U.S. ELECTION ASSISTANCE COMMISSION

633 3rd St. NW, Suite 200

Washington, DC 20001 

Tel: (301) 563-3919 www.eac.gov Fax: (301) 734-3108

Toll free: 1 (866) 747-1471

EAC GRANTS GUIDANCE:

ALLOCABILITY OF CYBERSECURITY ENHANCEMENTS

In July 2023, the U.S. Election Assistance Commission (EAC) voted unanimously to consider allowable 

cybersecurity enhancements direct costs and allow full allocability under HAVA Section 101(b)(1)(F) 

when the costs are reasonable and necessary and when the cost is incurred specifically for the purpose of 

benefitting election administration. The vote was conducted under the Policy Regarding Authority to 

Issue Funding Decisions on Use of HAVA Funds and does not change the applicability of the Uniform 

Guidance (2 CFR Part 200) to EAC grant funding. 

In accordance with the Commissioner decision, available here, the EAC Office of Grants Management, in 

consultation with the Office of General Counsel, has developed the following guidance on the proper 

application of this decision and how states may attest and document that expenditures qualify as direct 

costs for the purpose of allocation. 

ALLOWABLE

The Cybersecurity and Infrastructure Security Agency (CISA) defines cybersecurity as:

“the art of protecting networks, devices, and data from unauthorized access or criminal 

use and the practice of ensuring confidentiality, integrity, and availability of 

information.”

The EAC has previously determined that cybersecurity enhancements are allowable under HAVA Section 

101(b)(1)(F) which identifies allowable costs for “improving, acquiring, leasing, modifying, or replacing 

voting systems and technology and methods for casting and counting votes”. To be allowable under a 

grant, costs must be necessary, reasonable, and allocable to the grant. An allowable cost is one that is 

necessary and reasonable for the proper and efficient performance and administration of the activities 

funded under the grant. 

The Commissioner decision specifically addresses the allocability of allowable cybersecurity 

enhancement costs. Past guidance provided by the EAC regarding whether specific cybersecurity 

activities are allowable continues to apply.

ALLOCABLE

An allocable expense is one that is directly related to the objectives and activities planned under the grant 

and included in the approved budget for the grant. Under this decision, cybersecurity enhancements must 

be reasonable, necessary, and incurred specifically for the purpose of benefitting election administration

to be fully allocated to HAVA funding. The decision impacts how the EAC determines the allocability of 

specific cybersecurity costs.
 

 

U.S. ELECTION ASSISTANCE COMMISSION

633 3rd St. NW, Suite 200

Washington, DC 20001 

Tel: (301) 563-3919 www.eac.gov Fax: (301) 734-3108

Toll free: 1 (866) 747-1471

When a direct cost benefits two or more projects or activities, the EAC must apply the direct allocation 

cost principles described in the Uniform Guidance (2 CFR 200.405) which requires grantees to allocate 

costs based on the proportional benefit. 

Due to the nature of cybersecurity enhancements, the proportional benefit to two or more projects 

typically cannot be determined because of the interrelationship of the work involved. Per the Uniform 

Guidance, those costs may be allocated to benefitted projects on any reasonable basis. When 

cybersecurity enhancement costs are incurred specifically for election purposes, it is reasonable to 

consider the benefit as entirely election related and therefore, fully allocable to HAVA. However, this is 

not a blanket rule that covers all cybersecurity enhancement costs. The EAC has discretion to determine if 

an allowable cost may be fully allocated to HAVA.

States must seek approval from the EAC when the allocability of an allowable cost is in question. The 

following parameters apply in determining when agency approval is required.

1. Allowable cybersecurity costs that solely benefit election administration are 100% allocable to 

HAVA and do not require additional consideration from the EAC. The EAC has previously 

determined that costs that are allowable under HAVA Section 101(b)(1)(F) do not need to be 

allocated based on the benefit to federal versus local election administration. 

