Security

# (a)

Director of security. Any director of security the CLC may employ shall be a duly qualified, full time director of security licensed by the executive director as a class II occupational licensee. The duties of the director of security include, but are not limited to, responsibility for the security of CLC buildings and facilities and for monitoring the wearing of badges at said facilities.

# (b)

Division security unit. The security unit within the division shall enforce all regulations and state statutes as adopted by legislation pertaining to the CLC, ensuring that the lottery is operated with absolute integrity and for the public good.
The division security unit shall have overall responsibility for both regulatory and criminal investigations. The division security unit chief shall have the discretion to determine the need to conduct an investigation into any and all perceived or actual incidents or violations.

# (c)

Reporting requirements.

# (1)

The CLC shall immediately report to the division all incidents or allegations of misconduct involving any CLC employee, vendor employee or lottery retailer that threatens the integrity of the lottery. In addition to the reporting requirements established by section 4-33a of the Connecticut General Statutes, the CLC shall also notify the division of any unauthorized, illegal, irregular or unsafe handling or expenditure of state or quasi-public agency funds.

# (2)

The CLC shall immediately report to the division all statutory, regulatory and criminal incidents, or allegations of incidents. The division, in its sole discretion, may conduct its own investigation into any and all suspected incidents or violations.

# (3)

Failure by the CLC to report said incidents in a timely manner may be cause for license suspension or revocation of CLC officers, after being afforded the opportunity for a hearing in accordance with sections 12-568a-1 to 12-568a-23, inclusive, of the Regulations of Connecticut State Agencies, and the division rules of practice and hearing procedures.

# (d)

Division notification of system problems and disruptions.

# (1)

The CLC shall notify the division immediately of all material system problems, downtime, disruptions, or system modifications involving lottery games and/or tickets. Upon notification, the CLC shall estimate the time needed to bring the system back to full operation. Thereafter, the CLC shall provide a documented report of the events causing the disruption, the steps taken to resolve the situation, and the name of a contact person in the event additional clarifications are warranted.

# (2)

Failure to immediately report said incidents may be cause for license suspension or revocation of CLC officers, after being afforded the opportunity for a hearing in accordance with sections 12-568a-1 to 12-568a-23, inclusive, of the Regulations of Connecticut State Agencies, and the division rules of practice and hearing procedures.

Division of Special Revenue § 12-568a-20

# (e)

Drawings. Division security representatives shall oversee drawings conducted by the CLC. Division security shall formulate, implement, and conduct security procedures for all drawings, and shall be responsible for the safeguarding and testing of all drawing equipment. The division security shall have sole responsibility for the ultimate decision for any and all drawing problems or circumstances that may arise.

# (f)

Security of transaction tapes prior to the drawings. Until such time as an Internal Control System (ICS) provides the division with direct access to transaction tapes, division security representatives shall take possession of transaction tapes from the on-line vendor prior to any drawing being held.

# (g)

Promotional drawings. The CLC shall provide the division with advance notice of, and drawing procedures for, any promotional drawings. Said procedures shall be reviewed by the division and approved prior to said events being held.
The division security representatives shall oversee promotional drawings. Division security shall have sole responsibility for the ''final call'', in the event of any drawing problems or circumstances that may arise.

# (h)

Unfettered access to, inspection of, and monitoring of all CLC facilities.
Employees of the division and its designated representatives shall have the right to unannounced and unfettered entry to all CLC and vendor facilities. Division security shall inspect CLC and vendor facilities for possible breaches of security and physical standards. The CLC shall ensure that all vendors comply with physical security standards as approved by the division.

# (i)

Instant tickets. The CLC shall submit working papers for instant games to the division. The division shall review and approve said papers for integrity purposes prior to ticket production. Division security representatives shall obtain a sample of instant tickets during production and shall submit such samples to an approved independent laboratory for testing purposes. Tickets shall not be allowed to be distributed by the CLC until the independent laboratory results are received and approved by the division.

# (j)

Master system console logs. The CLC shall maintain system console logs of activity for the on-line system. These console log reports shall reflect all system activity, including, but not limited to, all system access, system transmissions and system errors.

# (k)

Retention and inspection of system console logs. The CLC shall retain all system console logs. The logs shall be in a media and format acceptable to the division and shall be retained for no less than five (5) years. The division, in its sole discretion, may request to review the system console logs at any time.

# (l)

Disaster recovery. The CLC shall submit for division approval a disaster recovery plan for the on-line system.

# (m)

Redundant fault-tolerant system. The CLC shall insure the on-line system records each transaction in at least two separate locations for each processor.

# (n)

Ticket validation requirements. The CLC shall set minimum ticket validation requirements for both instant and on-line tickets subject to division approval.
All claims presented shall be verified in accordance with established procedures for validating winning tickets processed through the on-line system.

# (o)

Ticket purge requirements for winning tickets. The on-line vendor shall utilize software that restricts access to nearly purged or soon to be purged winning tickets, and insures reporting controls to detect unusual cashing activity by agents, the on-line vendor, and the CLC. The CLC shall provide system reports on a regular basis, as determined by the division, which identify the cashing of nearly purged or soon to be purged tickets.

# (p)

Tampering with pools, liabilities, winfiles/console log review. The on-line vendor shall utilize software protection in the on-line system to prohibit CLC or vendor employees from tampering with pools, liabilities or winfiles. The on-line vendor shall produce system pool reports generated immediately at the close of games. These reports shall be provided to the division to verify liabilities. If an attempt is made to tamper with information, such activity shall be indicated on the system console log.

# (q)

System management reports. The CLC shall provide system reports which reveal all system activity generated at and by the terminals, including, but not limited to: wagers, cashes, cancels, errors, statuses, validations, activations, deactivations, special reports, sign-ons, sign-offs, inquiries, and diagnostic requests. These reports shall be available upon the division's request and shall be used to verify the operating status of the system and agent terminals.

# (r)

Liability for loss of data.

# (1)

In the event of loss of any data or records necessary for the performance of division duties, where such loss is due to the error or negligence of the CLC, the CLC shall cause the vendor to recreate such lost data or records at the CLC's own expense.

# (2)

In the event of loss of any data or records necessary for the performance of division duties, where such loss is due to the error or negligence of the vendor, the CLC shall cause the vendor to recreate such lost data or records at the vendor's own expense.