Election Vendor Security Act

“304. Requirements for vendors of election systems

“(a) Prohibiting agreements with vendors failing To meet requirements—A State, unit of local government, or any component of a State or unit of local government which is responsible for the administration of an election for Federal office may not enter into an agreement with a vendor to provide, support, or maintain any component of the election system unless the vendor meets the criteria described in subsection (b).

“(b) Criteria for vendors—The criteria described in this subsection with respect to a vendor are as follows, as established and published by the Chair of the Commission in coordination with the Secretary of Homeland Security:

“(1) The vendor shall certify that it is owned and controlled by a citizen, national, or permanent resident of the United States, and that none of its activities are directed, supervised, controlled, subsidized, or financed, and none of its policies are determined by, any foreign principal (as defined in section 1(b) of the Foreign Agents Registration Act of 1938 (22 U.S.C. 611(b)), or by any agent of a foreign principal required to register under such Act.

“(2) The vendor shall disclose to the Chair and the Secretary, and to the chief State election official of any State in which the vendor provides, supports, or maintains any component of an election system, any sourcing outside the United States for parts of the system.

“(3) The vendor shall ensure that the election system will be developed and maintained in a manner that is consistent with the cybersecurity best practices established under subsection (c).

“(4) The vendor shall maintain its information technology infrastructure in a manner that is consistent with the cybersecurity best practices established under subsection (c).

“(5) The vendor shall report any known or suspected security incidents involving election systems to the chief State election official of the State involved or the official’s designee, the Chair, and the Secretary not later than 10 days after the vendor first knows or suspects that the incident occurred.

“(c) Cybersecurity best practices—Not later than 90 days after the date of the enactment of this section, the Chair and the Secretary of Homeland Security shall establish and publish cybersecurity best practices for vendors who provide, support, or maintain election systems, and shall establish and publish updates to such best practices at such times as the Chair and the Secretary consider appropriate.

“(d) Availability of list of participating vendors

“(1) Submission of list to Commission—Not later than 90 days before the date of each regularly scheduled general election for Federal office (beginning with the election held in November 2018), each State shall submit to the Commission a list of all vendors who will be providing, supporting, or maintaining any component of any election system which will be used to carry out such election in the State.

“(2) Posting by Commission—Upon receiving a list from a State under paragraph (1), the Commission shall post the list on the official public website of the Commission.

“(e) Election system defined—In this section, the term “election system” means any system used in the administration of elections for Federal office, as well as related information and communications technology, including voter registration databases, voting machines, electronic mail and other communications systems (including electronic mail and other systems of vendors who have entered into contracts with election agencies to support the administration of elections, manage the election process, and report and display election results), and other systems used to manage the election process and to report and display election results on behalf of a State or unit of local government.”