Summary of Changes between Public Comment Version and 

Adopted Version of the Voluntary Voting System Guidelines 

Rationale for Global Changes to VVSG 

The version of the VVSG adopted in December of 2005 includes several global edits to 

clarify the language. Those changes are outlined below. 

ITA— prior usage referred to independent testing organizations accredited by NASED to 

perform voting system qualification testing. All these references have been changed to 

“testing laboratory” (or some form of this term), to refer to the testing organizations 

accredited by the EAC to perform certification testing. 

Polling site, polling area—have been changed to “polling place” for consistency. 

Punchcard systems—all references to punchcard systems have been eliminated. 

Qualification—has been changed to reflect the process of “certification” to reduce 

ambiguity between the previous NASED process and the new EAC process. 

Race—has been considered in all its usages within the document and has only been used 

when referring to a political contest between people. Prior versions of the document used 

race interchangeably with contest, blurring the lines between contests held between 

people and those concerning issues. Many instances of “race” have been replaced with 

“contest.” 

Standards—has been eliminated and replaced with “guidelines” when referring to the 

testing guidelines, and “requirements” when referring to the voting system requirements. 

Structural Changes—due to reorganization of the material, some section, subsection 

and appendix numbering has been changed in Volume I. In addition, several headings 

have been shortened and clarified. 

Voter choices, ballot choices—the word “choices” in these terms has been changed to 

“selections” whenever the terms refer to an unmarked ballot. 

Voter verified—has been replaced with “voter verifiable,” clarifying that the information 

is able to be reviewed and verified by the voter if the voter so chooses after his vote has 

been selected and before it is cast. 

Voting machine, voting station, voting equipment, voting system—these terms have 

been used interchangeably in past iterations of the Guidelines. For the 2005 VVSG, these 

terms have been closely reviewed and have each taken on a specific meaning. “Voting

machine” is now used to refer to the devices used by the voter to make a contest 

selection. “Voting station” refers to the voting machine and the space at the precinct that 

1
the voting machine and the voter occupy while the selections are being made. “Voting 

equipment” is any of the equipment used to place the vote, to verify that vote, and to 

tabulate that vote, and finally, “voting system” refers to the entire system that is used to 

perform election management functions, prepare ballots, and to display, capture, verify

and record votes. 

Write-once media—has been replaced in all instances with “unalterable storage media” 

indicating that the alterability of the media is more important to its acceptability in this 

role than the fact that it can only be written on once. (For instance, using a media type 

that allows write-overs but can be finalized so that it is unalterable at the point of sale 

would be acceptable). 

Volume I: Voting System Performance Guidelines 

The EAC published proposed Voluntary Voting System Guidelines for a 90-day public 

comment period in July of 2005. The comment period resulted in over 6000 comments. 

Each of these comments was reviewed and considered by the Election Assistance 

Commission (EAC) in consultation with the National Institute for Standards and 

Technology (NIST) in the development of the final version adopted by the Commission 

on December 13, 2005. 

More than 5800 of the comments pertained to Volume I. Several portions of the 

document have been modified to respond to the comments. In particular, Section 2 

(previously Voting System Functional Capabilities) has been split into two separate 

sections (2, Functional Requirements and 3, Usability and Accessibility Requirements) 

and the Security section (now Section 7) has undergone a substantial re-write. Changes 

to the entire volume are outlined below section by section. The adopted document 

section number and title heads each section. 

Section 1: Introduction

The introductory section has been revised to reflect changes in the rest of the document 

and also to relate more closely to the EAC certification process. 

Subsection 1.6.4 “Implementation Statement” has been changed from “An 

implementation statement may take the form of a checklist to be completed for each 

voting system for which a claim of conformance to the Guidelines is made” to “The 

implementation statement must include a checklist identifying all the requirements for 

which a claim of conformance is made.” The second and final paragraph in this 

subsection has been changed to communicate what is specifically required of the 

implementation statement. 

Finally, Subsection 1.7 (“Effective Date”) has been clarified with new language. 

2
Section 2: Functional Requirements 

As indicated above, Section 2 of the public comment version of the Guidelines has been 

split into two sections for the adopted version. In this later version, the “human factors” 

requirements have been extracted from the functional requirements and placed in a 

section of their own. Section 2 is now titled “Functional Requirements.” Furthermore, 

all references to punch card systems have been eliminated. 

