52 U.S.C. § 20971 — Certification and testing of voting systems

1. (a)Certification and testing
   1. (1)In generalThe Commission shall provide for the testing, certification, decertification, and recertification of voting system hardware and software by accredited laboratories.
   2. (2)Optional use by StatesAt the option of a State, the State may provide for the testing, certification, decertification, or recertification of its voting system hardware and software by the laboratories accredited by the Commission under this section.
2. (b)Laboratory accreditation
   1. (1)Recommendations by National Institute of Standards and TechnologyNot later than 6 months after the Commission first adopts voluntary voting system guidelines under subpart 3 of part A of this subchapter, the Director of the National Institute of Standards and Technology shall conduct an evaluation of independent, non-Federal laboratories and shall submit to the Commission a list of those laboratories the Director proposes to be accredited to carry out the testing, certification, decertification, and recertification provided for under this section.
   2. (2)Approval by Commission
      1. (A)In generalThe Commission shall vote on the accreditation of any laboratory under this section, taking into consideration the list submitted under paragraph (1), and no laboratory may be accredited for purposes of this section unless its accreditation is approved by a vote of the Commission.
      2. (B)Accreditation of laboratories not on Director listThe Commission shall publish an explanation for the accreditation of any laboratory not included on the list submitted by the Director of the National Institute of Standards and Technology under paragraph (1).
3. (c)Continuing review by National Institute of Standards and Technology
   1. (1)In generalIn cooperation with the Commission and in consultation with the Standards Board and the Board of Advisors, the Director of the National Institute of Standards and Technology shall monitor and review, on an ongoing basis, the performance of the laboratories accredited by the Commission under this section, and shall make such recommendations to the Commission as it considers appropriate with respect to the continuing accreditation of such laboratories, including recommendations to revoke the accreditation of any such laboratory.
   2. (2)Approval by Commission required for revocationThe accreditation of a laboratory for purposes of this section may not be revoked unless the revocation is approved by a vote of the Commission.
4. (d)TransitionUntil such time as the Commission provides for the testing, certification, decertification, and recertification of voting system hardware and software by accredited laboratories under this section, the accreditation of laboratories and the procedure for the testing, certification, decertification, and recertification of voting system hardware and software used as of October 29, 2002, shall remain in effect.
5. (e)Required penetration testing
   1. (1)In generalNot later than 180 days after December 18, 2025, the Commission shall provide for the conduct of penetration testing as part of the testing, certification, decertification, and recertification of voting system hardware and software by the Commission based on accredited laboratories under this section.
   2. (2)AccreditationThe Commission shall develop a program for the acceptance of the results of penetration testing on election systems. The penetration testing required by this subsection shall be required for Commission certification. The Commission shall vote on the selection of any entity identified. The requirements for such selection shall be based on consideration of an entity’s competence to conduct penetration testing under this subsection. The Commission may consult with the National Institute of Standards and Technology or any other appropriate Federal agency on lab selection criteria and other aspects of this program.