‘‘(F) Publishing and enforcing a policy de-
tailing use limitations and security safeguards 
to protect the personal information of voters in 
the voter registration process. 
‘‘(G) Providing secure processes and proce-
dures for reporting vote tallies. 
‘‘(H) Providing a secure platform for dis-
seminating vote totals. 
‘‘(2) Evidence of established conditions of inno-
vation and reform in providing voting system secu-
rity and the proposed plan of the State for imple-
menting additional conditions. 
‘‘(3) Evidence of collaboration between relevant 
stakeholders, including local election officials, in de-
veloping the grant implementation plan described in 
section 297B. 
‘‘(4) The plan of the State to conduct a rig-
orous evaluation of the effectiveness of the activities 
carried out with the grant. 
‘‘(e) ABILITY OF REPLACEMENT SYSTEMS TO AD-
MINISTER RANKED CHOICE ELECTIONS.—To the greatest 
extent practicable, an eligible State which receives a grant 
to replace a voting system under this section shall ensure 
that the replacement system is capable of administering 
a system of ranked choice voting under which each voter 
VerDate Sep 11 2014 
20:28 May 28, 2019
Jkt 034408
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2722.IH
H2722
pbinns on DSK79D2C42PROD with BILLS
shall rank the candidates for the office in the order of 
the voter’s preference. 
‘‘SEC. 297A. VOTING SYSTEM SECURITY IMPROVEMENTS 
DESCRIBED. 
‘‘(a) PERMITTED USES.—A voting system security 
improvement described in this section is any of the fol-
lowing: 
‘‘(1) The acquisition of goods and services from 
qualified election infrastructure vendors by purchase, 
lease, or such other arrangements as may be appro-
priate. 
‘‘(2) Cyber and risk mitigation training. 
‘‘(3) A security risk and vulnerability assess-
ment of the State’s election infrastructure which is 
carried out by a provider of cybersecurity services 
under a contract entered into between the chief 
State election official and the provider. 
‘‘(4) The maintenance of election infrastruc-
ture, including addressing risks and vulnerabilities 
which are identified under either of the security risk 
and vulnerability assessments described in para-
graph (3), except that none of the funds provided 
under this part may be used to renovate or replace 
a building or facility which is used primarily for pur-
VerDate Sep 11 2014 
20:28 May 28, 2019
Jkt 034408
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2722.IH
H2722
pbinns on DSK79D2C42PROD with BILLS
poses other than the administration of elections for 
public office. 
‘‘(5) Providing increased technical support for 
any information technology infrastructure that the 
chief State election official deems to be part of the 
State’s election infrastructure or designates as crit-
ical to the operation of the State’s election infra-
structure. 
‘‘(6) Enhancing the cybersecurity and oper-
ations of the information technology infrastructure 
described in paragraph (4). 
‘‘(7) Enhancing the cybersecurity of voter reg-
istration systems. 
‘‘(b) QUALIFIED ELECTION INFRASTRUCTURE VEN-
DORS DESCRIBED.— 
‘‘(1) IN GENERAL.—For purposes of this part, 
a ‘qualified election infrastructure vendor’ is any 
person who provides, supports, or maintains, or who 
seeks to provide, support, or maintain, election in-
frastructure on behalf of a State, unit of local gov-
ernment, or election agency (as defined in section 
801 of the Election Security Act) who meets the cri-
teria described in paragraph (2). 
‘‘(2) CRITERIA.—The criteria described in this 
paragraph are such criteria as the Chairman, in co-
VerDate Sep 11 2014 
20:28 May 28, 2019
Jkt 034408
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2722.IH
H2722
pbinns on DSK79D2C42PROD with BILLS
ordination with the Secretary of Homeland Security, 
shall establish and publish, and shall include each of 
the following requirements: 
‘‘(A) The vendor must be owned and con-
trolled by a citizen or permanent resident of the 
United States. 
‘‘(B) The vendor must disclose to the 
Chairman and the Secretary, and to the chief 
State election official of any State to which the 
vendor provides any goods and services with 
funds provided under this part, of any sourcing 
outside the United States for parts of the elec-
tion infrastructure. 
‘‘(C) The vendor agrees to ensure that the 
election infrastructure will be developed and 
maintained in a manner that is consistent with 
the cybersecurity best practices issued by the 
Technical Guidelines Development Committee. 
‘‘(D) The vendor agrees to maintain its in-
formation technology infrastructure in a man-
ner that is consistent with the cybersecurity 
best practices issued by the Technical Guide-
lines Development Committee. 
‘‘(E) The vendor agrees to meet the re-
quirements of paragraph (3) with respect to 
VerDate Sep 11 2014 
20:28 May 28, 2019
Jkt 034408
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2722.IH
H2722
pbinns on DSK79D2C42PROD with BILLS
any known or suspected cybersecurity incidents 
involving any of the goods and services provided 
by the vendor pursuant to a grant under this 
part. 
‘‘(F) The vendor agrees to permit inde-
pendent security testing by the Commission (in 
accordance with section 231(a)) and by the Sec-
retary of the goods and services provided by the 
vendor pursuant to a grant under this part. 
‘‘(3) CYBERSECURITY
INCIDENT
REPORTING 
REQUIREMENTS.— 
‘‘(A) IN GENERAL.—A vendor meets the 
requirements of this paragraph if, upon becom-
ing aware of the possibility that an election cy-
bersecurity incident has occurred involving any 
of the goods and services provided by the ven-
dor pursuant to a grant under this part— 
‘‘(i) the vendor promptly assesses 
whether or not such an incident occurred, 
and submits a notification meeting the re-
quirements of subparagraph (B) to the 
Secretary and the Chairman of the assess-
ment as soon as practicable (but in no case 
later than 3 days after the vendor first be-
VerDate Sep 11 2014 
20:28 May 28, 2019
Jkt 034408
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H2722.IH
H2722
pbinns on DSK79D2C42PROD with BILLS
comes aware of the possibility that the in-
cident occurred); 
‘‘(ii) if the incident involves goods or 
services provided to an election agency, the 
vendor submits a notification meeting the 
requirements of subparagraph (B) to the 
agency as soon as practicable (but in no 
case later than 3 days after the vendor 
first becomes aware of the possibility that 
the incident occurred), and cooperates with 
the agency in providing any other nec-
essary notifications relating to the inci-
dent; and 
‘‘(iii) the vendor provides all necessary 
updates to any notification submitted 
under clause (i) or clause (ii). 
‘‘(B) CONTENTS
OF
NOTIFICATIONS.— 
Each notification submitted under clause (i) or 
clause (ii) of subparagraph (A) shall contain 
the following information with respect to any 
election cybersecurity incident covered by the 
notification: 
‘‘(i) The date, time, and time zone 
when the election cybersecurity incident 
began, if known. 
VerDate Sep 11 2014 
20:28 May 28, 2019
Jkt 034408
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H2722.IH
H2722
pbinns on DSK79D2C42PROD with BILLS