Language in Subsection 2.3.3.2 (e)-(h) has changed from that of previous Subsection 

2.4.3.2.2 (a)-(c) so that the terms “undervote” and “overvote” are clearly defined within 

the requirements. The language was made consistent with the HAVA provisions in 

section 301 (a). 

Subsection 2.4.1, previously 2.5.1 “Closing the Polling Place (Precinct Count),” has been 

simplified to “Closing the Polls.” The introductory language in this Subsection has been 

changed to reflect that the closing of the polls includes the locking of voting systems 

against future voting. 

Section 3: Usability and Accessibility Requirements 

Human factors requirements were removed from Section 2 Voting System Functional 

Capabilities, placed in Section 3, and re-titled Usability and Accessibility Requirements. 

Subheadings have been added throughout the accessibility portion to more clearly 

indicate requirements for specific disability conditions. The usability and accessibility

requirements have been considerably expanded from the 2002 Voting System Standards. 

They are expected to become more extensive and detailed as further research is done and 

new technological solutions become available for accommodating voter disabilities. 

The order of presentation is reversed from the public comment version. Usability 

requirements are presented first because they apply to all voting systems. Alternative 

language and privacy requirements are included under Usability because they apply to all 

voting systems. Accessibility requirements follow as additional requirements that must be 

met by the accessible voting systems mandated by HAVA Section 301(a)(3)(B). 

Requirements pertaining to DREs with voter verifiable paper audit trail components have 

been removed from this section and have been consolidated. 

3.1.1 Usability Testing (previously 2.2.7.3.1) 

This requirement was revised to make usability testing mandatory for vendors: “The 

vendor shall conduct summative usability tests on the voting system using individuals 

representative of the general population. The vendor shall document the testing 

performed and report the test results using the Common Industry Format. This 

documentation shall be included in the Technical Data Package submitted to the EAC for 

national certification. 

Discussion: Voting system developers are required to conduct realistic usability tests on 

the final product. For the present, vendors can define their own testing protocols. Future 

revisions to the Guidelines will include requirements for usability testing that will include 

performance benchmarks.” 

3
3.1.2 Functional Capabilities a. through e. (previously 2.2.7.3.2.1, 2.2.7.3.2.2, 2.2.7.3.2.4) 

These three requirements were expanded to five and wording revised to be consistent 

with HAVA: 

“a. The voting system shall provide feedback to the voter that identifies specific 

contests or ballot issues for which he or she has made no selection or fewer than 

the allowable number of selections (e.g., undervotes) 

b. The voting system shall notify the voter if he or she has made more than the 

allowable number of selections for any contest (e.g., overvotes) 

c. The voting system shall notify the voter before the ballot is cast and counted of 

the effect of making more than the allowable number of selections for a contest 

d. The voting system shall provide the voter the opportunity to correct the ballot 

for either an undervote or overvote before the ballot is cast and counted 

e. The voting system shall allow the voter, at his or her choice, to submit an 

undervoted ballot without correction” 

3.1.3 Alternative Languages (previously 2.2.7.2, 2.2.7.2.1, 2.2.7.2.2, 2.2.7.2.3, 2.2.7.2.4) 

The concept of “an alternative language voting station” has been removed. All voting 

equipment is subject to meeting the criteria for alternative language accessibility as 

defined in Section 203 of the Voting Rights Act (VRA) of 1975 as applicable in the 

jurisdictions where it will be used. The wording of the previous requirements has been 

consolidated and made consistent with HAVA and the VRA. The new wording also 

recognizes that some states provide alternative language accessibility beyond what is 

required in federal law. 

“The voting equipment shall be capable of presenting the ballot, ballot selections, review 

screens and instructions in any language required by state or federal law.” 

3.1.5 Perceptual Issues (previously 2.2.7.3.4) 

Previous requirement 2.2.7.2.1.3 was moved to 3.1.5.e because it is a usability, not 

accessibility, requirement: “All voting machines using paper ballots should make 

provisions for voters with poor reading vision. Discussion: Possible solutions include: (a) 

providing paper ballots in at least two font sizes, 3.0-4.0mm and (b) providing a 

magnifying device.” 

Previous requirement 2.2.7.2.1.6 was moved to 3.1.5.f because it is a usability, not 

accessibility, requirement: “The default color coding shall maximize correct perception

by voters with color blindness. Discussion: There are many types of color blindness and 

no color coding can, by itself, guarantee correct perception for everyone. However, 

designers should take into account such factors as: red-green color blindness is the most

common form; high luminosity contrast will help colorblind voters to recognize visual 

features; and color-coded graphics can also use shape to improve the ability to distinguish 

certain features.” 

