> **Risk Assessment Summary**
>
> In August 2007, the TGDC delivered a set of recommendations for the
> next version of the Voluntary Voting System Guidelines (VVSG) to the
> EAC. These recommendations considerably expand the number of security
> requirements for voting systems. They also introduce several new
> concepts to be applied in system design and testing. The EAC must
> decide how to utilize these recommendations as they create the next
> iteration of the EAC voting system standards. This requires answering
> the question of how to specify a sufficient level of security
> protection without requiring disproportionate tradeoffs against other
> desirable attributes such as ease of use, efficiency of operation, and
> reasonable cost. At present, there is no federal analysis of the
> security threats to voting systems and the potential resulting harms.
> Thus there is an insufficient basis for determining what constitutes
> an acceptable level of risk. Without such a benchmark, it is
> impossible to make an informed decision on what constitutes a
> sufficient level of security protection.
>
> Consequently, the EAC requires a scientifically founded voting systems
> risk assessment to facilitate decisions relative to voting system
> standards. This assessment must encompass the complete range of voting
> system technologies -- paper-based systems, optical scan, DREs, etc.
> The product of this analysis must be a methodology or model that the
> EAC, and other stakeholders, can exercise independently without the
> assistance of specialized experts. The product will serve as an
> analytical tool to assist the EAC in evaluating trade-offs, running
> sensitivity analyses, and making determinations about voting system
> security requirements.
>
> The objective and scope of the project are provided below:

**2.0 Objective** The principal objective of this contract is to procure
the services of a well-qualified and broadly-based team to develop a
comprehensive voting systems risk assessment tool. The various elements
comprising this effort are described below. This is a three phase
process. The first phase will create reference models to be used in the
assessment. This includes developing election process models to describe
the operational context in which voting systems are used. It also
entails developing voting systems models by generic technology type.
This is needed because the types of threats encountered and their
potential impacts vary by technology.

> These models will be used in the second phase to develop a threat
> matrix associated with each election model and technology type, and to
> perform the risk assessment of the potential harms and possible
> mitigations. The final phase will document the models developed and
> the analyses performed so that the EAC, election officials, and other
> stakeholders can use these tools. The EAC is required to specify
> security requirements for the national certification of voting
> systems. State and local election officials need to perform
> assessments of the adequacy of security practices at the local level.
> Manufacturers should utilize these tools for system design purposes,
> and test labs for developing test scenarios.

**3.0 Scope** The Contractor shall be responsible for performing all the
tasks described below. It is the intention of the EAC that the
Contractor team be very broadly based in terms of knowledge and
experience, both theoretical and applied. It needs to include academic
researchers as well as individuals with direct experience in developing
and implementing secure IT systems. Election administration experience
must also be represented on the team.

> A substantial amount of work has already been done on risk assessments
> for secure IT systems and also for voting systems. The Contractor is
> expected to review this work and utilize it as appropriate. The tasks
> described below are based on the process described in NIST Special
> Publication 800-30, "Risk Management Guide for Information Technology
> Systems," July 2002. It is recommended that bidders be familiar with
> the methodology described in this document.
>
> Participants for review panels shall be identified by the Contractor
> in consultation with the EAC. The EAC shall be responsible for
> scheduling and convening peer reviews by the National Institute of
> Standards and Technology (NIST), the EAC Standards Board, and the EAC
> Board of Advisors called for in Tasks 4.8 and 4.14.