U.S. Election Assistance Commission

633 3rd St. NW, Suite 200 

Washington, DC 20001

BEFORE THE ELECTION ASSISTANCE COMMISSION

In the Matter of: ) 

) 

Adopting the Recommendation on the Allocability ) 

of Election Security Measures Under EAC Policy ) 

Regarding Authority to Issue Funding Decision ) 

on Use of HAVA Funds ) 

) 

CERTIFICATION

I, Christy McCormick, Chairwoman of the Election Assistance Commission, do hereby 

certify that on July 27, 2023 the Commission decided by a vote of 4-0 the following 

action(s): 

1. 

The Commission has adopted the Recommendation on the Allocability of Election

Security Measures Under EAC Policy Regarding Authority to Issue Funding Decision on 

Use of HAVA Funds. This Decision becomes effective as of the date of this certification. 

Commissioners McCormick, Hovland, Palmer, and Hicks approved the recommendation. 

Attest: 

______________________ ____________________________ 7/27/2023

Date Christy McCormick

Chairwoman
U.S. Election Assistance Commission

633 3rd St. NW, Suite 200 

Washington, DC 20001

TALLY VOTE MATTER

DATE & TIME OF TRANSMITTAL: Wednesday, July 26, 2023, at 11 AM 

BALLOT DEADLINE: Friday, July 28, 2023, at 5 PM

COMMISSIONERS: McCormick, Hovland, Palmer, and Hicks

SUBJECT: Approving the Recommendation on the Allocability of Election Security 

Measures Under EAC Policy Regarding Authority to Issue Funding 

Decision on Use of HAVA Funds 

( ) I approve the recommendation.

( ) I disapprove the recommendation. 

( ) I object to the recommendation.

( ) I am recused from voting.

COMMENTS: ____________________________________________________ 

________________________________________________________________ 

________________________________________________________________ 

DATE: 7/26/2023________________ SIGNATURE: __________________________

A definite vote is required. All ballots must be signed and dated. Please return ONLY 

THE BALLOT to the Office of General Counsel. Please return the ballot no later than 

date and time shown above. 

From: Camden Kelliher, EAC Senior Associate Counsel 
U.S. Election Assistance Commission

633 3rd St. NW, Suite 200

Washington, DC 20001

TALLY VOTE MATTER

DATE & TIME OF TRANSMITTAL: Wednesday, July 26, 2023, at 11 AM

BALLOT DEADLINE: Friday, July 28, 2023, at 5 PM

COMMISSIONERS: McCormick, Hovland, Palmer, and Hicks

SUBJECT: Approving the Recommendation on the Allocability of Election Security 

Measures Under EAC Policy Regarding Authority to Issue Funding 

Decision on Use of HAVA Funds

( ) I approve the recommendation.

( ) I disapprove the recommendation. 

( ) I object to the recommendation.

( ) I am recused from voting.

COMMENTS: ____________________________________________________

________________________________________________________________

________________________________________________________________

DATE: ________________ SIGNATURE: __________________________

A definite vote is required. All ballots must be signed and dated. Please return ONLY 

THE BALLOT to the Office of General Counsel. Please return the ballot no later than 

date and time shown above.

From: Camden Kelliher, EAC Senior Associate Counsel 

7/27/2023
U.S. Election Assistance Commission

633 3rd St. NW, Suite 200

Washington, DC 20001

TALLY VOTE MATTER

DATE & TIME OF TRANSMITTAL: Wednesday, July 26, 2023, at 11 AM

BALLOT DEADLINE: Friday, July 28, 2023, at 5 PM

COMMISSIONERS: McCormick, Hovland, Palmer, and Hicks

SUBJECT: Approving the Recommendation on the Allocability of Election Security 

Measures Under EAC Policy Regarding Authority to Issue Funding 

Decision on Use of HAVA Funds

( ) I approve the recommendation.

( ) I disapprove the recommendation. 

( ) I object to the recommendation.

( ) I am recused from voting.

COMMENTS: ____________________________________________________

________________________________________________________________

________________________________________________________________

DATE: ________________ SIGNATURE: __________________________

A definite vote is required. All ballots must be signed and dated. Please return ONLY 

THE BALLOT to the Office of General Counsel. Please return the ballot no later than 

date and time shown above.