Previous requirement 2.2.7.2.1.7 was moved to 3.1.5.g because it is a usability, not 

accessibility requirement: “Color coding shall not be used as the sole means of conveying 

4
information, indicating an action, prompting a response, or distinguishing a visual 

element. Discussion: While color can be used for emphasis, some other non-color mode 

must also be used to convey the information, such as shape or text style. For example, red 

can be enclosed in an octagon shape.” 

3.1.7.1 Privacy at the Polls (previously 2.2.7.4.1) 

Requirement was reworded to make it more specific: “When deployed according to the 

installation instructions provided by the vendor, the voting station shall prevent others 

from observing the contents of a voter’s ballot.” 

3.2.1.b General (under 3.2 Accessibility, previously 2.2.7.1.1) 

Requirement was revised to clarify interface between accessible voting station and 

personal assistive devices of the voters: “The support provided to voters with disabilities 

shall be intrinsic to the accessible voting station. It shall not be necessary for the 

accessible voting station to be connected to any personal assistive device of the voter in 

order for the voter to operate it correctly. Discussion: This requirement does not preclude 

the accessible voting station from providing interfaces to assistive technology. [See 

definition of “personal assistive devices in the Glossary.] Its purpose is to assure that 

disabled voters are not required to bring special devices with them in order to vote 

successfully. The requirement does not obviate the need for a voter’s ordinary noninterfacing devices, such as eyeglasses or canes. Jurisdictions should ensure that an 

accessible voting station provides clean and sanitary devices for voters with dexterity 

disabilities. 

3.2.2.1.a Partial Vision (previously 2.2.7.1.2.1.1) 

Requirement was revised to make usability testing mandatory for the vendor: “The 

vendor shall conduct summative usability tests on the voting system using partially 

sighted individuals. The vendor shall document the testing performed and report the test 

results using the Common Industry Format. This documentation shall be included in the 

Technical Data Package submitted to the EAC for national certification.” 

3.2.2.2.a Blindness (previously 2.2.7.1.2.2.1) 

Requirement was revised to make usability testing with blind individuals mandatory for 

the vendor. Wording is identical to 3.2.2.1.a above, except for the disability type. 

Requirement 3.2.2.2.c.iv (previously 2.2.7.1.2.2.3.4) was revised to make the provision of 

a sanitized handset or headphone mandatory for each voter: “A sanitized headphone or

handset shall be made available to each voter.” 

Requirement 3.2.2.2.c.viii (previously 2.2.7.1.2.2.3.8) was revised to make it a 

performance standard rather than prescribing a specific solution: “The audio presentation 

of verbal information should be readily comprehensible by voters who have normal 

hearing and are proficient in the language. This includes such characteristics as proper 

5
enunciation, normal intonation, appropriate rate of speech, and low background noise. 

Candidate names should be pronounced as the candidate intends.” 

Requirement 3.2.2.2.c.ix (previously 2.2.7.1.2.2.3.9) was revised to make it more 

specific: “The audio system shall allow voters to control the rate of speech. The range of 

speeds supported should be at least 75% to 200% of the nominal rate.” 

Requirement 3.2.3.a. under Dexterity (previously 2.2.7.1.3.1) was revised to make 

usability testing with individuals lacking fine motor control mandatory for vendors. 

Requirement 3.2.3.d (previously 2.2.7.1.3.4) was revised to make the provision of a 

mechanism for non-manual input mandatory for voters with dexterity limitations: “The 

accessible voting station shall provide a mechanism to enable non-manual input that is 

functionally equivalent to tactile input. Discussion: This requirement ensures that the 

accessible voting station is operable by individuals who do not have the use of their 

hands. All the functionality of the accessible voting station (e.g., straight party voting,

write-in candidates) that is available through the other forms of input, such as tactile, 

must also be available through a non-manual input mechanism if it is provided by the 

accessible voting station.” 

Requirement 3.2.3.e (previously 2.2.7.1.3.5) was revised to make the capability to submit 

the ballot mandatory for voters with dexterity limitations: “If the normal procedure is for 

voters to submit their own ballots, then the accessible voting station shall provide features 

that enable voters who lack fine motor control or the use of their hands to perform this 

submission.” 

Requirement 3.2.7 English Proficiency (previously 2.2.7.2) was revised to clarify 

provisions for voters lacking proficiency in reading English or whose primary language is 

unwritten: “For voters who lack proficiency in reading English, or whose primary 

language is unwritten, the voting equipment shall provide spoken instructions and ballots 

in the preferred language of the voter, consistent with state and federal law. The 

requirements of 3.2.2.2.c shall apply to this mode of interaction.” 

Section 4: Hardware Requirements

Section 3, “Hardware” has been displaced by the split of Section 2 so that it is now 

labeled Section 4. Furthermore, the title has changed so that it is now consistent with the 

others so it reads “Hardware Requirements.” 

In Subsection 4.3 VAC in reference to electronic measurements is now spelled out to 

avoid any ambiguity or misunderstanding, so that it now reads “voltage alternating 

current.” 

Section 5: Software Requirements

This Section is now titled “Software Requirements.” 

Subsection 5.4.1 (“Pre-election Audit Records”) has been amplified with a new 

requirement (d), so that in addition to former requirements, the log shall include: “Any 

6
other characteristics that may be peculiar to the jurisdiction, the election or the polling 

place location.” 

Section 6: Telecommunications Requirements

Other than its displacement due to the Section 2 split, there were no significant changes 

made to this section titled “Telecommunications Requirements.” 

Section 7: Security Requirements

Subsection headings throughout this section have been shortened and simplified. 

7.3.1 Polling Place Security (previously 6.3.1) 

Reworded to clarify that vendor is responsible for documenting security measures but 

poll workers will implement them. 

7.4.4 Software Distribution (previously 6.4.4 Software Distribution Methodology 

Requirements) 

a.i. (previously 6.4.4.1) “Part number” added as second unique identifier example. 

a.i. and b.i. (previously 6.4.4.1 and 6.4.4.4) “...certification number of the voting system” 

changed to “certification application number of the voting system”. The system

certification number is not granted until after the system test report is reviewed and 

approved by EAC. 

b.iii. (previously 6.4.4.6) “The testing authority shall retain this record until the voting 

system ceases to be nationally certified” was changed to “The testing lab shall retain this 

record until notified by the EAC that it can be archived.” EAC notification provides both 

authorization and a date certain for archiving this information. 

c. (previously 6.4.4.7) “After EAC certification has been granted” was added to the 

beginning of this requirement. 

c.ii. (previously 6.4.4.9) “...any other repository named by the Election Assistance 

Commission” was changed to “any other repository designated by a state.” The EAC has 

designated NSRL as the national repository for all certified voting system software, but 

states may wish to designate other entities for the specific voting system software used in 

their jurisdictions. This change has been made throughout this section. 

c.iii. (previously 6.4.4.10) “The testing authority shall retain this record until the voting 

system ceases to be nationally certified” was changed to “The NSRL shall retain this 

software until notified by the EAC that it can be archived.” This requirement for NSRL 

parallels the testing lab requirement in b.iii. above. 

d. (previously 6.4.4.11) “The vendor shall provide the NSRL or other EAC designated 

repository with a copy of all third party software” was changed to “The vendor shall 

provide the NSRL and any repository designated by a state with a copy of the software 

installation disk which the vendor will distribute to purchasers -- including the executable 

7
binary images of all third party software.” This change was made to clarify what software 

is to be provided to NSRL. 

d.ii. (previously 6.4.4.13) “The vendor shall document that the process used to verify the 

software distributed on write-once media is the certified software by using the reference 

information provided by the NSRL or other EAC designated repository” was changed to 

“The vendor shall document that the process used to verify the software distributed on 

unalterable storage media is the certified software by using the reference information 

provided by the NSRL or other designated repository before installing the software.” 

Adding the phrase “before installing the software” indicates when the vendor is to 

document verification of distributed software. 

7.4.5 Software Reference Information (previously 6.4.5 Generation and Distribution 

Requirements for Reference Information) 

c. (previously 6.4.5.4) “The NSRL or other EAC designated repository shall retain the 

write-once media used to generate the reference information until the voting system

ceases to be nationally certified” was changed to “The NSRL or other designated 

repository shall retain the unalterable storage media used to generate the reference 

information until notified by the EAC that it can be archived.” EAC notification provides 

authorization and a date certain for this action. 

7.4.5.1 Hashes and Digital Signatures (heading added to indicate change in topic) 

b.v. (previously 6.4.5.5.6) ...“the name of the organization” was added before “name and 

contact information.” Change adds indication of organizational affiliation of person 

receiving public keys. 

