U.S. flag
        An official website of the United States government
          Here’s how you know
        Here’s how you know**Official websites use .gov**
              
              A **.gov** website belongs to an official government organization in the United States.
        **Secure .gov websites use HTTPS**
              
              A **lock** (  A locked padlock
) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. https://www.nist.gov/itl/voting/test-assertions-vvsg-11-volume-1-section-753-september-23-2016-tabular
  Search NIST
    Search
              Menu

      


Close
    Topics
        All Topics
                                                        Advanced communications
                                                        Artificial intelligence
                                                        Bioscience
                                                        Buildings and construction
                                                        Chemistry
                                                        Climate
                                                        Cybersecurity
                                                        Electronics
                                                        EnergyEnvironment
                                                        Fire
                                                        Forensic science
                                                        Health
                                                        Information technology
                                                        Infrastructure
                                                        Manufacturing
                                                        Materials
                                                        Mathematics and statisticsMetrology
                                                        Nanotechnology
                                                        Neutron research
                                                        Performance excellence
                                                        Physics
                                                        Public safety
                                                        Resilience
                                                        Standards
                                                        Transportation
            Publications
            Labs & Major Programs
        Laboratories
                                Communications Technology Laboratory
                                  Engineering Laboratory
                                  Information Technology Laboratory
                                  Material Measurement Laboratory
                                  Physical Measurement LaboratoryUser Facilities
                                NIST Center for Neutron Research
                                  CNST NanoFab
                                                        Research Test Beds
                                                        Research Projects
                                                        Tools & InstrumentsMajor Programs
                                Baldrige Performance Excellence Program
                                  CHIPS for America Initiative
                                  Manufacturing Extension Partnership (MEP)
                                  Office of Advanced Manufacturing
                                  Special Programs Office
                                  Technology Partnerships Office
            Services & Resources
        Standards and Measurements
                                Calibration Services
                                  Laboratory Accreditation (NVLAP)
                                  Quality System
                                  Standard Reference Materials (SRMs)
                                  Standards.gov
                                  Time Services
                                  Office of Weights and MeasuresSoftware
                                                        Data
                                Chemistry WebBook
                                  National Vulnerability Database
                                  Physical Reference Data
                                  Standard Reference Data (SRD)
                                                        Storefront
                                                        License & PatentsComputer Security Resource Center (CSRC)
                                                        NIST Research Library
            News & Events
        News
                                                        Events
                                                        Blogs
                                                        Feature Stories
                                                        AwardsVideo Gallery
                                                        Image Gallery
                                                        Media Contacts
            About NIST
        About Us
                                Leadership
                                  Organization Structure
                                  Budget & Planning
                                                        Contact Us
                                                        Visit
                                                        Careers
                                Student programsWork with NIST
                                                        History
                                NIST Digital Archives
                                  NIST Museum
                                  NIST and the Nobel
                                                        Educational Resources
 
 Information Technology Laboratory
      Voting
    
      
  Research and Projects
                            Expand or Collapse
          VVSG
                      TGDC
                      Test Labs
                      Accessibility and Human Factors
                      Election Security
                      Interoperability
          Events
          About Us
          History of Voting
                            Expand or Collapse
          Archived Research Papers
          Contact UsTest Assertions for VVSG 1.1, Volume 1, Section 7.5.3, September 23, 2016 (tabular)

Share
  Facebook
                      Linkedin
                      Twitter
                      Email