From: Camden Kelliher, EAC Senior Associate Counsel 

7/27/2023
U.S. Election Assistance Commission

633 3rd St. NW, Suite 200

Washington, DC 20001

TALLY VOTE MATTER

DATE & TIME OF TRANSMITTAL: Wednesday, July 26, 2023, at 11 AM

BALLOT DEADLINE: Friday, July 28, 2023, at 5 PM

COMMISSIONERS: McCormick, Hovland, Palmer, and Hicks

SUBJECT: Approving the Recommendation on the Allocability of Election Security 

Measures Under EAC Policy Regarding Authority to Issue Funding 

Decision on Use of HAVA Funds

( ) I approve the recommendation.

( ) I disapprove the recommendation. 

( ) I object to the recommendation.

( ) I am recused from voting.

COMMENTS: ____________________________________________________

________________________________________________________________

________________________________________________________________

DATE: ________________ SIGNATURE: __________________________

A definite vote is required. All ballots must be signed and dated. Please return ONLY 

THE BALLOT to the Office of General Counsel. Please return the ballot no later than 

date and time shown above.

From: Camden Kelliher, EAC Senior Associate Counsel 

7/27/2023
U.S. Election Assistance Commission

633 3rd St. NW, Suite 200

Washington, DC 20001

MEMORANDUM

TO: Commissioners McCormick, Hovland, Palmer, and Hicks

FROM: Camden Kelliher, EAC Senior Associate Counsel

DATE: July 26, 2023

RE: Allocability of Election Security Measures Under EAC Policy Regarding 

Authority to Issue Funding Decision on Use of HAVA Funds

BACKGROUND

In 2015 the Commission adopted the, “Policy Regarding Authority to Issue Funding Decision on 

Use of HAVA Funds” (Funding Decision Policy). The Funding Decision Policy replaced the 

Advisory Opinion Process originally adopted by the EAC on April 16, 2008. The Funding 

Decision Policy explains that the Commissioners may consider any request related to questions 

of law and factual issues related to HAVA when:

(1) The legal issue is novel, complex and pertains to an unsettled question of law or 

interpretation of the HAVA statute; or

(2) The issue relates to an expenditure of HAVA funds that has not been previously 

addressed by OMB, the grant provisions or the EAC and for which it is determined to 

have significant policy implications for the implementation of HAVA; or

(3) There has been intervening legislation, rulemaking, or litigation since the EAC last 

considered the issue; or

(4) The request is contrary to or otherwise inconsistent with prior EAC matters dealing 

with the same issue.

The EAC Office of General Counsel, in consultation with the Commissioners, shall determine 

the eligibility of questions presented under these four categories. 

QUESTION PRESENTED

The EAC Office of General Counsel has concluded that there is currently a question before the 

agency, appropriately presented by the state of Nebraska, that is ripe for review under the 

Funding Decision Policy. That question is summarized as follows:

When an expenditure for cybersecurity enhancements that is allowable under HAVA 

Subsection F impacts non-election systems, but is specifically undertaken for the benefit 

to election security, must a state allocate the ancillary benefit under 2 CFR 200.405?

RECOMMENDATION

Under the Policy Regarding Authority to Issue Funding Decision on Use of HAVA Funds, the 

EAC Commissioners should consider whether a state may fully allocate the cost of a 
cybersecurity enhancement, undertaken with the objective of improving voting technology. As 

documented in the supporting memorandum provided by the Office of General Counsel, there 

are important policy considerations involved in this determination. This is highlighted by the 

changing election administration landscape and the interrelationship of cybersecurity networks.

Because HAVA specifically contemplates the improvement of voting technology, I recommend 

that the Commission consider allowable cybersecurity enhancements direct costs and allow full 

allocability under Subsection F of HAVA when the costs are reasonable and necessary and when 

the cost is incurred specifically for the purpose of benefitting election administration. The EAC 

Office of Grants Administration, in consultation with the Office of General Counsel, shall 

provide guidance on how states may attest and document that expenditures qualify as direct costs 

for the purpose of allocation. 