7.4.6 Software Setup Validation (previously 6.4.6 Setup Validation Methodology 

Requirements) 

b. (previously 6.4.6.2) ...”static and semi-static” removed before “voting system

software”. At present only static software can be verified using NSRL reference 

information. 

d. (previously 6.4.6.3.1) “The verification process shall be able to be performed using 

COTS software and hardware available from sources other than the voting system

vendor.” “Shall be able” changed to “should be able” because no third party COTS 

products are currently available and it is unknown when they might be. 

e. (previously 6.4.6.3.4) “Voting system equipment shall provide a read-only external 

interface to access the software on the system” was changed to “Voting system

equipment shall provide a means to ensure that the system software can be verified 

through a trusted external interface, such as a read-only external interface, or by other 

means.” Requirement was revised to indicate the functional capability required rather 

than to prescribe a single design solution. 

8
7.5.1 Maintaining Data Integrity (combines previous 6.5.1 Access Control, 6.5.2 Data 

Integrity, and 6.5.3 Data Interception Prevention) 

7.5.3 Monitoring and Responding to External Threats (previously 6.5.4.3) 

e. Timeframe for implementing corrective procedures to threats changed from “no later 

than one month before an election” to “within the timeframe established by the state.” 

Comments from election officials indicated that the timeframe for corrective action 

needed to be related to the nature and potential impact of the threat and shouldn’t 

arbitrarily be specified in advance. 

7.6 Use of Public Communications Networks (previously 6.6 Security for Transmission 

of Official Data Over Public Communications Networks) 

References to “DRE systems” changed to “voting systems” because use of

communications networks is not limited to DRE voting systems. 

7.7 Wireless Communications (previously 6.7) 

Introductory discussion edited and restructured to improve clarity of presentation. 

7.7.1 Controlling Usage (previously 6.7.2) 

“This review shall be done either through an open and public review or by a subject area 

recognized expert” (previously 6.7.2.1.3.1) was deleted. The testing labs are accredited to 

have technical competency for documentation review and testing of all elements and 

technologies used in voting systems. 

7.7.2 Identifying Usage (previously 6.7.3) 

c. (previously 6.7.3.3) “The indication should be visual” changed to “The indication shall 

be visual.” Visual indication that wireless capability is active is made mandatory to aid 

poll workers in properly controlling its use. 

“The wireless (audible) path shall be protected or shielded” (previously 6.7.6.4) was 

deleted. This requirement was intended to pertain to acoustic hearing and speech which is 

not electronically mediated. 

7.8 Independent Verification Systems 

This subsection was added to provide an overview discussion and description of the basic 

characteristics of independent verification systems. This material establishes context for 

the next subsection which states requirements for voter verifiable paper audit trails, one 

type of independent verification. Also terminology was changed from independent dual 

verification systems to reflect NIST’s current nomenclature. 

7.9 Voter Verifiable Paper Audit Trail Requirements (previously 6.8) 

9
Introductory paragraph revised to indicate that these requirements are for DRE voting 

systems; that VVPAT capability is not required for national certification, but these 

requirements will be applied in certification testing if vendor’s application for 

certification testing so requests. 

a. (previously 6.8.1.1) Discussion language revised to remove references to use of paper 

record for recounts. 

b. (previously 6.8.1.2) language revised to add the phrase “if required by state law” 

regarding whether paper record will be used for recount. The last sentence in the 

Discussion was revised to read: “The paper record shall also be suitable for use in full 

recounts of the election if required by state law.” These changes were made in response 

to comments from election officials that state law prescribes how recounts will be 

conducted. 

7.9.2 Approve or Void the Paper Record (previously 6.8.4 Approve or Spoil the Paper 

Record) 

This entire subsection has been substantially revised to clarify requirements for the 

processing of the VVPAT paper and electronic records in response to one of three 

possible scenarios: 

- The voter verifies that his or her selections displayed on the DRE summary 

screen and those printed on the paper record are the same. If they are, and the 

voter is satisfied with these selections, the voter proceeds to cast the electronic 

ballot, thereby approving the paper record. 

- If the records match, but the voter wishes to change any of his or her selections, 

the paper record must be voided so a new one can be printed to compare to the 

new summary screen display. The summary screen data are not permanently 

stored by most DREs, so previous reference to “spoiling” the electronic record 

would have required significant software changes. Voiding the paper record is a 

much simpler solution to providing the necessary audit trail.

