Little-noticed provision mandates penetration testing as part of federal voting machine certification
By yourNEWS Media Newsroom
The National Defense Authorization Act signed into law by President Donald Trump on Dec. 18, 2025, includes a largely overlooked provision that alters federal oversight of U.S. voting systems by requiring mandatory cybersecurity penetration testing as part of their certification process.
Buried deep within the more than 3,000-page defense bill, Section 6805 — Requiring Penetration Testing as Part of the Testing and Certification of Voting Systems — amends the Help America Vote Act of 2002 to formally require that voting system hardware and software undergo penetration testing conducted by an accredited laboratory as a condition of approval.
The provision, added to the National Defense Authorization Act, establishes “required penetration testing” for voting systems during certification, decertification, and recertification. It also authorizes coordination with the National Institute of Standards and Technology or other federal agencies on laboratory selection criteria and technical aspects of the testing program.
rcp_xml-2 by yourNEWS Media
Under the amendment, voting system vendors must now satisfy these cybersecurity testing requirements to obtain or maintain certification from the U.S. Election Assistance Commission, marking a shift toward increased technical scrutiny of election infrastructure.
While the change falls short of broader election integrity reforms sought by some advocates, it represents a step toward formalizing independent cybersecurity evaluation of voting technology. Supporters note that the requirement compels election systems to undergo the type of adversarial testing that cybersecurity professionals argue is essential for identifying vulnerabilities — testing that some experts, including former voting system test laboratory contractors, have previously said they were restricted from fully performing.
The provision does not mandate changes to ballot methods or counting procedures. However, separate efforts at the state and local level continue to focus on alternative election models. Dallas County, Texas, for example, plans to use hand-marked paper ballots hand-counted at the precinct level during the 2026 midterm primaries, an approach long advocated by election integrity groups as the most transparent method for conducting elections.
Though narrowly focused, the NDAA amendment represents a notable federal acknowledgment that cybersecurity risks in voting systems warrant formal, standardized testing — a requirement now written into law.
Original article
Comments