52 U.S.C. § 20971: Certification and testing of voting systems

The Commission shall provide for the testing, certification, decertification, and recertification of voting system hardware and software by accredited laboratories. At the option of a State, the State may provide for the testing, certification, decertification, or recertification of its voting system hardware and software by the laboratories accredited by the Commission under this section. Not later than 6 months after the Commission first adopts voluntary voting system guidelines under subpart 3 of part A of this subchapter, the Director of the National Institute of Standards and Technology shall conduct an evaluation of independent, non-Federal laboratories and shall submit to the Commission a list of those laboratories the Director proposes to be accredited to carry out the testing, certification, decertification, and recertification provided for under this section. The Commission shall vote on the accreditation of any laboratory under this section, taking into consideration the list submitted under paragraph (1), and no laboratory may be accredited for purposes of this section unless its accreditation is approved by a vote of the Commission. The Commission shall publish an explanation for the accreditation of any laboratory not included on the list submitted by the Director of the National Institute of Standards and Technology under paragraph (1). In cooperation with the Commission and in consultation with the Standards Board and the Board of Advisors, the Director of the National Institute of Standards and Technology shall monitor and review, on an ongoing basis, the performance of the laboratories accredited by the Commission under this section, and shall make such recommendations to the Commission as it considers appropriate with respect to the continuing accreditation of such laboratories, including recommendations to revoke the accreditation of any such laboratory. The accreditation of a laboratory for purposes of this section may not be revoked unless the revocation is approved by a vote of the Commission. Until such time as the Commission provides for the testing, certification, decertification, and recertification of voting system hardware and software by accredited laboratories under this section, the accreditation of laboratories and the procedure for the testing, certification, decertification, and recertification of voting system hardware and software used as of October 29, 2002 , shall remain in effect. Not later than 180 days after December 18, 2025 , the Commission shall provide for the conduct of penetration testing as part of the testing, certification, decertification, and recertification of voting system hardware and software by the Commission based on accredited laboratories under this section. The Commission shall develop a program for the acceptance of the results of penetration testing on election systems. The penetration testing required by this subsection shall be required for Commission certification. The Commission shall vote on the selection of any entity identified. The requirements for such selection shall be based on consideration of an entity’s competence to conduct penetration testing under this subsection. The Commission may consult with the National Institute of Standards and Technology or any other appropriate Federal agency on lab selection criteria and other aspects of this program.