New York Codes, Rules and Regulations › Title 9 - EXECUTIVE DEPARTMENT › Subtitle V - State Board of Elections › Part 6209 - Voting Systems Standards › Section 6209.6 - Examination criteria

Current through Register Vol. 46, No. 28, July 10, 2024
(a)
				State Board testing and examination shall be performed in an open and public
				venue. Testing shall be performed in conformity with written procedures adopted
				by the State Board. Such procedures and the test reports of the State Board and
				its ITA, shall be available for public inspection at the office of the State
				Board, and at its website. Each tested system shall, at a minimum, conform to
				the EAC's 2005 Voluntary Voting System Guidelines, to the extent that they are
				consistent with State law and this Part.
(b) The State Board or its designee, as part
				of its examination, may at its discretion, submit the voting system for
				analysis by a testing laboratory.
(c) Whenever the State Board is satisfied
				that a voting machine or system has been proven to meet the environmental
				standards of section
				6209.2(e) 
				of this Part; and the vendor is able to provide documentation for the State
				Board's testing authority to establish that those standards have been met; then
				the State Board may, in its discretion, accept such documentation as
				satisfaction of the tests required by these regulations.
(d) All laboratory testing shall be conducted
				or verified by independent testing authorities appropriately certified by the
				National Association of State Election Directors, the EAC or approved by the
				commissioners of the State Board.
(1)
				Software and hardware qualification tests. Qualification of voting system
				software and hardware shall consist of a series of tests, code analyses, and
				inspection tests performed at the Federal and State levels, to verify that the
				software and hardware meet design requirements and that characteristics are
				correctly described in the documentation items. Qualification shall also
				include a functional configuration audit and a physical configuration
				audit.
(2) Functional configuration
				audit. A functional configuration audit shall be performed to verify that the
				software complies with the software specification (as defined in paragraph
				[f][3] of this section) and applicable laws and regulations. Federal
				qualification test data may be used in partial fulfillment of this requirement;
				however, the State Board or its designee shall perform or supervise the
				performance of additional tests, or order additional laboratory testing, to
				verify system performance in all operating modes, including but not limited to
				disability access and alternate language modes and to validate the vendor's
				test data reports. The functional configuration audit shall be performed in a
				facility selected by the State Board.
(i)
				Vendor responsibility. The vendor shall provide a list of all documentation and
				data required to be included as part of the independent review, and vendor
				technical personnel shall be available to the State Board during the
				performance of the functional configuration audit.
(ii) Technical data. The vendor shall provide
				the following technical data:
(a) copies of
				all procedures used for module or unit testing, integration testing and system
				testing;
(b) copies of all test
				cases generated for each module and integration test and sample ballot formats
				or other test cases used for system;
(c) records of all tests performed by the
				procedures listed above, including error correction and retest.
(iii) Audit procedure. The State
				Board, with the assistance of an independent testing authority, shall subject
				each voting system to a complete functional test, including but not limited to
				actual use testing of all components used by voters to enter or review votes.
				Additionally, the State Board and its independent testing authority shall
				review the vendor's test procedures and test results. This review shall include
				an assessment of the adequacy of test cases and input data to exercise all
				system functions and to detect program logic and data processing errors if such
				be present. The review shall also include an examination of all test data which
				is to be used as a basis for qualification.
(3) Physical configuration audit. The
				physical configuration audit is an examination of the software configuration
				against its technical documentation to establish a configuration baseline for
				approval. The physical configuration audit shall include an audit of all
				drawings, specifications, technical data and test data associated with the
				system hardware and this audit shall establish the system hardware baseline
				associated with the software baseline. All subsequent changes to the software
				or hardware shall be subject to re-examination.
(i) Vendor responsibility. The vendor shall
				provide a list of all documentation and data required to be audited by the
				State Board. Vendor's technical personnel shall be available to the State Board
				during the performance of the physical configuration audit.
(ii) Technical data. The vendor shall provide
				the following technical data:
(a)
				identification of all items which are to be a part of the software
				release;
(b) identification of all
				hardware which interfaces with the software;
(c) configuration baseline data for all
				hardware included within the system;
(d) copies of all software documentation
				which is intended for distribution to users, including program listings,
				specifications, operator manual, user manual and software maintenance
				manual;
(e) proposed user
				acceptance test procedure and acceptance criteria;
(f) an identification and explanation of any
				changes between the physical configuration audit and the configuration
				submitted for the functional configuration audit.
(iii) Audit procedure. Required data items
				include draft and formal documentation of the vendor's software development
				program which are relevant to the design and conduct of qualification tests.
				The vendor shall identify all documents, or portions of documents, which the
				vendor asserts contain proprietary information not approved for public release.
				The State Board or its designee shall agree to use any proprietary information
				contained therein solely for the purpose of analyzing and testing the software
				and shall refrain from disclosing proprietary information to any other person
				or agency without the prior written consent of the vendor or a court order. The
				State Board or its designee shall review the vendor's source code and
				documentation to verify that the software conforms to the documentation, and
				that the documentation is sufficient to enable the user to install, validate,
				operate and maintain the voting system. The review shall also include an
				inspection of all records of the baseline version against the vendor's release
				control system to establish that the configuration, being qualified, conforms
				to the engineering and test data.