§20971 Certification and Testing of Voting Systems

Summary

The Commission must set up testing, certification, decertification, and recertification of voting system hardware and software through labs it approves. States may choose to use those approved labs for their own testing. Within 6 months after the Commission first creates the voluntary voting system guidelines, the Director of the National Institute of Standards and Technology (NIST) must review independent, non-Federal labs and give the Commission a list of suggested labs. The Commission must vote to approve any lab’s accreditation. If it approves a lab not on NIST’s list, the Commission must explain why. NIST will keep monitoring approved labs and can recommend revoking accreditation, but the Commission must vote to revoke. Until the Commission sets up this system, the lab approvals and testing rules in place on October 29, 2002 stay in effect. By 180 days after December 18, 2025, the Commission must require penetration testing as part of certification, make a program to accept those test results, and vote on and choose competent entities to do the testing, consulting NIST or other agencies if needed.