2. Allowable cybersecurity costs that benefit election administration as well as non-election 

activities (e.g. a firewall for a network that houses both the statewide voter registration system 

and databases for the Department of Motor Vehicles) may be 100% allocable to HAVA if the 

state can attest that the costs have been incurred specifically for election purposes. When a cost 

has an identifiable non-election benefit, states must email the EAC Office of Grants Management 

(grants@eac.gov) for clearance and approval to allocate the full cost to their HAVA grant (See 

Appendix A).

Additional instructions for completing and submitting a request for the EAC to consider the allocability of 

a cybersecurity enhancement are provided in the attached appendices. The approval process is applicable 

to planned future expenditures as well as past expenditures.

REASONABLE and NECESSARY 

State recipients who are considering expenses related to cybersecurity enhancements must document any 

existing security measures available, an assessment of cost of various options to establish reasonableness, 

and a description of the primary benefits to election administration as well as any secondary benefits to 

non-election activities. 

Although an activity may achieve the end goal of improving the administration of federal elections, the 

necessity for that activity could be questioned when a less expensive but equally effective activity is 

available for use. An expense would likely not be considered reasonable if a less expensive but equally 

effective alternative was available. There may be other cybersecurity options that are more reasonable 
 

 

U.S. ELECTION ASSISTANCE COMMISSION

633 3rd St. NW, Suite 200

Washington, DC 20001 

Tel: (301) 563-3919 www.eac.gov Fax: (301) 734-3108

Toll free: 1 (866) 747-1471

cost solutions and/or options that provide protection that allows for the improved administration of 

elections. States must document how they determined that their cybersecurity strategy is the most 

reasonable solution. A cost is considered reasonable if, by its nature and amount, it does not exceed what 

a prudent person would pay under the circumstances. This can be based on frequency of use, actual cost 

for the products, and other relevant factors. Expenditure towards cybersecurity enhancements would be 

analyzed similarly to other expenditures for reasonableness. See 2 CFR 200.404. 

SUPPLANTING 

In general, funding for any activity must not supplant state funds. Allowable costs would not include 

cybersecurity enhancements that are currently paid for with state or local election jurisdiction funds, such 

as state or local antivirus software. 
 

 

U.S. ELECTION ASSISTANCE COMMISSION

633 3rd St. NW, Suite 200

Washington, DC 20001 

Tel: (301) 563-3919 www.eac.gov Fax: (301) 734-3108

Toll free: 1 (866) 747-1471

APPENDIX A: JUSTIFICATION AND REQUEST FOR APPROVAL

All states and territories that plan to fully allocate cybersecurity costs for elections must contact the EAC 

Office of Grants Management at grants@eac.gov to determine next steps and eligibility. 

HAVA Grantees who wish to fully allocate cybersecurity enhancements that provide secondary benefits 

to non-election activities should provide in writing a request to the EAC that includes the following: 

1. Description of the cybersecurity enhancements including: 

- Date(s) expenses were/will be incurred

- A description of the product deliverables 

2. Explanation of the primary benefit to election administration and any secondary benefits to nonelection activities. 

3. Justification for costs. Please explain why these enhancements are reasonable and necessary for 

the security of elections in your jurisdiction(s).

Upon receipt of written approval from the EAC, grantees will be required to complete and submit 

an attestation that the allocated costs were incurred with the objective of improving elections 

administration and technology (APPENDIX B). Grantees should maintain all communications and 

written approvals in their records to ensure the appropriate documentation is available in case of an audit.
 

 

U.S. ELECTION ASSISTANCE COMMISSION

633 3rd St. NW, Suite 200

Washington, DC 20001 

Tel: (301) 563-3919 www.eac.gov Fax: (301) 734-3108

Toll free: 1 (866) 747-1471

APPENDIX B: SAMPLE ATTESTATION 

August 8, 2023

This letter is to confirm that the cybersecurity enhancements described below and first incurred on DATE

by STATE or TERRITORY were undertaken with the objective of improving voting systems and/or 

technology and for the benefit of elections security. These costs and their justification have been approved 

in writing by the Election Assistance Commission (EAC).

Cybersecurity enhancements referenced in this attestation include: 

Description of cybersecurity enhancements and benefits. 

I certify that the above statements are true and accurate to the best of my knowledge and information. 

Signature

Name

Title