Attachment.
U.S. Election Assistance Commission

633 3rd St. NW, Suite 200

Washington, DC 20001

M E M O R A N D U M

TO: EAC Commissioners McCormick, Hovland, Palmer, and Hicks

CC: Steven Frid, Executive Director

FROM: Camden Kelliher, EAC Senior Associate Counsel

DATE: July 25, 2023

RE: Question on Allocability of Election Security Measures Under EAC Policy Regarding 

Authority to Issue Funding Decision on Use of HAVA Funds

The purpose of this memorandum is to provide a legal analysis of a question presented by the 

state of Nebraska under the EAC Policy Regarding Authority to Issue Funding Decision on Use 

of HAVA Funds. The memorandum analyzes the Policy, provides background on the question 

presented, decides on the applicability of the Policy to the question presented, and makes a 

recommendation to the Commission on the resolution of the question presented under the Policy.

EAC FUNDING DECISION POLICY

In 2015 the Commission adopted the, “Policy Regarding Authority to Issue Funding Decision on 

Use of HAVA Funds” (Funding Decision Policy). The Funding Decision Policy replaced the 

Advisory Opinion Process originally adopted by the EAC on April 16, 2008. The Funding 

Decision Policy was adopted, “to provide a means for persons and entities to have legal or 

factual questions related to the implementation of HAVA considered by Commissioners outside 

of EAC's audit resolution process.” The Funding Decision Policy is not intended to replace or 

disrupt the role of the Office of Grants Management (OGM), which is responsible for issuing 

guidance, support and, when appropriate, approval/denial of certain expenditure of Federal funds 

under the Help America Vote Act (HAVA) and the relevant Office of Management and Budget

(OMB) Circulars found in 2 C.F.R. Parts 220, 225, 215, and 230. The approval package of the 

Funding Decision Policy specifically maintains that OGM will respond to day-to-day and routine 

HAVA questions that do not have policy implications.

To distinguish what questions are outside of the “day-to-day and routine HAVA questions,” the

policy explains that the Commissioners may consider any request related to questions of law and 

factual issues related to HAVA when:

(1) The legal issue is novel, complex and pertains to an unsettled question of law or 

interpretation of the HAVA statute; or

(2) The issue relates to an expenditure of HAVA funds that has not been previously 

addressed by OMB, the grant provisions or the EAC and for which it is determined to 

have significant policy implications for the implementation of HAVA; or
(3) There has been intervening legislation, rulemaking, or litigation since the EAC last 

considered the issue; or

(4) The request is contrary to or otherwise inconsistent with prior EAC matters dealing 

with the same issue.

The EAC Office of General Counsel, in consultation with the Commissioners, shall determine 

the eligibility of questions presented under these four categories. 

QUESTION PRESENTED

The current question presented is the product of an ongoing, joint inquiry from the state of 

Nebraska and the National Association of State Election Directors (NASED). On August 30, 

2022 the EAC Office of Grants Administration (OGM) requested guidance from the EAC Office 

of General Counsel (OGC). OGM specifically requested a determination as to the allocability of 

costs for cybersecurity enhancements. In the responsive guidance piece, OGC informed OGM 

that the EAC could reasonably consider improvements to cybersecurity as allowable under 

HAVA Section 101(b)(1)(F) (Subsection F). Subsection F makes allowable costs for, 

“improving, acquiring, leasing, modifying, or replacing voting systems and technology and 

methods for casting and counting votes.”1 Although cybersecurity is not specifically 

contemplated in HAVA or Subsection F, OGC relied on guidance from the Government 

Accountability Office (GAO) in concluding that cybersecurity improvements are allowable 

expenditures under the Subsection. Specifically, GAO has held:

“[w]here a given expenditure is neither specifically provided for nor prohibited, the

question is whether it bears a reasonable relationship to fulfilling an authorized purpose

or function of the agency. This, in the first instance, is a matter of agency discretion.

When we review an expenditure with reference to its availability for the purpose at issue,

the question is not whether we would have exercised that discretion in the same manner.

