1. A. A manufacturer may not perform from a remote location analysis of, or technical support with regard to, a video lottery terminal without:

   1. (1) Submission of a written request to the Commission; and
   2. (2) The written approval of the Commission.

2. B. A manufacturer may perform from a remote location analysis of, or technical support with regard to, a facility operator’s video lottery systems including, but not limited to, a:

   1. (1) Gaming ticket system;
   2. (2) Promotional play system;
   3. (3) Player tracking system;
   4. (4) External bonusing system;
   5. (5) Cashless funds transfer system; and
   6. (6) Wide area progressive system.

3. C. A facility operator intending to authorize remote access to a video lottery system under this regulation shall include in its internal controls submitted for Commission approval under COMAR 36.03.10.05 a written system of access protocols which require:

   1. (1) A unique system account for each employee of a manufacturer identified by the manufacturer as potentially required to perform technical support from a remote location;
   2. (2) Use of a dedicated and secure communication facility;
   3. (3) The facility operator to provide the Commission with notice of access within 4 hours after a person remotely accesses a system;
   4. (4) The facility operator to take affirmative steps, on a per access basis, to activate a manufacturer’s access privileges;

   5. (5) Imposition of limits on the ability of any individual authorized under this regulation to deliberately or inadvertently interfere with:

      1. (a) The normal operation of the system; and
      2. (b) Its data; and

   6. (6) An access log:

      1. (a) Maintained by both the:

         1. (i) Manufacturer; and
         2. (ii) Facility operator’s information technology department;

      2. (b) Maintained in:

         1. (i) A book with bound numbered pages that cannot be readily removed; or
         2. (ii) An electronic format equipped with software that prevents modification of an entry after it has been initially entered into the system; and

      3. (c) Documenting the:

         1. (i) Manufacturer version number of the system accessed;
         2. (ii) Type of connection as leased line, dial in modem, or private WAN;
         3. (iii) Name of the manufacturer employee remotely accessing the system;
         4. (iv) Name of the information technology department employee activating the manufacturer's access to the system;
         5. (v) Date and time of the connection;
         6. (vi) Duration of the connection;
         7. (vii) Reason for the remote access including a description of the symptoms or malfunction prompting the need for remote access to the system; and
         8. (viii) Any action taken or further action required.
4. D. A facility operator may not authorize a manufacturer to remotely access a video lottery system until its system access protocols are approved in writing by the Commission.

5. E. Any modification to a system required to be tested, certified, and approved by the Commission under Regulation .02E of this chapter shall be processed as:

   1. (1) An emergency modification under Regulation .07 of this chapter; or
   2. (2) A standard modification under Regulations .03C and .04C of this chapter.

6. F. If an employee of a manufacturer is no longer employed or authorized by a manufacturer to remotely access a system pursuant to this regulation, the manufacturer shall:

   1. (1) Immediately notify in writing:

      1. (a) Any facility operator that has established a unique system account for that employee of the change in authorization; and
      2. (b) The Commission; and
   2. (2) Verify with each facility operator notified of the change in authorization that the access privileges of the individual have been revoked.

Authority: State Government Article, §§9-1A-02, 9-1A-04, 9-1A-15, 9-1A-22, and 9-1A-24, Annotated Code of Maryland

Effective date:

Regulations .01—.32 adopted as an emergency provision effective March 1, 2013 (40:6 Md. R. 470); adopted permanently effective April 29, 2013 (40:8 Md. R. 725)

Regulation .01A amended effective October 27, 2014 (41:21 Md. R. 1262)

Regulation .11 amended effective November 14, 2022 (49:23 Md. R. 997)

Regulation .11D amended as an emergency provision effective December 12, 2023 (50:26 Md. R. 1130); amended permanently effective May 27, 2024 Md. R. 529)

Regulation .11E, I amended effective January 7, 2016 (42:26 Md. R. 1597)

Regulation .12C adopted effective October 7, 2019 (46:20 Md. R. 848)

Regulation .18 amended effective October 19, 2020 (47:21 Md. R. 905)

Regulation .18D, E amended effective October 22, 2018 (45:21 Md. R. 976)

Regulation .20A amended effective October 23, 2017 (44:21 Md. R. 985)

Regulation .20B amended effective February 16, 2015 (42:3 Md. R. 319)

Regulation .21 amended effective October 7, 2019 (46:20 Md. R. 848)

Regulation .21E amended effective October 22, 2018 (45:21 Md. R. 976)

Regulation .27B, D amended effective September 6, 2021 (48:18 Md. R. 695)

Regulation .28F amended effective September 26, 2016 (43:19 Md. R. 1073); October 19, 2020 (47:21 Md. R. 905)

Regulation .30D amended effective October 22, 2018 (45:21 Md. R. 976); September 6, 2021 (48:18 Md. R. 695)

Regulation .30D, E amended effective January 7, 2016 (42:26 Md. R. 1597)

Regulation .31C amended effective October 23, 2017 (44:21 Md. R. 985); October 22, 2018 (45:21 Md. R. 976); October 7, 2019 (46:20 Md. R. 848)