§1900.1460. Software Change Management

a)         After testing, certification, and installation of a sports wagering system, any further changes to the software of the system must be in compliance with this Section.

 

b)         The sports wagering system must be tested and re-certified at least once every six months.

 

c)         Changes to the Sports Wagering System

 

1)         New Core Functions

 

A)        A "core function" is any function related to the placement, recording, and resolution of wagers, or any other function or feature that affects the security, integrity, availability, or record keeping of the sports wagering system.

 

B)        Any new core function must be tested and certified by the Administrator in accordance with Section 1900.1410 prior to installation on a live sports wagering system.

 

2)         Substantial Changes to Core Functions

 

A)        A "substantial change" is any change that directly affects the functionality of a core function.

 

B)        A master sports wagering licensee shall notify the Administrator prior to the installation of any substantial change to a core function on a live sports wagering system.  The notification shall include a clear identification of the core function that is affected, an explanation of the reason for the change, and an identification of any critical files affected.

 

C)        The Administrator or his or her designee may order that the substantial change be tested and certified in accordance with Section 1900.1410 prior to installation on a live sports wagering system.

 

D)        If the Administrator does not order testing and certification within three business days after the notification, the master sports wagering licensee may install the substantial change on the sports wagering system.

 

3)         Changes to Non-core Functions

 

A)        A "non-core function" is any other function of a sports wagering system that is not identified as a core function.

 

B)        A master sports wagering licensee is not required to notify the Administrator of changes to non-core functions, except when any such change is related to or impacts a core function.

 

4)         Emergency Changes

 

A)        When an unanticipated incident occurs that causes a disruption in the collection, accuracy, integrity, or availability of the sports wagering system, the master sports wagering licensee must notify the Board in accordance with Section 1900.1450(k).

 

B)        When such an incident is reported, the master sports wagering licensee may implement substantial changes to core functions of the sports wagering system without prior notification to the Administrator. 

 

C)        Emergency changes must be documented in the change log and the master sports wagering licensee shall notify the administrator immediately upon implementation of any emergency changes.

 

5)         Logging

 

A)        All changes to the sports wagering system must be recorded on a change log.

 

B)        The change log must include date, summary of change, requestor, implementer, and results.

 

C)        The change log must be made available to the Board upon request.

 

d)         Each master sports wagering licensee shall include in its internal control system information detailing the software change management process for the sports wagering system, internet wagering system, client software, and any other software that is a component part of those systems.  The internal control system must, at a minimum, address the following:

 

1)         Process Description

 

A)        Roles in change management process.

 

B)        Handling requests for change.

 

C)        Change classification procedure.

 

2)         Writing release notes.

 

3)         Administrator notification process.

 

4)         Change logging.

 

(Source:  Added at 45 Ill. Reg. 3460, effective March 4, 2021)