Software Change Management

PURPOSE: This rule establishes standards for software change management. (1) As used in this rule, the following terms shall have the following meaning: (A) A core function is any function related to the placement, recording, and resolution of wagers, or any other function or feature that affects the security, integrity, availability, or recordkeeping of the sports wagering system in Missouri; (B) A substantial change is any change that directly affects the functionality of a core function; (C) A non-core function is any other function of a sports wagering system that is not identified as a core function. (2) After testing, certification, approval, and installation of a sports wagering system, any further changes to the software of the system must be in compliance with this rule. (3) Any new core function shall be tested and certified by a licensed independent testing laboratory (ITL) and approved by the commission in accordance with this chapter prior to installation on a live sports wagering system. (4) A Retail or Mobile licensee shall notify the commission prior to the installation of any substantial change to a core function on a live sports wagering system. The notification shall include a clear identification of the core function that is affected, an explanation of the reason for the change, and an identification of any critical files affected. The commission may order that the substantial change be tested, certified, and GAMING COMMISSION approved in accordance with this chapter prior to installation on a live sports wagering system. If the commission does not order testing and certification within three (3) business days after the notification, the Retail or Mobile licensee may install the substantial change on the sports wagering system. (5) When an unanticipated incident occurs that causes a disruption in the collection, accuracy, integrity, or availability of the sports wagering system, the Retail or Mobile licensee shall notify the commission in writing by the end of the following calendar day. When such an incident is reported, the Retail or Mobile licensee may implement substantial changes to core functions of the sports wagering system without prior notification to the commission. (6) Emergency changes shall be documented in the change log and the Retail or Mobile licensee shall notify the commission in writing within twenty-four (24) hours upon implementation of any emergency changes. The notification to the commission shall include the information documented on the change log. Upon review of the change, the commission may order the change be tested, certified, and approved. (7) The change log shall— (A) Include all changes to the sports wagering system; (B) Include the date of change, summary of change, implementer, and results of the change; and (C) Be made available to the commission upon request. (8) Each Retail and Mobile licensee shall include in its internal control system information detailing the software change management process for the sports wagering system, online sports wagering platform, client software, and any other software that is a component of those systems. The internal control system must, at a minimum, address the following: (A) A description of the process, including— 1. Roles in change management process, including segregation of duties; 2. Testing in a non-production environment; 3. Handling requests for change; 4. Installation of changes into the production environment; 5. Change classification procedure; and 6. Procedures for rollback of changes; (B) Writing release notes; (C) Commission notification process; and (D) Creating entries on the change log. AUTHORITY: section 39(g) of Article III, Mo. Const., section 313.004, RSMo 2016, and sections 313.800–313.850, RSMo 2016 and Supp. 2025.* Original rule filed May 14, 2025, effective Nov. 30, 2025. *Original authority: 313.004, RSMo 1993, amended 1994, 2014, and 313.800-313.850, see Revised Statutes of Missouri, 2016 and Supp. 2025.