Rather, the question is whether the expenditure falls within the agency's legitimate range

of discretion, or whether its relationship to an authorized purpose or function is so

attenuated as to take it beyond that range.”2

GAO noted previous decisions which held that where an agency received appropriations to

provide for “enhancement” of certain facilities, determining whether a particular expense

actually resulted in an enhancement required the exercise of discretion by the responsible agency. 

Determining whether a particular expense provides an “improvement,” similar to determining 

whether an expense provides an “enhancement,” requires the responsible agency to exercise 

judgment.3 Though the bounds of EAC’s discretion are not limitless, the statute’s use of the 

expansive term “improve” suggests that Congress vested EAC with greater discretion than what 

Congress sometimes affords when it uses a more specific word or phrase.

4 OGC concluded that 

1 52 U.S.C. § 20901(b)(1)(F).

2 U.S. Gov’t Accountability Off., B-333826, Election Assistance Commission—Use of Grant Funds for Security 

Services 4 (April 27, 2022) (citing B-223608, Dec. 19, 1988 (internal citations omitted)).

3

Id.

4

Id.
the EAC is within its discretion to determine that cybersecurity enhancement activities 

“improve” voting systems and technology under Subsection F.

In its guidance, OGC also provided an analysis on the allocation of expenditures for 

cybersecurity enhancement activities. EAC grants implement the “Uniform Administrative 

Requirements, Cost Principles, and Audit Requirements for Federal” (Uniform Guidance).5

Under the Uniform Guidance, to be allowable under a grant, costs must be necessary, reasonable 

and allocable to the grant.6 A cost is allocable to the grant if the goods or services involved are 

chargeable or assignable to the award in accordance with relative benefits received.7

OGC determined that the direct cost allocation principles described in the Uniform Guidance

apply when OGM determines that cybersecurity enhancements are allowable under Section 

101(b)(1)(F). OGC explained that cybersecurity enhancements with specific benefits to more 

than just voting systems and technology would need to be appropriately allocated. In short, OGC 

determined that expenditures for cybersecurity enhancements should be allocated based on the 

benefit to elections purposes and non-election purposes. As an example, if a State spends $1 

million on cybersecurity enhancements for statewide systems, the cost must be allocated to the 

projects based on the proportional benefit. So, if 50% of the benefit of cybersecurity 

enhancements is for voting systems and technology, then that 50% may be fully allocated to 

HAVA under Section 101(b)(1)(F). However, the remaining $500,000 of the expenditure that 

does not benefit voting systems or technology may not be paid for with HAVA funds.

In response to a question on a “day-to-day and routine HAVA question,” OGM provided the state 

of Nebraska with OGC’s analysis on the allowability and allocability of cybersecurity 

enhancements. On March 9, 2023 Nebraska notified the EAC that it was concerned that this 

guidance may conflict with the State’s Albert Sensor program. To further consideration of this 

concern, Nebraska raised this issue with NASED. NASED is a nonpartisan professional 

organization that disseminates election administration best practices and information across the 

states.8 Both Nebraska and NASED noted that in 2018, the EAC OGM “blanket pre-approval . . .

for all Albert monitors across all fifty-five of the states/territories that . . . received 2018 HAVA 

funds.”

To conclude this clarification, Nebraska formally submitted a request to the EAC on July 21, 

2023. That request, representing the current question presented, is as follows:

“The EAC has previously determined that Albert Sensors were allowable under the EAC 

HAVA Grant Program. However, during discussions with EAC staff on other projects we 

were considering funding, we were concerned that funds spent on Albert Sensors would 

need to be allocated based on the proportional benefit to non-election purposes. Our 

office would like clarification that the use of Albert Sensors deployed at the county level 

5 2 C.F.R. Part 200.

6 US EAC, Allowable Use Of Funds: Physical Security Services And Social Media Threat Monitoring (2022), 

https://www.eac.gov/sites/default/files/paymentgrants/Allowable_Use_of_Funds_Physical_Security_Services_and_ 

Social_Media_Threat_Monitoring_EAC.pdf.

7 2 CFR § 200.405.

8 NASED, “About” (2023), https://www.nased.org/about-nased.
continues to be an allowable expenditure. If it was previously determined that it was not, 

then Nebraska respectfully requests the EAC to reconsider the allocation requirement for 

these sensors under 2 CFR 200.405.”

To appropriately assess the question presented, OGC followed up with Nebraska. In that 

conversation, Nebraska noted that the purpose of expenditures on Albert Sensors is to monitor 

cybersecurity to ensure that election infrastructure is secure. This distinguishes the cost from 

general statewide cybersecurity enhancements in that general cybersecurity enhancements 

equally benefit all statewide functions whereas Albert Sensors monitor statewide networks in 

order to specifically benefit the election cybersecurity. Specifically, Nebraska noted that the

Albert Sensor monitors statewide networks to ensure that malicious actors cannot access any of 

the election-related networks through vulnerabilities in any statewide network. Nebraska also 

explained the State interprets the current guidance from the EAC on allocation is contrary to past 

guidance on the allowability of Albert Sensors, as past guidance from the EAC did not determine 

that expenditures for Albert Sensors needed to be allocated based on the benefit to non-elections 

technologies. 

The question from Nebraska specifically addresses Albert Sensors, but ultimately is a question of 

allocability of expenditures under Subsection F when the benefit is specifically to election

security. Therefore, to address the specific question from Nebraska, the question presented is 

interpreted as follows: 

When an expenditure for cybersecurity enhancements that is allowable under HAVA 

Subsection F impacts non-election systems, but is specifically undertaken for the benefit 

to election security, must a state allocate the ancillary benefit under 2 CFR 200.405?

APPLICABILITY OF POLICY TO QUESTION PRESENTED

The question presented cleanly fits under two of four of the categories of the Funding Decision 

Policy and is therefore ripe for Commissioner review in accordance with the policy. 

First, and most notable, the question would have “significant policy implications for the 

implementation of HAVA.” The Congressional Research Service (CRS) has highlighted that the 

election administration landscape has change significantly since the passage of HAVA in 2002.9

CRS also noted that foreign efforts to interfere with the 2016 election highlighted security as a 

primary consideration for elections policymaking.

10 Additionally, Congress has highlighted 

election security in recent appropriations language when allocating funds for Election Security 

Grants. Specifically, Congress authorized the EAC, “to make payments to States for activities to 

improve the administration of elections for Federal office, including to enhance election 

technology and make election security improvements, as authorized by sections 101, 103, and 

104 of such Act.”11 The explanatory statements accompanying the bills listed the following 

9 Congressional Research Service, “The Help America Vote Act of 2002 (HAVA): Overview and Ongoing Role in 

Election Administration Policy” (R46949, May 8, 2023).

10 Id. at 20.

11 Consolidated Appropriations Act of 2018, Public Law 115-141; Consolidated Appropriations Act of 2020, Public 

Law 116-93; Consolidated Appropriations Act of 2022, Public Law 117-103 (emphasis added).
election security-specific purposes as potential uses of the funds: upgrading election-related 

computer systems to address cyber vulnerabilities identified through DHS or similar scans or 

assessments of existing election systems, facilitating cybersecurity training for the state chief 

election official’s office and local election officials, implementing established cybersecurity best 

practices for election systems, and funding other activities that will improve the security of 

elections for federal office.12 This added language shows a clear Congressional intent to include 

election security in the preexisting authorized categories of expenditures under section 101. 

Therefore, a determination on how cybersecurity expenditures are analyzed under Subsection F 

has clear policy implication on the modern election administration landscape. 

The question from Nebraska is also, “inconsistent with prior EAC matters dealing with the same 

issue.” Because the EAC previously determined that Albert Sensors were allowable without 

offering an analysis on allocability, a determination on the allocation of such expenditures would 

be inconsistent with prior EAC matters. 

Therefore, the question of how cybersecurity enhancements for elections purposes must be 

allocated is well within the discretion of the Commissioners to take up under the Funding 

Decision Policy, as it has significant policy implications and deals with inconsistencies in prior 

EAC matters.

