Learning objectives
- Write evaluable requirements for a custody system
- Distinguish substantive security claims from marketing
- Identify the certification and compliance frameworks that actually apply
Content
- Certification landscape, stated accurately: VVSG 2.0 applies to voting systems — equipment that marks, casts, or tabulates. Custody and tracking systems sit outside that boundary, and VVSG 2.0 in fact requires election systems be air-gapped from the voting system. What this means for the buyer: no EAC certification gate, therefore a normal software procurement timeline — but also no federal certification to lean on, so your own evaluation has to be real.
- Frameworks that do apply: SOC 2 Type II, StateRAMP, NIST SP 800-53, EI-ISAC participation, independent penetration testing.
- Requirements-writing workshop (40 min): participants draft five evaluable requirements. The standard: could a third party determine objectively whether a vendor meets this?
- The question bank — twelve questions to ask every custody vendor:
- Who holds the signing keys, and can the county hold its own?
- Where is the commitment anchored, and who can verify it without trusting you?
- Can any administrator delete a record? Under what process, and is that deletion itself logged?
- What happens to our data if you go out of business? Is source escrowed?
- Show me a proof failing verification. What does the operator see?
- What is your penetration test cadence, and will you share the report under NDA?
- What is your data residency and hosting boundary?
- How do you handle the retention/privacy conflict architecturally?
- What is your degraded-mode operation if USPS data is unavailable?
- How many jurisdictions have deployed this in a live federal election?
- What is your incident response SLA and notification obligation?
- Who on your team has run an election?
Run the exercise
Assessment
Draft requirements section for a hypothetical RFP, peer-reviewed in session. ---