- In the event the records do not match, the voter would request assistance from a 

poll worker as this occurrence could indicate a potential voting machine or printer 

malfunction. In this circumstance the voting machine would be withdrawn from

use to permit investigation of the problem. 

7.9.3 Electronic and Paper Record Structure (previously 6.8.6) 

Previous requirement 6.8.6.1 was deleted because it was a general statement that could 

not be tested. 

Previous requirement 6.8.6.11 moved to 7.9.3.e.v. because it was out of sequence in the 

previous location. 

The words “or barcodes” added to end of Discussion sentence under 7.9.3.g. (previously 

6.8.6.8). 

10
Previous requirement 6.8.6.9, “Any automatic accumulation of electronic or paper 

records shall be capable of detecting and discarding duplicate copies of the records,” was 

deleted as duplicate records cannot occur. 

7.9.3.h. (previously 6.8.6.10) was revised to read: “If barcode is used, the voting 

equipment shall be able to print a barcode with each paper record that contains the 

human-readable contents of the paper record.” This change clarifies that the ability to 

print a barcode reflecting the contents of the paper record is mandatory if this technical 

solution is used. 

7.9.4 Equipment Security and Reliability (previously 6.8.7) 

This subsection was substantially revised to clarify and tighten up requirements. 

Previous requirements 6.8.7.1 and 6.8.7.2 were deleted because general statements that 

cannot be tested. 

Previous requirement 6.8.7.2.5 was deleted because it is subsumed in requirement 7.9.4.j. 

Previous requirement 6.8.7.2.7 was revised and moved to 7.9.4.b and c: “Tamper-evident 

seals or physical security measures shall protect the connection between the printer and

the voting machine.””If the connection between the voting machine and the printer has 

been broken, the voting machine shall detect this event and record it in the DRE audit 

log.” 

Previous requirement 6.8.7.3 was deleted because a general statement that could not be 

tested. 

New requirement 7.9.4.i added: “The voting machine shall not record votes if an error or 

malfunction occurs.” The “error or malfunction” refers to the VVPAT printer. 

7.9.5 Preserving Voter Privacy (previously 6.8.5) 

New requirement 7.9.5.b added: “When a VVPAT with a spool-to-spool continuous 

paper record is used, a means shall be provided to preserve the secrecy of the paper 

record of voter selections. 

New requirement 7.9.5.c added: “When a VVPAT with a continuous spool-to-spool 

paper record is used, no record shall be maintained of which voters used which voting 

machine or the order in which they voted. 

Previous requirement 6.8.5.1.1 deleted: “When the voter is responsible for depositing a 

paper record in the “ballot box” (reference is to the secure receptacle for storing the paper 

records, not the receptacle for ballots), the accessible voting station shall maintain the

privacy and anonymity of voters unable to manually handle paper.” 

11
Previous requirement 6.8.5.4 deleted: “The voter shall not be able to leave the voting area 

with the paper record if the information on the paper record can directly reveal the voter’s 

choices.” The rationale for both these changes (6.8.5.1.1 and 6.8.5.4) is that the voter 

should not be permitted to physically handle the paper record as this provides opportunity 

for fraud. 

New requirement 7.9.5.g added: “Both paper rolls and paper record secure receptacles 

shall be controlled, protected, and preserved with the same security as a ballot box.” This 

is to ensure that audit records are properly maintained for use while preserving the 

privacy of the voters. 

7.9.6 VVPAT Usability (previously 6.8.2) 

Previous requirements 6.8.3.2, 6.8.3.3, and 6.8.3.4 moved to 7.9.6.c and revised to read: 

c. “The voting equipment shall display, print and store the paper record in any of the 

written alternative languages chosen for the ballot. 

i. To assist with manual auditing, candidate names on the paper record shall be 

presented in the same language as used on the DRE summary screen. 

ii. Information on the paper record not needed by the voter to perform verification 

shall be in English.” Discussion added to clarify requirements. 

Previous requirements 6.8.2.3 and 6.8.2.3.1 were combined and revised to read: “The 

paper and electronic records shall be preserved to allow the voter to read and compare the 

records without the voter having to shift his or her position.” 

Sentence added to the Discussion following 7.9.6.e (previous 6.8.2.3.2): “The voter 

should be notified if it is not possible to scroll in reverse, so they will know to complete 

verification in one pass.” 

Requirement 7.9.6.f (previous 6.8.2.3.3) was revised to read: “If the paper record cannot 

be displayed in its entirety on a single page, each page of the record shall be numbered 

and shall include the total count of pages for the record.” Discussion added: “Possible 

numbering schemes include ‘Page X of Y.’ 

