Section 3775-16-02 - Sports gaming system change management(A) The responsible licensee for each sports gaming system must implement change management policies and procedures for tracking and controlling changes made to the system. The change management policies and procedures must include: (1) Procedures for testing proposed changes in a non-production environment. The non-production environment must be segregated from the production environment and not have the capability to alter data in the production environment;(2) Procedures for the classification of changes in accordance with paragraph (B) of this rule;(3) Procedures for the installation of changes into the production environment;(4) Procedures for the rollback of changes;(5) Procedures for documenting each phase of the change management process;(6) Procedures for logging all changes to the system; and(7) Policies to ensure appropriate segregation of duties to prevent unintended changes from occurring.(B) Changes made to sports gaming systems must be reviewed and classified by the responsible licensee as follows: (1) "High Impact" is any change to, or addition of, components which impact the operational integrity of the system. Components include, but are not limited to, any component deemed to be critical by the certified independent test lab.(2) "Low Impact" is any other change to the sports gaming system.(C) High Impact changes require commission notification at least five business days prior to installation. The installation may be denied or delayed at the discretion of the executive director.(D) Changes made to the sports gaming system that are necessary to remediate an immediate threat or liability may be installed immediately. The commission must be notified of the change within forty-eight hours of implementation.(E) The executive director may require any changes be tested by a certified independent testing laboratory, with testing completed and a testing laboratory letter provided to the commission within ninety days.Ohio Admin. Code 3775-16-02
Effective: 8/15/2022
Five Year Review (FYR) Dates: 08/15/2027
Promulgated Under: 119.03
Statutory Authority: 3775.02
Rule Amplifies: 3775.01, 3775.02