Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/voting/test-assertions-vvsg-10-section-753-august-2015

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Voting

-  Research and Projects  Expand or Collapse    -  VVSG 
  -  TGDC 
  -  Test Labs 
  -  Accessibility and Human Factors 
  -  Election Security 
  -  Interoperability 
-  Events 
-  About Us 
-  History of Voting  Expand or Collapse    -  Archived Research Papers 
-  Contact Us 

# Test Assertions for VVSG 1.0 Section 7.5.3, August 2015

## Share

Facebook

Linkedin

Twitter

Email

**Requirement 7.5.3**

**VVSG 1.0 Requirement 7.5.3:**

Voting systems that use public telecommunications networks may become vulnerable, by virtue of their system components, to external threats to the accuracy and integrity of vote recording, vote counting, and vote consolidation and reporting processes. Therefore, vendors of such systems shall document how they plan to monitor and respond to known threats to which their voting systems are vulnerable. This documentation shall provide a detailed description, including scheduling information, of the procedures the vendor will use to:

a.    Monitor threats, such as through the review of assessments, advisories, and alerts for COTS components issued by the Computer Emergency Response Team (CERT), for which a current listing can be found at http://www.cert.org, the National Infrastructure Protection Center (NIPC), and the Federal Computer Incident Response Capability (FedCIRC), for which additional information can be found at www.uscert.gov

b.   Evaluate the threats and, if any, proposed responses

c.    Develop responsive updates to the system and/or corrective procedures

d.   Submit the proposed response to the test labs and appropriate states for approval, identifying the exact changes and whether or not they are temporary or permanent

e.    After implementation of the proposed response is approved by the state, assist clients, either directly or through detailed written procedures, how to update their systems and/or to implement the corrective procedures within the timeframe established by the state

f.    Address threats emerging too late to correct the system by:

i.                 Providing prompt, emergency notification to the accredited test labs and the affected states and user jurisdictions

ii.               Assisting client jurisdictions directly or advising them through detailed written procedures to disable the public telecommunications mode of the system

iii.             Modifying the system after the election to address the threat, submitting the modified system to an accredited test lab and the EAC or state certification authority for approval, and assisting client jurisdictions directly or advising them through detailed written procedures, to update their systems and/or to implement the corrective procedures after approval.

**Test Assertions**

**TA753-1:** IF a voting system uses a public telecommunications network THEN that voting system SHALL document all known threats to which the voting system is vulnerable.

**TA753-2:** IF a voting system uses a public telecommunications network THEN that voting system SHALL provide documentation explaining how it plans to monitor known threats to the accuracy and integrity of vote recording, vote counting, and vote consolidation and reporting processes to which their voting systems are vulnerable.

**TA753-3:** IF a voting system uses a public telecommunications network THEN that voting system SHALL provide documentation explaining how it plans to respond to known threats to the accuracy and integrity of vote recording, vote counting, and vote consolidation and reporting processes to which their voting systems are vulnerable.

**TA753a-1:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to monitor threats.

**TA753a-1-1:** These procedures MAY include the review of assessments for COTS components issued by the Computer Emergency Response Team (CERT), for which a current listing can be found at https://www.us-cert.gov/ .

**TA753a-1-2:** These procedures MAY include the review of advisories for COTS components issued by the Computer Emergency Response Team (CERT), for which a current listing can be found at https://www.us-cert.gov/ .

**TA753a-1-3:** These procedures MAY include the review of alerts for COTS components issued by the Computer Emergency Response Team (CERT), for which a current listing can be found at https://www.us-cert.gov/.

**TA753b-1:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to evaluate any and all threats.

**TA753b-2:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to propose responses to any and all threats.

**TA753c-1:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to develop responsive updates to the system for each and every known threat to which the voting system is vulnerable.

**TA753c-2:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to develop corrective procedures for each and every known threat to which the voting system is vulnerable.

**TA753d-1:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to submit the proposed response to the test labs and appropriate states for approval, identifying the **exact changes** to be made to the voting system.

**TA753d-1-1:**This documentation MAY reference the EAC emergency certification procedures described in section 3.6 of the EAC Voting System Testing and Certification Program Manual.

**TA753d-2:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to submit the proposed response to the test labs and appropriate states for approval, identifying **whether or not the exact changes** to the voting system are temporary or permanent.

**TA753e-1:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to assist clients on how to **update** their systems within the timeframe established by the state, after implementation of the proposed response is approved by the state.

**TA753e-1-1:** This assistance SHALL occur in one of two ways – EITHER directly OR through detailed written procedures.

**TA753e-2:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to assist clients on how to **implement** any corrective procedures within the timeframe established by the state, after implementation of the proposed response is approved by the state.

**TA753e-2-1:** This assistance SHALL occur in one of two ways – EITHER directly OR through detailed written procedures.

**TA753fi-1:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by providing prompt, emergency notification to the accredited test labs.

**TA753fi-2:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by providing prompt, emergency notification to the affected states.

**TA753fi-3:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by providing prompt, emergency notification to the affected user jurisdictions.

**TA753fii-1:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by communicating to client jurisdictions how to disable the public telecommunications mode of the system.

**TA753fii-1-1:** This communication SHALL occur in one of two ways – EITHER by assisting client jurisdictions directly OR by advising them through detailed written procedures.

**TA753fiii-1:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by modifying the system after the election to address the threat.

**TA753fiii-2:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by submitting the modified system to an accredited test lab and the EAC or state certification authority for approval.

**TA753fiii-3:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by communicating to client jurisdictions to **update** their systems.

**TA753fiii-3-1:** This communication SHALL occur in one of two ways – EITHER by assisting client jurisdictions directly OR by advising them through detailed written procedures.

**TA753fiii-4:** This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by communicating to client jurisdictions to **implement** any corrective procedures after approval.

**TA753fiii-4-1:** This communication SHALL occur in one of two ways – EITHER by assisting client jurisdictions directly OR by advising them through detailed written procedures.

Information technologyVoting systems

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov