Bill H.R. 7447

Bill H.R. 7447

To amend the Help America Vote Act of 2002 to require the Election Assistance Commission to provide for the conduct of penetration testing as part of the testing and certification of voting systems and to provide for the establishment of an Independent Security Testing and Coordinated Vulnerability Disclosure Pilot Program for Election Systems.

Short Title

This Act may be cited as the "Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing Act" or the "SECURE IT Act".

Requiring Penetration Testing as Part of Testing and Certification of Voting Systems

This section amends Section 231 of the Help America Vote Act of 2002 to require the Election Assistance Commission to include penetration testing as part of the testing, certification, decertification, and recertification of voting system hardware and software. The National Institute of Standards and Technology will recommend entities for accreditation to carry out the penetration testing.

Independent Security Testing and Coordinated Vulnerability Disclosure Pilot Program for Election Systems

This section establishes a 5-year pilot program called the Independent Security Testing and Coordinated Vulnerability Disclosure Pilot Program for Election Systems (VDP-E). The program aims to test and disclose cybersecurity vulnerabilities in election systems.

The program will:

Provide a mechanism for election systems vendors to make their systems available to cybersecurity researchers participating in the program.
Vet cybersecurity researchers and establish terms of participation.
Require researchers to notify the vendor, the Election Assistance Commission, and the Secretary of any cybersecurity vulnerabilities they identify.
Require vendors to send patches or fixes for critical or high vulnerabilities to appropriate State and local election officials and notify the Commission and the Secretary.
Establish a process for expedited review of patches or fixes intended for certified systems.
Require researchers to keep vulnerabilities confidential for 180 days after notification.
Notify the Director of the Cybersecurity and Infrastructure Security Agency of disclosed vulnerabilities for inclusion in a database of common vulnerabilities and exposures.

The participation in the program is voluntary for vendors and researchers. Research conducted under the program will be treated as authorized and exempt from certain legal actions. Any cybersecurity vulnerabilities discovered under the program will be exempt from disclosure under the Freedom of Information Act.

Definitions

The bill also includes definitions for terms used in the bill, such as cybersecurity vulnerability, election infrastructure, election system, election system vendor, information system, Secretary, and security vulnerability.

Rep. David Valadao

Stats

Sponsored Legislation