Administrative Code

Creating a Report: Check the sections you'd like to appear in the report, then use the "Create Report" button at the bottom of the page to generate your report. Once the report is generated you'll then have the option to download it as a pdf, print or email the report.

Virginia Administrative Code
Title 11. Gaming
Agency 20. Department of Agriculture and Consumer Services, Charitable Gaming
Chapter 20. Charitable Gaming Regulations

11VAC20-20-240. Security requirements.

A. A distributed pull-tab system computer must be in a locked, secure enclosure with key controls in place.

B. A distributed pull-tab system shall provide a means for terminating the game set if information about electronic pull-tabs in an open game set has been accessed or at the discretion of the department. In such cases, traceability of unauthorized access, including time and date, users involved, and any other relevant information shall be available.

C. A distributed pull-tab system shall not permit the alteration of any accounting or significant event information that was communicated from the electronic gaming device without supervised access controls. In the event financial data is changed, an automated audit log must be capable of being produced to document the following:

1. Data element altered;

2. Data element value prior to alteration;

3. Data element value after alteration;

4. Time and date of alteration; and

5. Personnel that performed alteration.

D. A distributed pull-tab system must provide password security or other secure means of ensuring data integrity and enforcing user permissions for all system components through the following means:

1. All programs and data files must only be accessible via the entry of a password that will be known only to authorized personnel;

2. The distributed pull-tab system must have multiple security access levels to control and restrict different classes;

3. The distributed pull-tab system access accounts must be unique when assigned to the authorized personnel and shared accounts amongst authorized personnel must not be allowed;

4. The storage of passwords and personal identification numbers must be in an encrypted, nonreversible form; and

5. A program or report must be available that will list all registered users on the distributed pull-tab system, including the registered user's privilege level.

E. All components of a distributed pull-tab system that allow access to users, other than end- users for game play, must have a password sign-on with two-level codes comprising the personal identification code and a personal password.

1. The personal identification code must have a length of at least six American Standard Code for Information Interchange (ASCII) characters; and

2. The personal password must have a minimum length of six alphanumeric characters, which should include at least one nonalphabetic character.

F. A distributed pull-tab system must have the capability to control potential data corruption that can be created by multiple simultaneous log-ons by system management personnel.

1. A distributed pull-tab system shall specify which of the access levels allow for multiple simultaneous sign-ons by different users and which of the access levels do not allow for multiple sign-ons, and if multiple sign-ons are possible, what restrictions, if any, exist; or

2. If a distributed pull-tab system does not provide adequate control, a comprehensive procedural control document must be drafted for the department's review and approval.

G. Distributed pull-tab system software components or modules shall be verifiable by a secure means at the system level. A distributed pull-tab system shall have the ability to allow for an independent integrity check of the components or modules from an outside source, and an independent integrity check is required for all control programs that may affect the integrity of the distributed pull-tab system. This must be accomplished by being authenticated by a third-party device, which may be embedded within the distributed pull-tab system software or having an interface or procedure for a third-party application to authenticate the component. This integrity check will provide a means for field verification of the distributed pull-tab system components.

H. A distributed pull-tab system may be used to configure and perform security checks on electronic gaming devices, provided such functions do not affect the security, integrity, or outcome of any game and meets the requirements set forth in this chapter regarding program storage devices.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.

Website addresses provided in the Virginia Administrative Code to documents incorporated by reference are for the reader's convenience only, may not necessarily be active or current, and should not be relied upon. To ensure the information incorporated by reference is accurate, the reader is encouraged to use the source document described in the regulation.

As a service to the public, the Virginia Administrative Code is provided online by the Virginia General Assembly. We are unable to answer legal questions or respond to requests for legal advice, including application of law to specific fact. To understand and protect your legal rights, you should consult an attorney.