Amended May 18, 2018 Responses to Questions Received Regarding the Request for Proposals for Random Number Generator Systems and Support

Transcription

1 Amended May 18, 2018 Responses to Questions Received Regarding the Request for Proposals for Random Number Generator Systems and Support Please note, questions were edited for clarity. The Lottery s responses are in italics. Answers requiring an amendment to the RFP are in red. 1. Can you please explain how the background investigation of employees will take place? Will it happen directly by Minnesota Lottery or by a third party? Will it be done in a pre-defined time schedule? Does the background investigation subject to anyone in the company or those who are involved in the RFP process? The Division of Alcohol and Gambling Enforcement may investigate vendors prior to or after a contract has been signed. The Division will determine who will be investigated. The Lottery will review the results. 2. [Vendor] fulfils the requirement when it comes to experience and references. However, our customers prefer to be anonymous. The name of the clients can be revealed only if a NDA is signed. Is Minnesota Lottery willing to sign a NDA? No. The Lottery, as a public entity, cannot protect information beyond what is protected by the Minnesota Government Data Practices Act. Please note, trade secret materials as defined by the Minnesota Government Data Practices Act, Minn. Stat , may be marked pursuant to the RFP. 3. The RFP document states that the proposal has to be submitted by post (mailing envelop) on May 29. Is it possible to send the proposal by mail as we do not have any insight over delivery time of international post? Any delivery method is acceptable, but the proposals must be received before the deadline. Yes. 4. [Vendor] is a [foreign] company with no office in US. Do the insurance requirements apply? 5. Do the E-Verify certifications apply on [a foreign vendor]? Yes, the certification must be completed, but note that the E-Verify only applies to workers in the United States. 6. The RFP document states that the RNG must be able to run all current Lottery games. Can you please specify the word Run? In this context, run means produce random numbers via a computer system meeting the minimum requirements.

2 7. Please specify the meaning of matrix changes? Can you please provide a specific example? A matrix change is a change in parameters to an existing lottery game. In 2015, for example, the matrix for Power Ball changed from 5-59 plus 1-35 to 5-69 plus (Note: drawing Power Ball is not part of this RFP.) 8. Can you please be more specific about the meaning of Physically Secure? Physically secure is the protection from physical actions that could compromise the RNG system. The Minnesota Lottery wants vendors to explain how their proposed system is physically secure so that it can evaluate their proposed system. 9. Can you please be more specific about the meaning of Logically Secure? Logically secure is the software protection included in an RNG system to protect that system from unauthorized use. The Minnesota Lottery wants vendors to explain how their proposed system is logically secure so that it can evaluate their proposed system. 10. Can you please be more specific what type of report you are asking for and what is the goal of the audit? Does the RNG system has to provide a specific report with specific formats? The Minnesota Lottery expects every action and every change, including every input and output, to be recorded and capable of being reviewed in an audit. The Minnesota Lottery wants vendors to explain how their proposed system is auditable so that it can evaluate their proposed system. 11. Can you please explain what do you mean by Secure Linux OS and if Standard Linux OS is OK? The Minnesota Lottery does not anticipate an off-the-shelf version of the Linux OS would be sufficiently secure for its RNG. However, the RFP does state, if another OS is proposed, the company must provide explicit documentation how that OS will provide an equivalent (or higher) level of security than a Linux OS. 12. Can you please explain what exactly the system has to include as peripherals? The system has to support the peripherals, or the peripheral devices have to be included as part of the delivery solution? All peripherals (e.g. monitors, printers, keyboards, mice, etc.) needed to operate the RNG Systems should be included in the price and delivered to the Minnesota Lottery. 13. In case if the system must include peripherals, does the final quote include the RNG system and the peripherals as a whole or it has to be defined and quoted separately? Please see response to question The Lottery is asking for a minimum $2 million Professional (Errors & Omissions) insurance policy. Will the Lottery accept a $1 million limit for the Professional (Errors & Omissions) insurance policy? Yes. Please see the First Amended RFP.

