The intent of section 3.8 in the Voting System Test Laboratory Manual, version 2.0 is to make clear that the VSTL accreditation is subject to reassessment by NVLAP and the EAC with a period of approximately two years, at the discretion of the EAC. It is not intended to describe the EAC VSTL accreditation revocation process, which is described in chapter 5 of the Voting System Test Laboratory Manual, version 2.0.

The EAC has determined that allowing software de minimis changes is necessary to confront a rapidly evolving cybersecurity threat environment as well as allowing Manufacturers to quickly respond to changing jurisdictional requirements, where those requirements can be addressed with minor changes.

The EAC will use each manufacturer's quality assurance system and its internal procedures for controlling changes to, and versions of, it's voting systems when determining when a voting system is a "new" system.

Tight project schedules and other realities of voting system testing and certification have generally made manufacturers choose to move forward with “at risk” testing performed well before test plan approval. This reality conflicts with the requirement that the VSTL inform the EAC in writing once test cases have been completed. The EAC has generally not seen test cases until after test plan approval, even for "at risk" testing that may have occurred much earlier. In order to remedy this situation and to allow the EAC to more productively and appropriately comment on test cases before they have been run, the following clarification is noted: require the VSTLs to notify the EAC in writing and to upload test cases to the VRT when requested by the EAC before any tests have been run using the particular test case or test cases. This process will allow EAC to review test cases proximate to when they will be run and will hopefully eliminate any issues arising from after-the-fact test case review that might cause meaningful and potentially harmful delays in the testing and ultimate certification of the voting system

Based upon VSTL feedback and recommendations, EAC shall receive Virtual Machines (appliances) from the VSTL for the trusted build. Trusted builds shall include this virtual machine and any related items, so that the system can be constructed or restored on another machine. Trusted builds shall be in the Open Virtualization Format (OVF)

The initial practical application of the TRR process has lead the EAC to conclude that one item needs to be modified in the TRR in order to achieve the stated purpose of this program requirement. In order to be truly ready for testing, a voting system must be able to do substantially more than simply read a fully filled square or oval for optical scan systems.

There is a discrepancy between the VSTL manual and the Cert manual that requires clarification. The statement in question (“The TRR does not apply to modifications.”) is in the VSTL manual and was overlooked during the revision and editing of the manuals.  The TRR applies to applications to test full systems and modifications.  Additionally, if the application is for a system modification, the VSTL is responsible for reviewing no less than 1% of code that has changed in every software package, module or product.

This NOC outlines the process under which the EAC, VSTL and voting system manufacturer can come to a mutually acceptable agreement regarding the testing of any new technology that is submitted for certification under the extensions clause of the VVSG and Section 3.2.2.4 of the Program Manual - via TTA meetings (as detailed in this NOC).