually thereafter, Offeror shall cooperate with the Lottery to complete and document risk assessments and system security plans to ensure compliance with Commonwealth of Virginia Information Security Standards.

b.) Penetration Testing Prior to system go-live and annually thereafter, or following an environment change, Offeror shall conduct penetration testing and provide the Lottery with a report detailing the results.

c.) System Access Approval All systems and users requiring access shall be approved by the Lottery. The System shall support controls and procedures that allow the Lottery to audit all System access. The System shall provide the ability for the Lottery to administer the Lottery user access to user functions within the System including, but not limited to, content management, player management, back-office system, games management, retailer affiliate programs, customer service software, and other functions that Lottery users will access.

d.) Authentication, Authorization and Access Controls

The System shall have controls related to user authentication, authorization, and access controls for using and operating the system. The System shall be compliant with all requirements found in VITA SEC 530 and Attachment Two – Information Security Terms and Conditions.

e.) Principle of Least Privilege

System users shall only be granted access to the information in the Application and Licensed Services needed to perform their job functions as designated by the Lottery as defined in Attachment Two – Information Security Terms and Conditions.

f.) Protection against Unauthorized Access or Service Disruption

Offeror shall have the ability to ensure the System is not vulnerable to unauthorized access, malware, and other threats.

g.) Other System Controls

Offeror shall have the ability to provide any additional information on other systems security components and controls that will be implemented including, but not limited to, operating system hardening, vulnerability scanning, penetration testing, login and password controls, system security log management, patch and policy management for system components, incident response, contingency planning and disaster recovery, system backup and recovery, remote access security procedures if remote access is used for tasks such as server administration, and intrusion detection mechanisms. Additionally, the System shall log all changes, and the logs shall be available to the Lottery upon request as required by Commonwealth information security standards as required by SEC 530. All data shall be retained for any term designated by the Lottery.

h.) Notifications

Offeror shall have the ability to notify the Lottery on all actions taken to prevent fraud and other security issues.

i.) Auditing

The System shall have the ability to maintain a log of transactions for the lifetime of the contract that are subject to auditing for appropriate usage and free from error. The Lottery shall have access to an audit log of transactions. This shall include the users who made any modifications to the system. The Lottery requires access to audit logs for review at any time. All materials related to the Lottery shall be maintained for a period of 12 months in active storage and 18 months in cold data storage after the contract has concluded.

j.) Transaction Research

Authorized Lottery personnel shall be able to research transactions as needed. Reports on transaction log entries shall allow standard queries and sorts. Data shall be immediately accessible in real-time and shall be available to the Lottery from a browser-based reporting system. Further, at least twenty-four (24) months of historical transaction detail, from the latter of the date of sale or redemption, shall be immediately accessible to the Lottery from a web-accessible reporting system.

In the event that a new vendor is selected after contract expiry and the Offeror is also the current vendor, the Offeror shall transfer all applicable data to the new vendor and the Lottery so data can be retained by the Lottery.

k.) Unique Transaction Numbers

All transaction serial number assignment methods used by the Offeror shall account for the fact that transactions may reside for extended periods in the system and numerous sources.

Transaction serial numbers shall be unique over the term of the contract.

l.) Transactions Protected

The System shall ensure that transactions cannot be tampered with, including but not limited to winner files and transaction log files.

m.) Unauthorized Access and Irregular Activity

The system shall not be vulnerable to unauthorized access.

The Offeror’s system and network monitoring solution shall monitor the network for data network status information, unauthorized access attempts, manipulation of components, and data within the network. The System shall ensure that no part of any transaction can be corrupted, altered, or manipulated.

Any irregular activity on the system or network shall be detected and handled in a manner that prevents the irregular activity from further occurring. This includes controls that detect irregular deposits into or withdrawals from a player account to which the System responds automatically by locking out the player and ceasing the irregular activity until the Offeror can intervene for investigation.

n.) System Integrity

The System shall ensure integrity wherein no action, either operational or by tampering, can permit duplicate or unauthorized user or player identities or addresses to be established.

o.) Software Checksums

Checksums or standard hash algorithms shall verify the integrity and authenticity of executable programs on the servers for auditing purposes. This requirement also applies to the test system and ICS system. Checksum information shall be provided to the Lottery upon request.

p.) Game Monitoring

Real-time monitoring of gaming transaction traffic and system utilization shall be provided.

The Lottery shall receive immediate notification of abnormal system operations and their causes, such as game loading problems, communication difficulties, system downtime, etc. The Lottery shall reserve the right to view dashboards of real-time monitoring within the iLottery System.

q.) Secure On-Site and Off-Site Storage

The Offeror shall have the ability to provide secure on-site and off-site storage of the System’s critical files, software, and backup data, subject to the approval of the Lottery. Stored materials retention shall follow a schedule approved by the Lottery. Data stored in archives shall be checked and/or exercised periodically to ensure physical integrity and validity. At the direction of the Lottery, the Offeror may be directed to restore a backup file to a test system to ensure viability.

r.) Compliance with Security Requirements

The System shall be compliant with all requirements as defined by VITA SEC 530 and Attachment Two – Information Security Terms and Conditions.

4. Software Development a.) Software Development Methodology

Offeror shall be able to use the agile or comparable methodology for software development.

b.) Software Planning Offeror shall have the ability to plan new software releases including the development of new features. The Lottery shall be the final decision maker on release date regardless of holidays and other priorities.

c.) Release Cycles

Offeror shall have the ability to utilize release cycles to enhance and adapt the software after implementation as well as be responsible for periodic system changes to accommodate integrations.

d.) Software and Hardware Documentation

Offeror shall have the ability to provide detailed documentation of every change to software and/or hardware in any environment that may affect testing in any environment and/or affect any third parties integrated with the system prior to issuing the release.

e.) Testing Plans

Offeror shall have the ability to provide recommended testing plans along with any hardware and/or software updates as designated by the Lottery.

f.) Software Development Resources

i. Offeror shall have the ability to provide ample resources to modify the system during the

Contract Term. System change requests outside of contract requirements shall be estimated by the Offeror using a standard methodology.

ii. Offeror shall provide a minimum of 6,400 hours or points (depending on methodology) for software changes per year of the Contract after the System startup date. Offeror shall have the ability to provide a plan in which the amount of development can scale up during a given period (e.g., month, quarter, year) within 120 days of the Lottery’s request to increase the velocity of development. Offeror may propose more than 6,400 annual hours/points.

**No software development hours or points shall be used to provide functionality, features, games, etc., that exist within the Lottery’s iLottery platform at start of implementation. ** g.) Multi-Tenant.

Where the Offeror has a function or feature that is already developed, including those developed for other clients, the Offeror shall only apply development hours/points to the time necessary to customize the function or feature to the Lottery-specific System. Offeror shall have the ability to partially credit the Lottery hours back on functions or features developed for the Lottery, which is later used by Offeror’s other clients. Offeror shall describe the method of calculation that will be used for the credit.

h.) Current Technology.

System shall have the ability to be regularly updated to meet requirements of new devices, new versions of operating systems, etc., without extra cost or deduction of development hours/points. This requirement is to ensure no degradation in the user experience as technology is updated and expanded.

i.) Unused hours.

Any unused hours or points in a given period shall roll forward into subsequent periods and shall never expire during the term of the contract. The Lottery may elect to take a credit against unused hours/points at any time. Hours and points may not be applied to any software deliverables or services in the RFP that are specified as required, or that have been proposed free of charge by the Offeror.

5. Testing and Quality Assurance a.) Quality Assurance Environment

Offeror shall have the ability to provide at least one (1) distinct quality assurance environment for the purposes of its own testing, Lottery testing, and third-party testing of software prior to delivery to the Lottery for acceptance testing. This environment shall mirror the Lottery’s production environment to every extent possible. This environment shall have an up-time (functional for the use of testing) of 99.999% or better, with the exception of planned maintenance downtime. Planned maintenance downtime shall never exceed twenty-four (24) hours for a single occurrence and no more than ninety-six (96) hours in any 365-day period unless otherwise directed or agreed to by the Lottery. The Offeror shall have the ability to have a system in place to alert the Lottery and all Lottery designated third parties of any downtime within 10 minutes of the start of the downtime, whether planned or unplanned. Planned downtime, shall be communicated at least five (5) business days in advance to the Lottery and all Lottery designated third parties.

b.) Lottery Testing Environment

Offeror shall have the ability to provide a distinct user acceptance testing environment to the Lottery, which is exclusively used for testing by the Lottery or its authorized designees. This environment shall mirror the Lottery’s production environment to every extent possible. The System shall allow for time travel. This environment shall have an up-time (functional for the use of testing) of 99.999% or better, with the exception of planned maintenance downtime.

Planned maintenance downtime shall never exceed eight (8) hours for a single occurrence and no more than a total of 32 hours in any 365-day period unless otherwise directed or agreed to by the Lottery. The Offeror shall have the ability to have a system in place to alert the Lottery and all Lottery designated third parties of any downtime within ten (10) minutes of the start of the downtime, whether planned or unplanned. Planned downtime shall be approved by the Lottery and communicated at least five (5) business days in advance to the Lottery and all Lottery designated third parties. No Personally Identifiable Information (PII) shall be allowed on any test environment.

c.) Production Testing To the extent testing is necessary in production, the Offeror shall have the ability to provide secure test accounts that do not allow testers to win prizes. Alternatively, the Offeror shall have the ability to provide a method to ensure any prizes won during production testing are removed from the test account and added back into the prize pool.

d.) Operational Ownership and Continuous Improvement The Offeror shall have the ability to support:

• Ongoing maintenance of test suites;

• Regular updates as platform features evolve;

• Continuous improvement of test coverage and effectiveness; and

• Knowledge transfer to Lottery personnel, where applicable.

e.) Test Accounts

Offeror shall have the ability to provide test accounts for all environments or provide a method by which the Lottery can create test accounts. All access to environments and all test accounts shall be approved by the Lottery and logged in case of audit. The Offeror shall have the ability to provide a method (such as third-party contract approved by the Lottery or designated Lottery employee) to facilitate tests in production.

f.) Regulatory Compliance Testing

The Offeror shall have the ability to conduct periodic testing, quarterly at a minimum, to ensure age verification and geolocation technologies are performing as expected, and in compliance with all regulatory requirements.

g.) Automated Testing Capabilities The Offeror shall have the ability to provide a comprehensive automated testing framework that supports the following test types:

• Functional Testing (gameplay, transactions, user flows);

• Regression Testing (existing features and games);

• Integration Testing (APIs, third-party systems, payment providers, CRM, loyalty);

• Performance and Load Testing (peak usage, scalability, stress scenarios);

• Security Testing (vulnerability scanning, policy validation);

• Data Integrity Testing (transaction accuracy, reporting, accounting controls); and

• Configuration Validation (environment parity checks).

h.) Change Control and Configuration Management

The Offeror shall have the ability to implement and maintain a formal, robust, automated, and documented change control and configuration management procedure practices for all environments. The Offeror shall develop control procedures for software change management and documentation, including updating of service and operational manuals, written procedures, and updating the source code maintained in an escrow account. This may not impede or slow the development process. Configuration management practices, as described below, shall apply to all of the following components:

• Documentation,

• Procedures,

• Specifications,

• Program application source and object code,

• Operating systems,

• Database platforms,

• Third-party applications,

• Systems and network hardware,

• Major hardware components,

• Application code changes,

• Configuration changes,

• Game releases and enhancements,

• Platform upgrades and patches,

• Infrastructure or cloud environment changes,

• API and integration updates,

• Security, compliance, and performance-related changes, and

• Any other major iLottery System components.

The Offeror’s change control and automated testing capability shall be fully integrated into the Offeror’s software delivery and change management lifecycle.

i Generate Change Request

The Offeror shall have the ability to generate a document describing any requested change and why it is required. Each change request shall include impact analysis, risk assessment, rollback procedures, and testing plans. All change requests shall be approved in writing by the Lottery. The Offeror shall have the ability to maintain a centralized change request repository accessible to the Lottery.

ii Approved Changes Only

The Offeror shall have the ability to ensure, through procedural and iLottery System controls, that only Lottery-approved changes, on an approved schedule, can be made. The Offeror shall enforce change gating mechanisms (e.g., CI/CD pipeline controls, access restrictions) to ensure only Lottery-approved changes are deployed. Audit trails shall be retained for a minimum of 3 years. Reports and displays shall be available to the Lottery to review all related change and configuration management activities.

iii Change Introduction

All changes to servers, network devices, or applications shall first be completed on the related testing systems. All changes approved and completed for production systems shall also be completed on the backup system. Changes shall follow a staged deployment process. The Offeror shall use automated deployment tools where feasible to reduce human error and ensure consistency.

iv Software Checksums

Checksums shall be required for software at the time it is released for Lottery testing and shall be available at any time for testing applications and for the production systems.

