PRIA Logo™
119-hr-6315119th Congress

SECURE IT Act

Sponsored By: Representative Valadao, David G. [R-CA-22]

Introduced

Summary

This bill would strengthen election cybersecurity by requiring penetration testing of voting systems and creating a five-year independent vulnerability disclosure pilot for election systems. It lays out who can test, how researchers are vetted, how vendors must respond to flaws, and legal safe harbors for participants.

Show full summary
  • Election system vendors would be able to opt into a voluntary pilot to make machines and source code available to vetted researchers. Vendors must patch or mitigate disclosed vulnerabilities and notify relevant State and local election officials and federal election agencies.
  • Cybersecurity researchers would undergo vetting, including background checks, before participating and would receive legal safe harbors from the Computer Fraud and Abuse Act and DMCA anti-circumvention rules. Vulnerabilities found under the program are exempt from Freedom of Information Act requests.
  • Accredited testing labs and standards bodies would be required to include penetration testing in voting system certification. The National Institute of Standards and Technology Director would recommend testing entities and the Election Assistance Commission would vote on their accreditation.
  • The program would set timelines for handling disclosures. Vulnerabilities must stay confidential for 180 days after notification and patches for certified systems get an expedited 90-day review window, after which an uncompleted review is deemed certified.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

2 provisions identified: 2 benefits, 0 costs, 0 mixed.

Five-year election security testing program

This bill would create a 5‑year, voluntary program for vetted security researchers to test election systems, including source code. Vendors could share systems for testing; researchers would be background‑checked and must report flaws to the vendor, the Commission, and the Secretary of Homeland Security. Researchers would keep findings confidential for 180 days; after a NIST‑defined critical or high flaw is reported, vendors would need to send a patch or mitigation to state and local officials and notify federal agencies. Patches for Commission‑certified systems would get a 90‑day fast review; if review is not finished in 90 days, the patch would be treated as certified. The program would give legal safe harbors for good‑faith research and keep reports out of FOIA; after 180 days, CISA would be told so the flaw can be added to the CVE list.

Required penetration tests for voting systems

This bill would require accredited penetration testing as part of testing, certification, decertification, and recertification of voting hardware and software. NIST would recommend and certify labs for this work, and the Election Assistance Commission would vote on accreditation. Accreditation would judge only a lab’s skill at penetration testing. These testing rules would need to be in place within 180 days of enactment.

Sponsors & CoSponsors

Sponsor

Valadao, David G. [R-CA-22]

CA • R

Cosponsors

  • Rep. Deluzio, Christopher R. [D-PA-17]

    PA • D

    Sponsored 11/25/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation