§20971 Certification and Testing of Voting Systems

Summary

The Commission must set up testing, certification, decertification, and recertification of voting system hardware and software to be done by labs it accredits. A State can choose to use those accredited labs. Within 6 months after the Commission first adopts voluntary voting system guidelines under subpart 3 of part A of this subchapter, the Director of the National Institute of Standards and Technology (NIST) must review independent non-Federal labs and give the Commission a list of labs recommended for accreditation. The Commission votes to approve any lab. If it approves a lab not on NIST’s list, the Commission must explain why. NIST will keep watching accredited labs and may recommend that a lab lose its accreditation, but the Commission must vote to revoke accreditation. Existing lab accreditations and procedures in use on October 29, 2002, stay in place until the Commission sets up the new system. Within 180 days after December 18, 2025, the Commission must include penetration testing in its lab-based testing and certification program and create a way to accept those test results. Penetration testing will be required for Commission certification. The Commission will vote on who is selected to perform or be accepted for such testing and will base choices on the entity’s ability to do penetration testing. The Commission may consult NIST or other federal agencies on selection criteria.