Checksums shall be generated using secure hashing algorithms (e.g., SHA-256) and validated during each deployment. The Offeror shall maintain checksum logs for all releases and provide verification tools to the Lottery.

v Component Identification iLottery System components shall be documented with version and release numbers, patch versions, or model and serial numbers. All components shall be cataloged in a Configuration Management Database (CMDB) or equivalent system, with versioning and lifecycle status clearly indicated.

vi Traceability of Components iLottery System components shall be traceable, identifying the history, use and location of a component. The Offeror shall maintain traceability records that link components to their change history, deployment dates, responsible personnel, and associated tickets or approvals.

vii Change Tracking

The Offeror shall have the ability to track all changes made to iLottery System components, provide reports showing when and by whom a change was made and for what purpose, and shall avoid update conflicts. Change logs shall reference associated planning documents and approvals. Change tracking shall be automated where possible, with integration into the Offeror’s ITSM platform. Reports shall be exportable in standard formats (e.g., CSV, PDF) and include timestamps, user IDs, and change rationale.

viii Configuration Status and Inventory

The Offeror shall have the ability to produce a configuration status report identifying the current configuration of any iLottery System component, as well as an inventory report including all iLottery System components. The Offeror shall provide real-time configuration status dashboards and periodic inventory reports (monthly or as requested).

These shall include asset health, patch status, and compliance indicators.

ix Documentation

The Offeror shall have the ability to provide and maintain comprehensive iLottery System documentation, including, but not limited to, network diagrams, security standards and processes, multi-jurisdictional security standards compliance documents, change control processes and procedures, data dictionaries, third-party licensing documentation, etc.

Documentation shall be version-controlled and updated within five (5) business days of any approved change. The Offeror shall provide access to a secure documentation portal with role-based permissions.

6. Data Integrations a.) Player Database Integration

The System shall have the ability to integrate with internal Lottery systems as required by the Lottery. Data shall be provided to the Lottery in real-time or near real-time. The player database shall include, but is not limited to:

i Player Data

The system shall have the ability to support a player database, central to iLottery management functions. Database elements may include, but are not limited to, player ID, name and address, telephone number, email address, bank account information required for EFT transactions, debit card information, status and history, W-2G(s), federal and Commonwealth of Virginia tax reporting information, account status, and any outstanding debt setoffs. Any changes to player data shall be logged in the System with associated details such as date, timestamp, Portal type being accessed, and logging the user making changes (e.g., Lottery employee identifier or player-initiated change).

ii Funds Transfer Activity

The System shall have the ability to record all internal and external funds transfers, including transaction type, amount, date, timestamp, applicable fees, funding source and funding destination.

iii Wager and Winnings Activity

When a player purchases a wager or wins a prize, the account record shall have the ability to maintain a history of the player’s wagers and prizes. Non-winning results and expired wagers may be removed, subject to the expiration policies set by the Lottery.

iv Promotions History

When a player receives a promotion offer from the Lottery, the System shall have the ability to reflect the activity in the database.

v Responsible Gaming Activity

The System shall have the ability to record all changes made to responsible gaming controls.

vi Survey Attributes/Attribute Modeling

The player database application shall have the ability to store and report player responses to surveys, other research activities, and player activity segmentation.

vii Data Conversion

As directed by the Lottery, the Offeror shall be required to convert existing player database(s) to maintain common sign-on credentials for current players.

viii Signature Capture

The System shall have the ability to store a digitized signature for the player.

ix Reporting and Download

The system shall have the ability to support real-time queries and reporting on the player database, and downloads to Excel of player database information.

x Rewards Activity

The player database application shall have the ability to store and report player data relating to Rewards activity b.) Communication Systems Integration

The System shall have the ability to be readily integrated with external communication systems in order to trigger player communications such as email, SMS, or push notifications. Some data will be required to be provided in regular intervals to third party communications partners for external campaign development and triggering.

c.) Analytics Systems Integration

The System shall have the ability to provide support for analytics tracking mechanisms, such as Google Analytics, advertising pixels, etc., on all pages or UI components that are provided by the System. This shall support the ability to establish and track conversion funnels with the capability to pass parameters in order to relate purchase value back to specific campaigns or site conversion paths.

