N.J. Admin. Code § 15:10-7.5

Current through Register Vol. 56, No. 24, December 18, 2024

Section 15:10-7.5 - Technical requirements for e-poll book systems

(a) The e-poll book system must comport with N.J.S.A. 19:31-36.

(b) Password protected accounts must be used to access or operate the e-poll book system, including operating systems and applications.

(c) User accounts in an e-poll book system must follow NIST 800-53 standard guidelines for access control management and allow separation of duties by user according to the principle of least privilege. The guidelines include, but are not limited to, the requirement to identify and document functions, tasks, and responsibilities, including system maintenance, day-to-day computer operations, and security/system administration duties; as well as define system access authorizations to support separation of duties to prevent malevolent activity without collusion.

(d) Passwords used in an e-poll book system must follow standard guidelines for identity and authentication management best practices. This should include minimum requirements for non-privileged users and strong password requirements for privileged users and service accounts.

(e) Any administrative accounts or user accounts that have the ability to add, modify, or delete programs or data must use multifactor authentication.

(f) Detailed network and system architecture diagrams showing all software and hardware must be submitted to the Division of Gaming Enforcement (DGE) for testing and examination.

(g) The e-poll book system must prevent unauthorized devices from connecting to the system.

(h) Remote access from outside the e-poll book system is not allowed without prior written authorization from the Director of the Division of Elections.

(i) All network protocols, system services, and applications not required for the e-poll book system to function must be removed or, if they cannot be removed, disabled.

(j) All network ports not required for the e-poll book system to function must be blocked by a firewall.

(k) All cryptographic modules used in an e-poll book system must comply with the guidelines set forth in the System and Communications Protection section of NIST 800-53 under "Cryptographic Protection."

(l) All network communications between components in the e-poll book system must be secured by following standard guidelines in the System and Communications Protection section of NIST 800-53, under "Transmission Confidentiality and Integrity." If wireless networks are used, standard guidelines under "Access Control/Wireless Access" of NIST 800-53 must be followed.

(m) Any communications between the New Jersey Statewide Voter Registration System (NJSVRS) and e-poll book systems must be secured by following standard guidelines in the Access Control/Information Flow Enforcement section of NIST 800-53.

(n) The e-poll book system must ensure voter information received from the NJSVRS has not been modified from the original.

(o) The e-poll book system must only allow voters eligible to vote in the NJSVRS system to sign in.

(p) All voter-related information stored by an e-poll book system, including backups, must be encrypted by following standard guidelines in the System and Communications Protection section of NIST 800-53 under "Protection of Information at Rest."

(q) Any use of cloud services must meet Federal Risk and Authorization Management Program (FedRAMP) "High Impact Level" standards and be located in a government cloud.

(r) Any removable storage media and files stored on removable media used by the e-poll book system must follow standard guidelines in the Media Protection section of NIST 800-53.

(s) All components of an e-poll book system that contain clocks must be synchronized to the correct time zone and local time by following standard guidelines in the System and Communications Protection section of NIST 800-53 for "System Time Synchronization."

(t) The e-poll book system must prevent a voter from being authorized to vote more than once in an election.

(u) The e-poll book system must have a legible user interface (UI) for voters. The voter UI must offer a "help" option that provides all information required for the voter to properly use the system.

(v) A voter may only use the e-poll book system if that voter's information is in the system. If a voter's information is not in the system, a message must be displayed to the voter advising that their information is not available.

(w) A voter may view only their own information in an e-poll book system.

(x) The e-poll book system must automatically check, at least once per hour, and on demand by an administrator, to ensure only approved software and settings exist in the system and that the system is functioning without errors. If an issue is discovered, the e-poll book system must automatically record the error in a System Integrity Failure Log, pursuant to (bb) below. The e-poll book system must automatically halt operations on all affected devices, with a detailed error message displayed on each device. Operations on all affected devices may only resume once the error has been resolved.

(y) The e-poll book system must allow external verification of its critical files in a manner approved by the DGE and the Division of Elections, pursuant to N.J.A.C. 15:10-7.6.

(z) The e-poll book system must use uninterruptable power supplies capable of providing enough time to completely process the last voter and shut down the system without losing any information.

(aa) The e-poll book system must, at a minimum, be capable of displaying the following error messages:

1. Low battery level detected on the device;

2. Failure during voter check in;

3. System connection failure;

4. System integrity failure; and

5. Hardware failure.

(bb) The e-poll book system must be capable of creating and maintaining the following logs:

1. A User Access Log that includes:

i. The user name;

ii. The user permission level;

iii. The network address used;

iv. The date and time of the start of access; and

v. The date and time of the end of access;

2. A software installation/removal log that includes:

i. Whether any software or settings were installed, removed, or changed;

ii. The date and time of the installation, removal, or change;

iii. The identification of the software or setting;

iv. The identity of the person performing the action;

3. A system integrity failure log, which includes:

i. The file that failed an integrity check;

ii. The location of the file;

iii. A detailed description of the failure; and

iv. The date and time of failure; and

4. An adjustment log that includes:

i. The date and time the adjustment occurred;

ii. The user who performed the adjustment;

iii. A description of the adjustment; and

iv. The starting and ending values of any data altered as a part of the adjustment.

(cc) The e-poll book system must be capable of processing simultaneous voter check-ins that exceed expected loads when polling locations are at maximum capacity. This must be demonstrable with a load test.

(dd) The e-poll book system must generate reports that accurately reflect the data captured by the system.

N.J. Admin. Code § 15:10-7.5