Public confidence in elections depends on more than secure procedures at polling places; it also rests on the technology used to record and count votes. Secure voting machine certification provides a structured way to assess whether a system meets defined requirements for functionality, security, and reliability.
Certification is an important safeguard, but it is not a guarantee against every threat or operational failure. Understanding who sets the standards, how independent testing works, and why ongoing oversight matters helps place certification within the broader framework of election security.
What Secure Voting Machine Certification Establishes
Secure voting machine certification establishes that a defined voting system has been evaluated against specified technical and security requirements. The evaluation applies to the tested system configuration, including its hardware, software, and documentation, rather than to every election setup in which the system may later be used.
Certification provides documented evidence that the system met applicable requirements at the time of testing. It gives election officials a basis for assessing a system’s capabilities and limitations, but it does not establish that every component is free from defects or that an election will be conducted securely in all circumstances.
The scope and meaning of certification depend on the standards and rules of the jurisdiction responsible for approval. Requirements may differ across countries and, within the United States, across state and local jurisdictions. Certification is therefore one layer of election security, not a substitute for operational safeguards, oversight, or election procedures.
Standards and Authorities Behind Certification
In the United States, federal voting-system certification is administered by the U.S. Election Assistance Commission (EAC). Its Voluntary Voting System Guidelines (VVSG) set requirements for system performance, security, accessibility, and usability; jurisdictions are not universally required to use EAC-certified systems.
The EAC accredits independent Voting System Test Laboratories (VSTLs), which assess systems against applicable standards. The Commission reviews test results and, when requirements are met, may certify a system. Certification therefore involves both technical evaluation and a formal decision by the authorized federal body.
States retain significant authority over election administration. They may adopt additional requirements, conduct their own reviews, or decide whether to use federally certified equipment. Secure voting machine certification consequently operates within a layered framework of federal standards and state-level rules.
The applicable VVSG version matters: requirements and certification status depend on the standard under which a system was evaluated. Readers should consult EAC records and relevant state election authorities for current, jurisdiction-specific information.
How Voting Systems Enter the Certification Process
A voting system typically enters certification when its vendor submits an application to the relevant authority and identifies the system version for review. Requirements vary by jurisdiction; in the United States, federal certification is voluntary, while some states require or conduct their own approval processes.
The application generally includes system documentation, such as hardware and software specifications, design descriptions, security procedures, and instructions for operation and maintenance. These materials help reviewers define what is being evaluated and check that the submitted components and configurations are clearly identified.
An accredited testing laboratory then examines the system under the applicable program’s requirements. Testing may include reviewing documentation, inspecting components, and running prescribed functional and security tests. The lab records its methods and findings for review by the certifying authority.
Certification decisions depend on the program and jurisdiction. A system may be approved, rejected, or required to address identified deficiencies before proceeding. This structured process provides the basis for secure voting machine certification, while keeping the vendor’s submission and independent evaluation distinct.
Vendor application and system documentation
A vendor seeking Secure voting machine certification submits an application identifying the voting system, its components, and the versions proposed for evaluation. The application establishes the scope of review and helps certification authorities determine which materials and tests are required under the applicable program.
Supporting documentation describes how the system is designed, configured, and operated. It may include hardware and software specifications, system architecture, installation and maintenance instructions, security procedures, and explanations of how election data is handled. Requirements vary by certification program.
Reviewers use these materials to understand the system and assess whether its documented design can be tested. Vendors may need to provide:
- Source code and build information, where required
- Configuration details and component inventories
- User, security, and system-administration manuals
- Records identifying software versions and dependencies
Accurate, version-specific documentation gives independent testing laboratories a reliable basis for evaluating the submitted system. Missing or inconsistent materials can delay review or require clarification before testing proceeds.
Independent testing by accredited laboratories
Accredited laboratories assess voting systems against the technical requirements adopted by the relevant election authority. In the United States, testing for federal certification is conducted by laboratories accredited by the U.S. Election Assistance Commission (EAC), under its Voting System Testing and Certification Program.
Testing examines the submitted system and its documentation using defined procedures. Laboratory staff may evaluate hardware, software, configuration, and security controls, and record whether the system meets applicable requirements. The precise tests depend on the standards and scope of the certification effort.
Accreditation establishes that a laboratory meets specified competence and quality requirements; it does not mean the lab guarantees a system is free of defects. Findings are documented and reviewed through the certification process, where identified issues may require correction and further testing.
This independent assessment provides evidence for Secure voting machine certification, while leaving certification decisions to the responsible authority. Laboratories do not determine how jurisdictions deploy equipment or replace election-day procedures, such as local testing and safeguards.