The Offeror shall have the ability to provide data analysis services to the Lottery throughout the term of the contract. This shall include canned and standard iLottery reports from the iLottery System and the ability for the Lottery to create its own in-house reporting and analysis using the main database/data warehouse.

The Offeror shall have the ability to assist the Lottery with the following:

i Data Integrations

The ability to automatically extract or acquire data from external sources on a defined schedule or incrementing real-time basis. This shall entail a complete feedback loop, meaning the data can be connected from an acquisition source to player registration and all transactional activity, to marketing campaigns and the resulting trackable actions (e.g., app open, email open, etc.).

ii Player Normalization

The ability to recognize the same player from two (2) or more different data sources, and to merge or make the data relational to a single controlling player profile.

iii Business Rules

The ability to define and apply business rules, as established by the Lottery, to the data sources. For example, the ability to indicate a priority for ‘source of truth’ for two (2) data sets that contain the same data types.

iv Data Access

The ability for the Lottery to readily access, query, and export analysis reports or segmented player lists based on the universe of data available.

v Process Automation

The ability to automate specific recurring processes, such as a daily extract file (e.g., a player segment file for a recurring email campaign) that is sent to a third-party.

d.) Other Systems Integration

The System shall have the ability to provide support for integrations with other third-party systems to provide services such as retail systems, MUSL provided systems, payment processors, third-party loyalty programs (i.e., corporate accounts, MUSL, etc.), online game providers, SMS and push notification providers, external CRM programs, call center solution, digital data reporting systems, etc. Additionally, the Offeror shall have the ability to develop and provide system integration solutions as they become identified and required by the Lottery.

Offeror shall have the ability to use the NASPL API if and as directed by the Lottery.

e.) Data Warehouse

The Offeror shall have the ability to provide a data warehouse solution that shall include support for and connections to iLottery, existing retail systems, and all the Lottery’s data sources, which includes at a minimum, the following:

• Gaming systems provider;

• Retailer information and physical location;

• Retail sales, validations, shopping cart, coupons, vouchers, cross promotions, etc.;

• Mobile application;

• Second chance;

• Rewards provider;

• Affiliate program; and

• Financial transactions (i.e., deposits and withdrawals).

The connections shall include, but are not limited to, the following tasks: import data, provide data cleansing/formatting functions, and link to a suite of analysis and visualization tools such as, but not limited to, Excel, Tableau, PowerBI or analytical tools that are part of the data warehouse solution.

7. Retail Sales Support

Offeror shall the ability to support Lottery sales at brick-and-mortar retailers as described below:

a.) Retail Integrations Offeror shall have the ability to support the existing and planned retail sales program available at the time of start of implementation, such as withdraw vouchers, digital wallet use at retail, integrations to support communication with central gaming system, coupon validation, dissemination of digital products, QR code deep linking, connecting to retailer shopping carts, integrations with retailer websites and mobile apps to display games, cross-promotion using redemption codes, etc. The System shall have the ability to track and report on all available data related to retail support programs.

b.) Coupon System

Offeror shall have the ability to provide a coupon management system that can support cross-promotional strategies. The coupon management system shall be able to scale to handle all Rewards and other Lottery promotions. Coupons shall be printable as well as available digitally and provide an overall image template and barcode in a format designated by the Lottery. The coupons need to be available on-demand and at any denomination. Coupons shall have enforceable expiration dates tracked within the System. Offeror may need to provide APIs or other method (as designated by the Lottery) to integrate with the Lottery’s retail sales system to support validation of coupons at retail.

c.) Affiliate Program

Offeror shall have the ability to provide an Affiliate Program designed to expand and enhance online and retail partnerships. The Affiliate Program shall maintain all currently available affiliates and payment requirements. Specific requirements are listed below:

i Affiliate Program shall have the capability to capture performance of advertising as it relates to affiliates.

ii Offeror shall have the ability to be responsible for the technical requirements including licensing, asset management, commission management (to ensure affiliate commissions match with Lottery reporting), reporting, and affiliate retailer portal.

iii Affiliate Program…