SECURE IT Act

The SECURE IT Act requires mandatory penetration testing for voting systems as part of their certification process under the Help America Vote Act. It establishes a 5-year pilot program allowing cybersecurity researchers to legally test election systems and report vulnerabilities to vendors, with researchers protected from legal action under federal computer crime and copyright laws. Vendors must fix critical vulnerabilities within 180 days and provide patches to election officials, while the Election Assistance Commission must expedite review of these fixes (within 90 days or deem them approved). The program is voluntary for vendors and researchers, and disclosed vulnerabilities are exempt from public disclosure under the Freedom of Information Act.