2018 ELECTION SECURITY IMPROVEMENTS GRANT NARRATIVE Washington State Award $7 907 768 Washington State Match $395 388 Summary Washington received $7 907 768 which will be matched by state funds of $395 388 for a total of $8 303 156 to improve the administration of elections for Federal office including to enhance election technology and make election security improvements The Washington Secretary of State believes the best way to make security improvements is to invest in a security operations center and address cyber vulnerabilities While technological security improvements can help the most advanced security systems in the world are not secure if the people using and interfacing with our Election Systems are the “weakest link” in the security chain Our plan aims to make state and county elections employees the strongest link in the security chain Washington plans to purchase monitoring sensors security and event management software upgraded firewalls and multi-factor authentication for all key personnel with access to our centralized Voter Registration EMS system before the 2018 General Election This will provide a needed boost in security for the upcoming election We will develop our Security Operations Center SOC and associated training reviews communication channels and equipment tracking over time to bring the entire election process up to the highest security standards Election Auditing OSOS Security Operations Center SOC OSOS SOC personnel will regularly review state and county voting equipment voter registration systems and computer systems for security vulnerabilities and to ensure compliance with current security policies The SOC will also ensure equipment being utilized in the elections process has not been compromised Results from these reviews will be used to create tailored training for each county working closely with the OSOS Certification Training C T team to ensure any deficiencies are addressed We plan to add C T team members to develop and facilitate county training programs incorporate results of security reviews into existing reports and develop training strategies and methodologies tailored to each county based on the results provided by SOC reviews Cyber Vulnerabilities Monitoring Sensors Cyber vulnerabilities will be addressed through technology to both monitor for and prevent unauthorized access Monitoring will be provided with the purchase of sensor s which provide monitoring for many types of threats Security Information and Event Management Software Along with the hardware monitoring sensors will be Security Information and Event Management SIEM software which will provide our OSOS SOC personnel with information about attempted unauthorized access into our network OSOS Security Operations Center SOC The OSOS SOC will monitor for possible threats and intrusions into state and county election systems and coordinate with state and federal agencies on security issues The SOC will also develop and maintain a technology replacement schedule for all state and county elections equipment to prevent vulnerable and end-of-life products from being used and interfaced with election systems In addition the SOC will monitor for and ensure any critical security issues on county and state elections systems are patched with current releases Hardware Upgraded Firewalls With the purchase of upgraded firewalls the centralized OSOS elections infrastructure will be protected from outside threats Multi-Factor Authentication All access to centralized elections systems will require multi-factor authentication We will utilize multifactor provided by individual tokens for every user Training OSOS Security Operations Center SOC The OSOS Security Operations Center SOC will consist of 5 technology IT personnel with expertise in both IT security and election systems The SOC will have the following responsibilities related to security training Provide regular security training for state and county election officials Conduct regular security reviews for state and county election officials Section 303 of HAVA required states to implement a “single uniform official centralized interactive computerized statewide voter registration list ” As states and counties become more connected through the Voter Registration Database VRDB more security will be required for both personally identifiable information PII and to maintain the integrity of the records kept within Washington State has 39 different counties ranging from one employee in the smallest counties to over sixty in the largest with each having their own unique security needs – no one technology solution or training program will meet such varying needs The OSOS SOC personnel will provide tailored training to each county working in concert with the Certification Training team in the OSOS Elections division Beyond our initial plan we plan to spend remaining HAVA funds to provide security training educational materials and assessments to existing and newly developed elections systems 2018 HAVA ELECTION SECURITY GRANT CFDA # 90 404 Budget Information Name of Organization Non-Construction Program Washington Secretary of State Budget Period Start 3 23 2018 Budget Period End 3 23 2023 SECTION A - BUDGET SUMMARY a Voting Equipment BUDGET CATEGORIES c Voter Registration Systems b Election Auditing 1 PERSONNEL including fringe Consolidated Budget for total project term-up to 5 years as defined by grantee FEDERAL NON-FEDERAL FUNDS Match $ 897 744 00 $ PROGRAM CATEGORIES d Cyber Security e Communications 897 744 00 2 EQUIPMENT $ 897 744 00 $ 4 116 792 00 f Other Cyber security training $ g Other ______________ 897 744 00 3 SUBGRANTS- to local voting jurisdictions $ 200 000 00 $ - $ 897 744 00 $ 897 744 00 $ 5 014 536 00 $ - $ 13 Percentage By Category Proposed State Match $ - $ 897 744 00 $ 897 744 00 $ 5 014 536 00 $ - $ - $ 897 744 00 $ 897 744 00 $ 5 014 536 00 $ - 0% 11% B Period Covered by the Indirect Cost Rate Agreement mm dd yyyy-mm dd yyy D If other than Federal agency please specify E The Indirect Cost Rate is 11% 5 0% A Do you have an Indirect Cost Rate Agreement approved by the Federal government or some other non-federal entity If yes please provide the following information C Approving Federal agency $ 4 116 792 00 52% 1 097 744 00 $ - $ $ $ 11 Non-Federal Match 12 Total Program Budget 45% $ 7 INDIRECT COSTS if applied 8 Total Federal Budget 3 590 976 00 $ 5 All OTHER COSTS No 63% 0% 1 097 744 00 $ 395 388 00 $ 1 493 132 00 14% $ - $ - $ 0% % Fed Total $ $ 4 TRAINING 6 TOTAL DIRECT COSTS 1-6 TOTALS 200 000 00 - 0% 3% 0% 7 907 768 00 7 907 768 00 $ 395 388 00 $ 8 303 156 00 0%