Security Controls Examined During Testing
Testing examines whether a voting system restricts sensitive functions to authorized users and protects election data from unauthorized access. In secure voting machine certification, evaluators review how authentication works, how permissions are assigned, and whether access controls are enforced across relevant system components.
- Access control and authentication: Testing may assess user roles, password or other authentication requirements, account management, and safeguards against unauthorized or excessive privileges.
- Software integrity and configuration: Evaluators examine software versions, approved configurations, and controls intended to detect or prevent unauthorized changes. The specific procedures depend on the applicable standards and system design.
Testing also considers whether systems create reliable audit records and protect election data during storage and transfer. Reviewers may assess whether records capture security-relevant events and can be preserved for later examination. These controls support accountability, but their evaluation does not establish that every possible threat has been eliminated.
Access control and authentication
Testing examines how a voting system restricts access to its components and functions. Reviewers assess whether users receive only the permissions needed for their roles, such as election administrators, poll workers, and technical personnel, and whether sensitive operations are limited to authorized individuals.
Authentication controls are evaluated for how they establish a user’s identity before granting access. Depending on the system and applicable requirements, controls may include unique accounts, passwords, or other approved methods. Testing also considers whether default or shared credentials could allow unauthorized use.
Assessors examine how the system handles failed login attempts, account changes, and privileged actions. They check whether access can be revoked when duties change and whether administrative functions are separated from routine tasks. Specific requirements vary by certification standard and system design.
These checks help determine whether access protections work as documented and resist defined threats. Secure voting machine certification does not establish that every election environment will be secure; election officials must also configure systems properly and manage user accounts throughout their use.
Software integrity and system configuration
Testing examines whether voting software matches the version and configuration submitted for evaluation. Laboratories may verify software identifiers, digital signatures, or cryptographic hashes, where specified by the applicable requirements, to detect unauthorized changes between reviewed and tested components.
System configuration is assessed against documented requirements, including settings that govern device behavior, interfaces, and enabled features. Reviewers may check that unnecessary functions are disabled and that components are configured consistently with the approved system design.
These checks help establish a controlled baseline for certification. They do not by themselves prove that every component is free from vulnerabilities; their scope depends on the governing standards, test procedures, and evidence available to the laboratory. Secure voting machine certification therefore evaluates integrity within defined boundaries.
Election officials and vendors must preserve the certified software and configuration in deployment. Changes to code, settings, or hardware may require review or retesting under applicable rules before the system is used in an election.
Audit records and protection of election data
Audit records allow election officials and authorized reviewers to reconstruct key system actions, such as changes to settings, administrative access, and ballot processing events. During Secure voting machine certification, testing examines whether records are generated consistently and can support review without exposing sensitive information.
Protection measures should help prevent unauthorized access, alteration, or deletion of election data and audit records. Testing may assess whether the system restricts access by role, preserves record integrity, and handles data securely during storage and transfer. Specific requirements depend on the applicable standards and system design.
Reviewers may examine whether records capture relevant events, use reliable timestamps, and can be exported for analysis. Depending on the system, evidence may include:
- Access and configuration logs
- Records of election-data transfers or processing
- Procedures for retaining and reviewing records
Certification evaluates documented system capabilities; it does not replace election officials’ responsibility to secure records, maintain chain-of-custody procedures, and conduct post-election reviews.
Certification Testing and Its Limits
Certification testing evaluates whether a voting system meets defined functional and security requirements under specified conditions. Accredited laboratories may examine system behavior, documentation, and safeguards, then report findings to the relevant certification authority. The scope and procedures depend on the applicable standards and program.
Testing may include checks such as:
- Confirming that required voting and tabulation functions operate as specified.
- Assessing security controls and whether known vulnerabilities or configuration weaknesses are detected.
- Reviewing audit records and system responses to defined test scenarios.
Secure voting machine certification does not prove that a system is immune to every attack or flaw. Tests cover a defined version and configuration, and may not reproduce every real-world environment, threat, or operational practice. Undiscovered vulnerabilities can remain.
Certification also does not establish that election procedures are followed correctly or that equipment is configured and maintained properly at every site. It is evidence of compliance within a stated scope—not a substitute for election-specific testing, monitoring, and oversight.
Functional and security testing
Testing evaluates whether a voting system performs its documented functions accurately and consistently. Examiners may check ballot presentation, vote recording, tallying, reporting, and accessibility features against applicable requirements. The specific procedures depend on the system and the governing certification program.