*Summary Tabular Format***Requirement****Assertion(s)****VVSG 1.1, Vol 1, Requirement 7.5.3:** **Monitoring and Responding to External Threats**Voting systems that use public telecommunications networks may become vulnerable, by virtue of their system components, to external threats to the accuracy and integrity of vote recording, vote counting, and vote consolidation and reporting processes. Therefore, manufacturers of such systems **shall** document how they plan to monitor and respond to known threats to which their voting systems are vulnerable. This documentation **shall** provide a detailed description, including scheduling information, of the procedures the manufacturer will use to:Monitor threats, such as through the review of assessments, advisories, and alerts for COTS components issued by the Computer Emergency Response Team (CERT), for which a current listing can be found at http://www.cert.orgEvaluate the threats and, if any, proposed responsesDevelop responsive updates to the system and/or corrective proceduresSubmit the proposed response to the VSTLs and appropriate states for approval, identifying the exact changes and whether or not they are temporary or permanentAfter implementation of the proposed response is approved, assist clients, either directly or through detailed written procedures, how to update their systems and/or to implement the corrective procedures within the timeframe establishedAddress threats emerging too late to correct the system by:Providing prompt, emergency notification to the EAC, VSTLs and the affected states and user jurisdictionsAssisting client jurisdictions directly or advising them through detailed written procedures to disable the public telecommunications mode of the systemModifying the system after the election to address the threat, submitting the modified system to a VSTL and the EAC for approval, and assisting client jurisdictions directly or advising them through detailed written procedures, to update their systems and/or to implement the corrective procedures after approval**TA753-1:** IF a voting system uses a public telecommunications network THEN that voting system SHALL document all known threats to which the voting system is vulnerable.**TA753-2:**  IF a voting system uses a public telecommunications network THEN that voting system SHALL provide documentation explaining how the voting system plans to monitor known threats to the accuracy and integrity of vote recording, vote counting, and vote consolidation and reporting processes to which their voting systems are vulnerable.**TA753-3:**  IF a voting system uses a public telecommunications network THEN that voting system SHALL provide documentation explaining how the voting system plans to respond to known threats to the accuracy and integrity of vote recording, vote counting, and vote consolidation and reporting processes to which their voting systems are vulnerable.**TA753a-1:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to monitor threats.**TA753a-1-1:**  These procedures MAY include the review of assessments for COTS components issued by the Computer Emergency Response Team (CERT), for which a current listing can be found at https://www.us-cert.gov/ncas/ .**TA753a-1-2:**  These procedures MAY include the review of advisories for COTS components issued by the Computer Emergency Response Team (CERT), for which a current listing can be found at https://www.us-cert.gov/ncas/.**TA753a-1-3:**  These procedures MAY include the review of alerts for COTS components issued by the Computer Emergency Response Team (CERT), for which a current listing can be found at https://www.us-cert.gov/ncas/.**TA753b-1:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to evaluate any and all threats.**TA753b-2:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to propose responses to any and all threats.**TA753c-1:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to develop responsive updates to the system for each and every known threat to which the voting system is vulnerable.**TA753c-2:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to develop corrective procedures for each and every known threat to which the voting system is vulnerable.**TA753d-1:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to submit the proposed response to the test labs and appropriate states for approval, identifying the **exact changes** to be made to the voting system.**TA753d-1-1:** This documentation MAY reference the EAC emergency certification procedures described in section 3.6 of the EAC Voting System Testing and Certification Program Manual.**TA753d-2:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to submit the proposed response to the test labs and appropriate states for approval, identifying **whether or not the exact changes** to the voting system are temporary or permanent.**TA753e-1:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to assist clients on how to **update** their systems within the timeframe established, after implementation of the proposed response is approved.**TA753e-1-1:**  This assistance SHALL occur in one of two ways – EITHER directly OR through detailed written procedures.**TA753e-2:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to assist clients on how to **implement** any corrective procedures within the timeframe established, after implementation of the proposed response is approved.**TA753e-2-1:**  This assistance SHALL occur in one of two ways – EITHER directly OR through detailed written procedures.**TA753fi-1:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by providing prompt, emergency notification to the VSTLs.**TA753fi-2:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by providing prompt, emergency notification to the EAC.**TA753fi-3:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by providing prompt, emergency notification to the affected states.**TA753fi-4:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by providing prompt, emergency notification to the affected user jurisdictions.**TA753fii-1:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by communicating to client jurisdictions how to disable the public telecommunications mode of the system.**TA753fii-1-1:**  This communication SHALL occur in one of two ways – EITHER by assisting client jurisdictions directly OR by advising them through detailed written procedures.**TA753fiii-1:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by modifying the system after the election to address the threat.**TA753fiii-2:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by submitting the modified system to a VSTL and the EAC for approval.**TA753fiii-3:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by communicating to client jurisdictions to **update** their systems.**TA753fiii-3-1:**  This communication SHALL occur in one of two ways – EITHER by assisting client jurisdictions directly OR by advising them through detailed written procedures.**TA753fiii-4:**  This documentation SHALL provide a detailed description, including, but not limited to, scheduling information, of the procedures the vendor will use to address threats emerging too late to correct the system by communicating to client jurisdictions to **implement** any corrective procedures after approval.**TA753fiii-4-1:**  This communication SHALL occur in one of two ways – EITHER by assisting client jurisdictions directly OR by advising them through detailed written procedures.
  Information technology and Voting systems

    
    Created September 22, 2016, Updated October 19, 2016
 HEADQUARTERS
            100 Bureau Drive
              Gaithersburg, MD 20899301-975-2000
            Webmaster | Contact Us | Our Other Offices
        Twitter
            
Facebook
            
LinkedIn
            
Instagram
            
YouTube
            
Giphy
            
RSS Feed
            
Mailing List
                              How are we doing? Feedback

  
  Site Privacy
                      Accessibility
                      Privacy Program
                      Copyrights
                      Vulnerability Disclosure
                      No Fear Act Policy
                      FOIA
                      Environmental Policy
                      Scientific Integrity
                      Information Quality Standards
                      Commerce.gov
                      Science.gov
                      USA.gov
                      Vote.gov