U. S. ELECTION ASSISTANCE COMMISSION VOTING SYSTEM TESTING AND CERTIFICATION PROGRAM

 1225 New York Avenue, NW, Suite 1100 

 Washington, DC. 20005 

Mary Saunders 

Chief, Standards Services Division 

National Institute of Standards and Technology 

100 Bureau Drive, Mail Stop 2100 

Gaithersburg, MD 20899 

July 10, 2008 

Dear Ms. Saunders, 

Now that many of the Voting System Test Laboratories (VSTLs) have completed their 2nd

NVLAP accreditation review, the EAC would like a status report from NVLAP on the items we 

noted as observations and concerns in our letter to you dated March 13, 2008. (Attached) 

Because these issues are so critical to the success of our certification program, we are requesting 

a response by August 8, 2008, or sooner if possible. 

Specifically, we are interested in updates on how SysTest Labs LLC, iBeta Quality Assurance, 

and Wyle Laboratories: 

 Assign appropriately qualified staff to EAC certification engagements. 

 Assure that testers have certification in specific critical areas, particularly a CISSP or 

similar certification for staff involved in security testing. 

 Prioritize EAC certification engagements in light of other State or local contractual 

responsibilities. 

 Use their quality management process to develop and validate test methods to ensure 

test-to-test and case-to-case repeatability. 

As you know, the credibility of the EAC Testing and Certification Program depends largely on 

having competent VSTLs to thoroughly test voting systems to the applicable Federal Standards. 

NVLAP review of the technical competency of these laboratories is a critical prerequisite to EAC 

accreditation of the VSTLs and provides assurance that the labs will function in accordance with 

internationally accepted standards for testing bodies. 

Thanks to you and the NVLAP staff for your continued great work and support. 

Sincerely, 

Brian J. Hancock 

Director, Testing and Certification 
U. S. ELECTION ASSISTANCE COMMISSION 

VOTING SYSTEM TESTING AND CERTIFICATION PROGRAM

1225 New York Avenue, NW, Suite 1100 

Washington, DC. 20005 

Mr. Mark Skall 

Chief, Software Diagnostics and Conformance 

Testing Division 

National Institute of Standards and Technology 

100 Bureau Dr. 

Gaithersburg, MD 20899-8970 

Ms. Mary Saunders 

Chief, Standards Services Division 

National Institute of Standards and Technology 

100 Bureau Drive, Mail Stop 2100 

Gaithersburg, MD 20899 

March 13, 2008 

Dear Ms. Saunders and Mr. Skall: 

The U.S. Election Assistance Commission (EAC) appreciates the work done by the 

National Voluntary Laboratory Accreditation Program (NVLAP) over the past two and 

one-half years to accredit Voting System Test Laboratories (VSTLs). We value our 

partnership established under Section 231 of the Help America Vote Act (HAVA) and 

continue to count on the expertise of NVLAP to assure the technical competency of the 

VSTLs. HAVA tasks NIST with the responsibility to “monitor and review, on an 

ongoing basis, the performance of the laboratories accredited by the Commission”. As 

such, NVLAP recommendations are a pillar of the EAC laboratory accreditation process 

and a key component to a successful certification program. 

Now that those VSTLs initially reviewed and accredited through the NVLAP program 

are approaching their second review pursuant to the renewal of their accreditation, the 

EAC believes this would be an appropriate time to discuss some observations and 

concerns gained from working with the VSTLs during recent EAC certification 

engagements. 
Because the VSTLs have moved forward quickly to hire the staff necessary to take on a 

heavy workload of voting system test engagements, we would like your upcoming 

reviews to include an evaluation of the following staffing related issues: 

• Please review the management process of each lab for assigning 

appropriately qualified staff to their EAC related voting system test 

engagements. 

• Review the qualifications of all staff members directly involved in the 

testing of voting systems to assure that each has the appropriate 

qualifications and appropriate certifications in their relevant testing areas 

(for example a CISSP or similar certification for staff involved in security 

testing). 

• Review how the VSTLs prioritize staffing for Federal testing 

engagements and other state or local voting system testing arrangements 

to ensure that testing is being conducted and managed by qualified 

personnel. 

Furthermore, as you know, NIST is in the process of developing a standardized suite of 

test methods for voting systems. Because the VSTLs do not yet have such standardized 

methodology, each lab must currently develop and validate unique test methods 

appropriate for voting systems. The EAC recommends NVLAP review these test methods 

and their validation by the VSTL’s to ensure that NIST remains confident of each 

VSTL’s ability to test voting systems. 

If NVLAP is unable for any reason to undertake any of the review items noted above, 

please inform the EAC at your earliest opportunity so that we may immediately pursue 

other avenues for laboratory review on these issues. 

Thank you once again for your ongoing work in this extremely important field of 

accreditation. The EAC and the voting public is indebted to NVLAP for this invaluable 

service to our country. 

Sincerely, 

Brian J. Hancock 

Director 

Testing and Certification 

2