Security testing examines how the system handles threats and protects election data. Accredited laboratories assess controls such as authentication, software integrity, audit logging, and resistance to unauthorized access, using prescribed test methods and documentation.
Testing may include reviewing source code and system configurations, examining hardware, and running controlled tests for identified vulnerabilities. Results are evaluated against the relevant standards; failures may require corrective changes and additional testing before certification can be granted.
Secure voting machine certification therefore reflects performance under defined test conditions, not proof that every possible attack or operational problem has been eliminated. Test scope, methods, and findings vary by program, and certification does not replace security measures or oversight during actual elections.
What certification does not guarantee
Certification does not guarantee that a voting system is free from vulnerabilities. Testing evaluates a defined system against specified requirements at a particular time; undiscovered defects or newly identified threats may remain.
It also does not ensure that a certified system is configured, operated, or maintained correctly in every jurisdiction. Security depends on local procedures, trained personnel, physical safeguards, and adherence to approved configurations.
Certification cannot prevent every incident, including insider misuse, supply-chain compromise, or attacks on election infrastructure beyond the equipment tested. Nor does it verify that election results are accurate by itself; audits and other independent checks provide additional evidence.
For these reasons, Secure voting machine certification is one layer of election security, not a substitute for ongoing monitoring, sound election administration, and post-election verification.
From Certification to Election-Day Readiness
Certification confirms that a voting system has met specified requirements under defined test conditions; election officials must still determine whether the certified system is ready for use in their jurisdiction. They verify that the equipment and software delivered match the approved configuration and that local procedures follow applicable requirements.
Readiness also depends on operational preparations. Officials can conduct logic and accuracy testing, check ballots and election definitions, confirm that equipment is configured for the correct contests, and train staff on setup, incident reporting, and procedures for managing equipment failures. These steps help identify local errors that certification testing may not cover.
Secure voting machine certification does not replace pre-election safeguards. Jurisdictions should secure equipment and credentials, control access to voting systems, and maintain documented checks from preparation through deployment. Specific requirements vary by jurisdiction, so officials must consult applicable laws and election procedures.
A system should be deployed only after required checks are completed and discrepancies are addressed. Clear records of testing, configuration, training, and equipment handling support accountability and help officials respond to questions about election-day readiness.
Managing System Changes After Certification
Certification applies to a specific voting system configuration, not automatically to every later version. After approval, vendors and election officials should follow the applicable certification rules and procedures before introducing changes to software, hardware, or system settings.
A proposed change may require review, testing, or recertification, depending on its nature and the requirements of the relevant authority. Changes that appear minor can still affect security or system behavior, so they should not be deployed on the assumption that they fall outside certification controls.
A documented change-management process should track:
- What was changed, when, and by whom
- The reason for the change and its approval
- Testing and review results
- Whether the change affects the certified configuration
These records help election officials confirm that equipment remains within approved limits and support accountability if questions arise. Secure voting machine certification therefore depends on ongoing configuration control, not only the original approval.
Verification, Records, and Public Accountability
Election officials should verify that the equipment used at polling places matches the certified system and approved configuration. Pre-election checks, such as comparing software versions and testing device functions, help identify discrepancies before voting begins. Procedures vary by jurisdiction and system.
Records support this verification. Certification documents, configuration details, test results, maintenance logs, and election-related audit records can help officials trace what was tested, changed, and used. Access to sensitive information may be restricted to protect security, while required records remain available to authorized reviewers.
Public accountability depends on clear procedures and meaningful oversight. Election authorities can explain how systems were certified, how checks are conducted, and how concerns are reviewed, while providing access to records as permitted by law. Secure voting machine certification is one part of this evidence; it does not replace election-specific verification or independent audits.
Strengthening Election Security Through Ongoing Oversight
Ongoing oversight extends election security beyond the initial certification decision. Election officials should monitor systems for vulnerabilities, review vendor security notices, and assess whether newly discovered issues affect deployed equipment. Findings should be handled through established reporting and incident-response procedures.
Post-certification changes require careful control. Officials should confirm that software updates, configuration changes, and maintenance follow applicable requirements, and determine whether changes require review or testing under the relevant certification program. This helps preserve a clear record of each system’s approved configuration.
Routine audits, access reviews, and checks of security logs can help identify unauthorized activity or deviations from documented procedures. When concerns arise, officials should preserve relevant records, investigate promptly, and coordinate with appropriate election, technical, and cybersecurity authorities.
Secure voting machine certification provides an important baseline, but it cannot replace ongoing governance. Regular training, transparent documentation, and coordination among jurisdictions, testing laboratories, vendors, and oversight bodies help maintain accountability as threats and operational needs evolve.