SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Strengthening Election 
Cybersecurity to Uphold Respect for Elections through 
Independent Testing Act’’ or the ‘‘SECURE IT Act’’. 
SEC. 2. REQUIRING PENETRATION TESTING AS PART OF 
THE TESTING AND CERTIFICATION OF VOT-
ING SYSTEMS. 
Section 231 of the Help America Vote Act of 2002 
(52 U.S.C. 20971) is amended by adding at the end the 
following new subsection: 
‘‘(e) REQUIRED PENETRATION TESTING.— 
‘‘(1) IN GENERAL.—Not later than 180 days 
after the date of the enactment of this subsection, 
the Commission shall provide for the conduct of pen-
etration testing as part of the testing, certification, 
decertification, and recertification of voting system 
hardware and software by accredited laboratories 
under this section. 
‘‘(2) ACCREDITATION.—The Director of the 
National Institute of Standards and Technology 
shall recommend to the Commission entities the Di-
rector proposes be accredited to carry out penetra-
tion testing under this subsection and certify compli-
ance with the penetration testing-related guidelines 
required by this subsection. The Commission shall 
vote on the accreditation of any entity recommended. 
VerDate Sep 11 2014 
03:10 Dec 04, 2025
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6315.IH
H6315
kjohnson on DSK7ZCZBW3PROD with $$_JOB
The requirements for such accreditation shall be a 
subset of the requirements for accreditation of lab-
oratories under subsection (b) and shall only be 
based on consideration of an entity’s competence to 
conduct penetration testing under this subsection.’’. 
SEC. 3. INDEPENDENT SECURITY TESTING AND COORDI-
NATED 
CYBERSECURITY 
VULNERABILITY 
DISCLOSURE PROGRAM FOR ELECTION SYS-
TEMS. 
(a) IN GENERAL.—Subtitle D of title II of the Help 
America Vote Act of 2002 (42 U.S.C. 15401 et seq.) is 
amended by adding at the end the following new part: 
‘‘PART 7—INDEPENDENT SECURITY TESTING AND 
COORDINATED 
CYBERSECURITY 
VULNER-
ABILITY DISCLOSURE PILOT PROGRAM FOR 
ELECTION SYSTEMS 
‘‘SEC. 297. INDEPENDENT SECURITY TESTING AND COORDI-
NATED 
CYBERSECURITY 
VULNERABILITY 
DISCLOSURE PILOT PROGRAM FOR ELEC-
TION SYSTEMS. 
‘‘(a) ESTABLISHMENT.—The Commission, in con-
sultation with the Secretary, shall establish an Inde-
pendent Security Testing and Coordinated Vulnerability 
Disclosure Pilot Program for Election Systems (VDP–E) 
(in this section referred to as the ‘program’) in order to 
VerDate Sep 11 2014 
03:10 Dec 04, 2025
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6315.IH
H6315
kjohnson on DSK7ZCZBW3PROD with $$_JOB
test for and disclose cybersecurity vulnerabilities in elec-
tion systems. 
‘‘(b) DURATION.—The program shall be conducted 
for a period of 5 years. 
‘‘(c) REQUIREMENTS.—In carrying out the program, 
the Commission, in consultation with the Secretary, 
shall— 
‘‘(1) establish a mechanism by which an elec-
tion systems vendor may make their election system 
(including voting machines and source code) avail-
able to cybersecurity researchers participating in the 
program; 
‘‘(2) provide for the vetting of cybersecurity re-
searchers prior to their participation in the program, 
including the conduct of background checks; 
‘‘(3) establish terms of participation that— 
‘‘(A) describe the scope of testing per-
mitted under the program; 
‘‘(B) require researchers to— 
‘‘(i) notify the vendor, the Commis-
sion, and the Secretary of any cybersecu-
rity vulnerability they identify with respect 
to an election system; and 
VerDate Sep 11 2014 
03:10 Dec 04, 2025
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6315.IH
H6315
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(ii) otherwise keep such vulnerability 
confidential for 180 days after such notifi-
cation; 
‘‘(C) require the good faith participation of 
all participants in the program; and 
‘‘(D) require an election system vendor, 
after receiving notification of a critical or high 
vulnerability (as defined by the National Insti-
tute of Standards and Technology) in an elec-
tion system of the vendor, to— 
‘‘(i) send a patch or propound some 
other fix or mitigation for such vulner-
ability to the appropriate State and local 
election officials, in consultation with the 
researcher who discovered it; and 
‘‘(ii) notify the Commission and the 
Secretary that such patch has been sent to 
such officials; 
‘‘(4) in the case where a patch or fix to address 
a vulnerability disclosed under paragraph (3)(B)(i) 
is intended to be applied to a system certified by the 
Commission, provide— 
‘‘(A) for the expedited review of such patch 
or fix within 90 days after receipt by the Com-
mission; and 
VerDate Sep 11 2014 
03:10 Dec 04, 2025
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6315.IH
H6315
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) if such review is not completed by the 
last day of such 90-day period, that such patch 
or fix shall be deemed to be certified by the 
Commission; and 
‘‘(5) 180 days after the disclosure of a vulner-
ability under paragraph (3)(B)(i), notify the Direc-
tor of the Cybersecurity and Infrastructure Security 
Agency of the vulnerability for inclusion in the data-
base of Common Vulnerabilities and Exposures. 
‘‘(d) VOLUNTARY PARTICIPATION; SAFE HARBOR.— 
‘‘(1) VOLUNTARY
PARTICIPATION.—Participa-
tion in the program shall be voluntary for election 
systems vendors and researchers. 
‘‘(2) 
SAFE
HARBOR.—Research 
conducted 
under the program, and any subsequent publication 
of such research, shall be treated as follows: 
‘‘(A) The research and publication shall be 
treated as authorized in accordance with section 
1030 of title 18, United States Code (commonly 
known as the ‘Computer Fraud and Abuse 
Act’), (and similar State laws), and the election 
system vendor will not initiate or support legal 
action against the researcher for accidental, 
good faith violations of the program. 
VerDate Sep 11 2014 
03:10 Dec 04, 2025
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6315.IH
H6315
kjohnson on DSK7ZCZBW3PROD with $$_JOB