ANALYSIS

It is important to reiterate that the current question presented is how states must allocate 

cybersecurity enhancement costs for allowable expenditures under Subsection F in accordance 

with 2 CFR 200.405 when the costs are incurred specifically for the benefit of election 

administration.

The direct cost allocation principles contained within the Uniform Guidance state that, “if a cost 

benefits two or more projects or activities in proportions that can be determined without undue 

effort or cost, the cost must be allocated to the projects based on the proportional benefit. If a 

cost benefits two or more projects or activities in proportions that cannot be determined because 

of the interrelationship of the work involved, then ... the costs may be allocated or transferred to 

benefitted projects on any reasonable documented basis.”13 A state recipient must determine the 

proportions, that may be approximated, using reasonable methods to determine the benefit to the 

allowable purpose.14

Further guidance from the Office of Management and Budget (OMB) explains that a cost is 

allocable to a particular cost objective if the goods or services involved are chargeable or 

assignable to such cost objective in accordance with relative benefits received.15 All activities 

12 Rep. Rodney Frelinghuysen, “Explanatory Statement Submitted by Mr. Frelinghuysen, Chairman of the House

Committee on Appropriations, Regarding the House Amendment to Senate Amendment on H.R. 1625,” explanatory

statement, Congressional Record, daily edition, vol. 164, part 50 (March 22, 2018), p. H2519.

13 Id.

14 US EAC, Allowable Use Of Funds: Physical Security Services And Social Media Threat Monitoring (2022), 

https://www.eac.gov/sites/default/files/paymentgrants/Allowable_Use_of_Funds_Physical_Security_Services_and_ 

Social_Media_Threat_Monitoring_EAC.pdf.

15 2 CFR Part 225.
which benefit from the governmental unit’s indirect cost, including unallowable activities and 

services donated to the governmental unit by third parties, will receive an appropriate allocation 

of indirect costs. 

Direct costs are those costs that can be identified specifically with a particular final cost 

objective, such as a Federal award, or other internally or externally funded activity, or that can be 

directly assigned to such activities relatively easily with a high degree of accuracy. Costs 

incurred for the same purpose in like circumstances must be treated consistently as either direct 

or indirect (F&A) costs.16

Under the allocation principles described by OMB, cybersecurity enhancements undertaken for 

the sole purpose of improving the administration of elections may reasonably be considered 

direct costs. As discussed above, HAVA specifically contemplates the improvement of voting 

technology, and the EAC has defined heightened cybersecurity as an improvement. This is 

supported by the language included in appropriations language for HAVA grants. Therefore, 

cybersecurity enhancements for election security can be identified specifically with a particular 

final cost objective and should be considered direct costs.

As direct costs, the EAC must consider the direct cost allocation principles of 2 CFR 200.405. 

The nature of cybersecurity enhancements are such that any benefit to two or more projects or 

activities typically cannot be determined because of the interrelationship of the work involved. 

Therefore, the costs may be allocated or transferred to benefitted projects on any reasonable 

documented basis under the Uniform Guidance. When such a cost is incurred specifically for 

elections purposes, it would be reasonable to consider that the relative benefits received are 

entirely election related. Thus, as a direct cost, the cost of cybersecurity enhancements may be 

fully allocated to HAVA grants when the reasonable documented basis is that it is incurred 

specifically to enhance election administration. Therefore, these costs would be allowable and 

fully allocable when also reasonable and necessary. 

RECOMMENDATION 

Under the Policy Regarding Authority to Issue Funding Decision on Use of HAVA Funds, the 

EAC Commissioners should consider whether a state may fully allocate the cost of a 

cybersecurity enhancement, undertaken with the objective of improving voting technology. As 

documented in this memorandum, there are important policy considerations involved in this 

determination. This is highlighted by the changing election administration landscape and the 

interrelationship of cybersecurity networks.

Because HAVA specifically contemplates the improvement of voting technology, I recommend 

that the Commission consider cybersecurity enhancements direct costs and allow full allocability 

under Subsection F of HAVA when the costs are reasonable and necessary and when the cost is 

incurred for the purpose of benefitting election administration. 

16 2 CFR § 200.413.
Sincerely, 

Camden Kelliher

EAC Senior Associate Counsel