New Jersey Administrative Code › Title 15 - STATE › Chapter 10 - ELECTIONS › Subchapter 7 - ELECTRONIC POLL BOOKS › Section 15:10-7.5 - Technical requirements for e-poll book systems

Current through Register Vol. 56, No. 14, July 15, 2024
(a) The e-poll book system must comport with N.J.S.A. 19:31-36.
(b) Password protected accounts must be used to access or operate the e-poll book system, including operating systems and applications.
(c) User accounts in an e-poll book system must follow NIST 800-53 standard guidelines for access control management and allow separation of duties by user according to the principle of least privilege. The guidelines include, but are not limited to, the requirement to identify and document functions, tasks, and responsibilities, including system maintenance, day-to-day computer operations, and security/system administration duties; as well as define system access authorizations to support separation of duties to prevent malevolent activity without collusion.
(d) Passwords used in an e-poll book system must follow standard guidelines for identity and authentication management best practices. This should include minimum requirements for non-privileged users and strong password requirements for privileged users and service accounts.
(e) Any administrative accounts or user accounts that have the ability to add, modify, or delete programs or data must use multifactor authentication.
(f) Detailed network and system architecture diagrams showing all software and hardware must be submitted to the Division of Gaming Enforcement (DGE) for testing and examination.
(g) The e-poll book system must prevent unauthorized devices from connecting to the system.
(h) Remote access from outside the e-poll book system is not allowed without prior written authorization from the Director of the Division of Elections.
(i) All network protocols, system services, and applications not required for the e-poll book system to function must be removed or, if they cannot be removed, disabled.
(j) All network ports not required for the e-poll book system to function must be blocked by a firewall.
(k) All cryptographic modules used in an e-poll book system must comply with the guidelines set forth in the System and Communications Protection section of NIST 800-53 under "Cryptographic Protection."
(l) All network communications between components in the e-poll book system must be secured by following standard guidelines in the System and Communications Protection section of NIST 800-53, under "Transmission Confidentiality and Integrity." If wireless networks are used, standard guidelines under "Access Control/Wireless Access" of NIST 800-53 must be followed.
(m) Any communications between the New Jersey Statewide Voter Registration System (NJSVRS) and e-poll book systems must be secured by following standard guidelines in the Access Control/Information Flow Enforcement section of NIST 800-53.
(n) The e-poll book system must ensure voter information received from the NJSVRS has not been modified from the original.
(o) The e-poll book system must only allow voters eligible to vote in the NJSVRS system to sign in.
(p) All voter-related information stored by an e-poll book system, including backups, must be encrypted by following standard guidelines in the System and Communications Protection section of NIST 800-53 under "Protection of Information at Rest."
(q) Any use of cloud services must meet Federal Risk and Authorization Management Program (FedRAMP) "High Impact Level" standards and be located in a government cloud.
(r) Any removable storage media and files stored on removable media used by the e-poll book system must follow standard guidelines in the Media Protection section of NIST 800-53.
(s) All components of an e-poll book system that contain clocks must be synchronized to the correct time zone and local time by following standard guidelines in the System and Communications Protection section of NIST 800-53 for "System Time Synchronization."
(t) The e-poll book system must prevent a voter from being authorized to vote more than once in an election.
(u) The e-poll book system must have a legible user interface (UI) for voters. The voter UI must offer a "help" option that provides all information required for the voter to properly use the system.
(v) A voter may only use the e-poll book system if that voter's information is in the system. If a voter's information is not in the system, a message must be displayed to the voter advising that their information is not available.
(w) A voter may view only their own information in an e-poll book system.
(x) The e-poll book system must automatically check, at least once per hour, and on demand by an administrator, to ensure only approved software and settings exist in the system and that the system is functioning without errors. If an issue is discovered, the e-poll book system must automatically record the error in a System Integrity Failure Log, pursuant to (bb) below. The e-poll book system must automatically halt operations on all affected devices, with a detailed error message displayed on each device. Operations on all affected devices may only resume once the error has been resolved.
(y) The e-poll book system must allow external verification of its critical files in a manner approved by the DGE and the Division of Elections, pursuant to N.J.A.C. 15:10-7.6.
(z) The e-poll book system must use uninterruptable power supplies capable of providing enough time to completely process the last voter and shut down the system without losing any information.
(aa) The e-poll book system must, at a minimum, be capable of displaying the following error messages:
1. Low battery level detected on the device;
2. Failure during voter check in;
3. System connection failure;
4. System integrity failure; and
5. Hardware failure.