In-kind match is always a contribution by a third-party.  Expenditures that the state incurs through its own budget are cash match.  Expenditures the state incurs, regardless of whether they were formerly paid for with federal funds, can be counted as state match as long as they are expended for activities within the approved budget for the grant (allocable to the grant).  E.g. The grant budget and narrative indicate the 2020 funds will be spent for activities in support of post-election auditing and cyber security upgrades to the voter registration system.  Costs the state covers for those activities can be used as match on the grant. 

The EAC will publish a list of voting systems that have been certified with this patch. Additionally, you should reach out to your voting system vendor for information on whether an update is necessary and what their implementation plan is in the event you require an update.

The EAC has reached out to voting system manufacturers and test labs reminding them that software de minimis changes are available for this type of update. We encourage manufacturers to submit updates to affected systems as soon as possible. The Testing and Certification program stands ready to expedite review of these changes.

Since the ECC vulnerability described above requires that malicious software be loaded on to a vulnerable system in some manner, security measures designed to protect against accidental or unauthorized software installation should be implemented and/or existing procedures reviewed. For voting systems, precautions should be taken when transporting media (USB, flash drives, DVD-ROM, etc.) between components connected to public networks such as the internet and certified voting system components. This could include setting up a stand-alone PC (not connected to the internet or voting system) that has been patched and has up-to-date anti-malware/anti-virus software installed that is used to scan any media before it is introduced to the voting system. Additionally, we recommend that physical security best practices should be followed, including sealing USB, CD/DVD readers, and other external connections when not in use.