((a)) ** Certification and testing**
((1)) ** In general** The Commission shall provide for the testing, certification, decertification, and recertification of voting system hardware and software by accredited laboratories.
((2)) ** Optional use by States** At the option of a State, the State may provide for the testing, certification, decertification, or recertification of its voting system hardware and software by the laboratories accredited by the Commission under this section.
((b)) ** Laboratory accreditation**
((1)) ** Recommendations by National Institute of Standards and Technology** Not later than 6 months after the Commission first adopts voluntary voting system guidelines under subpart 3 of part A of this subchapter, the Director of the National Institute of Standards and Technology shall conduct an evaluation of independent, non-Federal laboratories and shall submit to the Commission a list of those laboratories the Director proposes to be accredited to carry out the testing, certification, decertification, and recertification provided for under this section.
((2)) ** Approval by Commission**
((A)) ** In general** The Commission shall vote on the accreditation of any laboratory under this section, taking into consideration the list submitted under paragraph (1), and no laboratory may be accredited for purposes of this section unless its accreditation is approved by a vote of the Commission.
((B)) ** Accreditation of laboratories not on Director list** The Commission shall publish an explanation for the accreditation of any laboratory not included on the list submitted by the Director of the National Institute of Standards and Technology under paragraph (1).
((c)) ** Continuing review by National Institute of Standards and Technology**
((1)) ** In general** In cooperation with the Commission and in consultation with the Standards Board and the Board of Advisors, the Director of the National Institute of Standards and Technology shall monitor and review, on an ongoing basis, the performance of the laboratories accredited by the Commission under this section, and shall make such recommendations to the Commission as it considers appropriate with respect to the continuing accreditation of such laboratories, including recommendations to revoke the accreditation of any such laboratory.
((2)) ** Approval by Commission required for revocation** The accreditation of a laboratory for purposes of this section may not be revoked unless the revocation is approved by a vote of the Commission.
((d)) ** Transition** Until such time as the Commission provides for the testing, certification, decertification, and recertification of voting system hardware and software by accredited laboratories under this section, the accreditation of laboratories and the procedure for the testing, certification, decertification, and recertification of voting system hardware and software used as of , shall remain in effect.October 29, 20022002-10-29
((e)) ** Required penetration testing**
((1)) ** In general** Not later than 180 days after , the Commission shall provide for the conduct of penetration testing as part of the testing, certification, decertification, and recertification of voting system hardware and software by the Commission based on accredited laboratories under this section.December 18, 20252025-12-18
((2)) ** Accreditation** The Commission shall develop a program for the acceptance of the results of penetration testing on election systems. The penetration testing required by this subsection shall be required for Commission certification. The Commission shall vote on the selection of any entity identified. The requirements for such selection shall be based on consideration of an entity’s competence to conduct penetration testing under this subsection. The Commission may consult with the National Institute of Standards and Technology or any other appropriate Federal agency on lab selection criteria and other aspects of this program.