3 15. The RFP requests a population of 10 billion for raffle and promotional games. This is a very high value and we would like to make sure that the Lottery requires such high population value. Such high population value will impact the price and length of time required for the RNG system certification. Please advise. This value should be 1 billion (1,000,000,000). Please see the First Amended RFP. 16. For the certification purpose, could the Lottery provide the highest number of winnings to be supported in a raffle and promotional draw? Currently, the highest number of winners in a raffle or promotional draw is 14,000 in the Minnesota Millionaire Raffle. To account for future growth, the RNG Systems should be certified support up to 25,000 winners in a single raffle or promotional drawing. 17. Could the Lottery explain more precisely what is meant by certification of systems is this RNG certification? If the certification scope is broader, could the Lottery provide more specific requirements for the certification, for example, is a security assessment of each RNG system requested in addition to the RNG certification? This is a certification of the RNG system by GLI. It does not include a broader security assessment. However, the Minnesota Lottery wants vendors to explain how their proposed system is secure so that it can evaluate their proposed system and any further certifications may help that evaluation. 18. In some jurisdictions yearly re-certifications of RNG systems are required. Will the MN Lottery require yearly or other re-certifications during the contract duration and if so should the costs be included in the bid price or will re-certifications after deployment be paid by the Lottery? The Minnesota Lottery wants to take delivery of systems fully certified by GLI for all current games. Any re-certifications would be the responsibility of the Minnesota Lottery. This includes re-certification after a game change or on any sort of periodic basis. 19. Would the Lottery be willing to accept RNG system certification also from other established certification laboratories used by the industry, e.g. Eclipse Testing, Delehanty Consulting /SeNet, etc.? No. The Minnesota Lottery prefers GLI. 20. When will the Lottery expect the delivery of the RNG systems? When is the first use of the RNG system expected in production date of the first draw? The Minnesota Lottery hopes to take delivery of the RNG Systems by July 1, 2018, but recognizes this timeline might not be possible. After announcing an apparent successful bidder, the Minnesota Lottery will negotiate a delivery schedule and will sign a 5-year contract that will commence upon delivery.

4 21. The Lottery is requesting standalone RNG systems. We understand that requirement to mean that each system is air gapped and it is not connected by network to any other system. Since there are different definitions of standalone systems - is this the correct understanding? Another requirement The RNG must have the capability to sync users across the three (3) systems., could be interpreted that there is a network connectivity between the RNG systems. Could the Lottery clarify their intentions regarding connectivity? The Minnesota Lottery s definition of standalone is air gapped. The Minnesota Lottery, however, is very interested in how to operate an air gapped RNG System that can be quickly and easily replaced by a backup in storage in a disaster situation without creating security risks. Please see the First Amended RFP and the Minnesota Lottery s response to questions 22 and Is the Lottery open to the inclusion of additional options that would significantly improve security of the solution or add other important features that are not directly required in the RFP (with separate pricing)? Yes. The Minnesota Lottery is interested in any additional offered options. Please clearly mark features and capabilities that are not included as part of the base price. The Minnesota Lottery will expect all features that are not clearly marked as optional will be delivered as part of the base price. 23. Can the requirement to only use a Linux Operating System (OS) be changed to require all Vendors to submit their security guidelines for any and all proposed Operating Systems (OS) along with installation and access procedures/protocols? Please see response to question Can [vendor] submit a bid that is based on our patent-pending alternative solution to the security of self-contained systems. Possibly. The Minnesota Lottery has attempted to draft the minimum requirements of the RFP to allow companies to showcase their approach to the problem of creating safe, secure, and easy to operate RNG Systems. Prior to receiving your question, the Minnesota Lottery assumed a standalone (i.e. selfcontained) air gapped system was the best way to design and operate an RNG. The Minnesota Lottery, however, is willing to evaluate your approach and is modifying the requirement that the system be standalone. The burden, however, is on you to show that your approach meets the modified requirements (including the minimum requirement that of having one North American lottery reference), is fully certified by GLI, is superior to standalone RNG systems, and may require a broader security assessment. Please see the First Amended RFP. 25. Can the Lottery provide samples of the reports and examples of the internal forms? Yes. See attached.

5 Minnesota State Lottery Winning Numbers Selection Draw Day: Monday Draw Date: May 14, 2018 Draw Time: 18:17:00 Draw Period: Evening Random Number Generator Machine: A Algorithm: MT Game Name: Daily 3 Draw Number: 8370 Winning Result for Daily 3 Draw is: Game Name: Northstar Cash Draw Number: 5334 Winning Numbers in DRAWN order are: Winning Numbers in ASCENDING order are: Game Name: Gopher 5 Draw Number: 2618 Winning Numbers in DRAWN order are: Winning Numbers in ASCENDING order are: John Doe Drawings Supervisor Jane Doe Auditor