7.9.7 VVPAT Accessibility (previously 6.8.3) 

Requirement 7.9.7.b (previous 6.8.3.5) significantly revised: “If the normal voting 

procedure includes VVPAT, the accessible voting equipment should provide features that 

enable voters who are visually impaired and voters with an unwritten language to 

perform this verification. If state statute designates the paper record produced by the 

VVPAT to be the official ballot or the determinative record on recount, the accessible 

voting equipment shall provide features that enable visually impaired voters and voters 

with an unwritten language to review the paper record.” Discussion was added: “For 

example, the accessible voting equipment might provide an automated reader that 

converts the paper record contents into audio output.” This change was made to make it 

clear that if the paper record either is treated as the official ballot or could be the 

12
controlling record used for recount, then visually disabled voters must be able to verify

the paper record itself. The requirement was also extended to voters with an unwritten 

language. 

Section 8: Quality Assurance Requirements and Section 9: Configuration 

Management Requirements 

There were no significant changes made to these sections. 

Appendix A: Glossary

A large number of terms were dropped from the glossary, either because the term does 

not appear in the document, there is a commonly understood meaning, or it is explained 

thoroughly in the text where it is used. In addition, several terms have been added to the 

glossary. They include: configuration status accounting, election, electronic voting 

system, hash function, internal audit log, NIST, personal assistive device, precinct count 

voting system, product standard, qualification testing, secure receptacle, security analysis, 

testing standard, and voter verifiable. The definitions for a significant number of terms 

were expanded to better define their usage. 

Appendix B

Appendix B is a list of references pertaining to the whole document to which has been 

added a list of Legislation References in Subsection B.3. 

Appendix C: References 

Appendix C, “Best Practices for Election Officials,” has been deleted. Election 

administration and procedural matters will be addressed by the EAC Management 

Guidelines Working Group and published in a separate document. 

Appendix D (Now Appendix C): Independent Verification Systems

The term “Independent Dual Verification Systems” has been changed to “Independent 

Verification Systems.” There were several wording clarifications throughout this 

appendix. 

Appendix E (Now Appendix D): Technical Guidance for Color, Contrast, and Text 

Size

Subsections D.1 (Introduction), D.2 (Requirements) and D.3 (Design Options) have been 

removed because this material is now contained in the main body of the Guidelines. The 

last line of the fourth paragraph of this appendix has changed so that the use of the 16-

color palette or larger is now suggested instead of required when voter adjustment of 

color is provided. The term “accessibility” has been clarified as “low-vision 

accessibility.” 

13
Volume II: National Certification Testing Guidelines 

Of the thousands of comments made to the VVSG, only 148 pertained to Volume II; and 

97 of those concerned Sections 1 or 5. Many of these comments concerned simple 

formatting or grammar changes; relatively few substantive changes were called for in 

Volume II. 

Structural changes to Volume II were also minimal. Section numbers did not change or 

shift and no appendices were removed. A title page and a copy of the Overview were 

added to this Volume in order to provide an easy reference guide to Volume I for readers 

who will generally consult only Volume II. 

Section 1: Introduction 

The testing sequence described in Section 1.4 has been reordered to reflect a more logical 

sequence in which the testing must be completed. The order now prescribes that 

examination of the system, the technical documentation provided by the vendor and the 

vendor’s quality assurance program and configuration management plan occur prior to 

the development of a detailed system test plan. Furthermore, the witness of the system

build will occur immediately after these examinations and the software code review. 

Following the build, testing will be performed on the operation, function and 

performance of hardware first, then software, and finally on the entire integrated system. 

After all testing is complete, the National Certification Test Report will be prepared and 

delivered to the EAC. The witness of the system build described in Section 1.8.2.4 has 

been changed so that the build can now take place at either the vendor site or the test lab. 

Section 2: Description of Technical Data Package 

There were no substantial changes to Section 2. 

Section 3: Functionality Testing

The language in Subsection 3.4 “Functionality Testing for Accessibility” has been 

changed from, “The test lab shall design and perform test procedures that verify 

conformance with each of these requirements” to; 

To demonstrate conformance to these requirements, vendors shall 

conduct summative usability tests of accessible voting equipment 

with blind and visually impaired individuals and individuals 

lacking fine motor control. A description of the testing performed, 

the population of test subjects participating, and the results shall be 

documented using the Common Industry Format (CIF) by the

vendor and submitted as part of the Technical Data Package. The 

test labs shall review this information during the system 

certification documentation review. 

 Section 4: Hardware Testing 

“Voltage Alternating Current” is now spelled out in Section 4.3 (b) to avoid reader 

confusion. 

14
The tests that previously had their own titles under “Other Environmental Tests” are now 

labeled with individual letters for direct reference without those titles. 

Section 5: Software Testing 

Control constructs in Section 5.4.1 have been amplified to include permission for 

conventional constructs that are inherent to the development language with the caveat 

that such constructs must be documented in the code, adjacent to their use. 

The assessment of coding conventions described in Section 5.4.2 has been clarified by 

removing guideline (t) which stated “(the test lab shall review the code to ensure that it)

specifies explicit comparisons in all if() and while() conditions;” and by removing the 

accompanying examples. 

Section 6: System Integration Testing and Section 7: Quality Assurance Testing 

There were no substantive changes made to these sections. 

Appendix A: National Certification Test Plan, Appendix B: National Certification 

Test Report and Appendix C: National Certification Test Design Criteria 

There were no substantive changes made to the appendices. 

Changes in the Glossary 

The following terms have been removed from the glossary: 

alternative language voting station, approval, attestation, ballot set, 

baseline, calibration, compliance point, configuration identification, 

configuration item, conformity, conformity assessment, conformity 

assessment body, consensus, design entity, design entity attributes,

designating authority, designation, DRE display, DRE-VVPAT, election 

coding, electronic ballot printer, electronic vote capture system, 

electronically-assisted ballot marker, ergonomics, e-voting, fled voter, 

font, HAVA, human computer interaction, human factors, implementation 

conformance statement, on-site absentee voting, operations procedures, 

pass/fail criteria, point size, profile, public information package, public 

key certificate, punchcard voting system, quality assurance plan, quality 

control, quality manual, race, read ballot, record, records, repeatability,

rolloff, second chance voting, secret key, section 508, specification 

(technical), standard, standard (product), standard (testing), standard on 

data to be provided, test case specification, test design specification, 

testing, testing authority, traceability, type font, uncertainty, user 

documentation, verification and validation, vote capture system, voter 

registration system, VVPAT, voting environment, voting equipment

operational environment, voting equipment operations procedure, voting 

equipment user documentation, VVPAT ballot box, VVPAT display, 

VVPAT printer, witness device, and workspace. 

15
Terms that have been added to the glossary are: 

configuration status accounting, election, electronic voting system, hash 

function, internal audit log, NIST, personal assistive device, precinct count 

voting system, product standard, qualification testing, secure receptacle, 

security analysis, testing standard, voter verifiable. 

These terms appear in the glossary, but have been slightly altered from their previous

form:

alternate format (from alternative formats), central count voting system 

(from central count), directly verifiable (from directly verified), guidelines 

(from Guideline), indirectly verifiable (from indirectly verified), overvote

(from overvotes), and voter verifiable audit record (from voter verified

audit record). 

Several definitions of pre-existing terms have been clarified or enhanced to better define 

their usage by EAC. They are: 

absentee ballot, Access Board, accessibility, accessible voting station, 

accreditation, adequate security, audio ballot, audio-tactile interface, audit,

audit trail, availability, ballot counter, ballot counting logic, ballot format, 

ballot image, ballot instructions, ballot measure, ballot position, ballot 

production, ballot scanner, ballot style, canvass, certification, challenged 

ballot, checksum, claim of conformance, closed primary, common off the 

shelf (COTS), component, confidentiality, conformance, conformance 

testing, contest, cross-filing, cryptography, cumulative voting,

decertification, decryption, disability, early voting, election district,

election officials, electronic cast vote record, electronic voter interface, 

encryption, error correcting code, Federal Information Processing 

Standards (FIPS), firmware, hash, independent testing authority, integrity, 

multi-seat contest, national certification testing, NVLAP, non-partisan 

office, nonvolatile memory, open primary, operational environment, 

optical scan, optiscan system, paper-based voting system, polling place, 

precinct, privacy, provisional ballot, public network DRE voting system, 

qualification number, qualification test report, recall issue with options, 

recertification, referendum, requirement, residual vote, semi-static voting 

system software, split precinct, state certification, straight party voting, 

support software, tabulation, touch screen voting machine, undervote, 

usability, valid vote, validation, vote for N of M, voted ballot, voting 

equipment, voting machine, voting station, voting system software and 

write-in voting. 

16