SECRETARY 01 STATE STATE OF INDIANA CONNIE LAWSON SECRETARY or STATE July 12 2018 Brian Newby Executive Director US Election Assistance Commission 1335 East-West Highway Suite 4300 Silver Spring MD 20910 Re lndiana HAVA Cybersecurity Program Narrative Dear Mr Newby This letter provides a narrative of Indiana's plan to spend the 2018 HAVA Elections Security Grant Funds and the investments Indiana has expended out of the lndiana Secretary of State's office to qualify for the required matched funds To prepare this narrative INSDS surveyed local election of cials and Indiana vendors to identify challenges and opportunities to secure and improve lndiana s election security cyber posture We appreciate the release of $7 595 088 additional HAVA funds which will be used to continue Indiana's investment in election security Assessment gf Indiana s Cybersggurity Profile Since the 2018 election lndiana has been working to modernize and maximize security through the implementation of cybersecurity projects across the Statewide Voter Registration System SVRS and the election infrastructure Indiana has partnered with the US Department of Homeland Security DHS and Multi State information and Analysis Center MS-ISAC to assess risk and vulnerabilities develop best practices and provide access to 24 7 security information threat notifications and security advisories Additionally the Indiana Executive Council for Cybersecurity was established by Governor Holcomb in January 2017 to form an understanding of Indiana s cyber risk pro le identify priorities establish a strategic framework of Indiana's cybersecurity initiatives and leverage strategic cybersecurity partnerships aoross the public and private sector in 2017 INSOS implemented many cybersecurity improvements which included cybersecurity training at the county and state level that covered spear phishing implementation of security enhancements to improve password protections hardening the validation protocols required for user access implementation of multifactcr authentication protocols and migrated to a new hosting environment with added security features Indiana expanded its cyber footprint in 2018 through the sharing of election cybersecurity best practices to local election of cials conducted a risk and vulnerability assessment across the election infrastructure and piloted a risk limiting audit in our state s largest county to validate optical scan voting tabulation systems lndiana also partnered with MS-ISAC to install an Albert Sensor a network monitoring solution that provides automated alerts of network threats enabling Indiana to respond quickly when data may be at risk Additional lndiana election security practices include mandatory public testing of voting equipment by local election of cials before each election in which the equipment will be used and required state laboratory testing and certification for the implementation and usage of voting system hardware and software In 2018 Indiana became one of the rst states to pass legislation to restrict the transfer of The state House 200 West Washington Street Room 201 IndianapoliS Indiana 46204 317' 233 5531 3117 2334233 SECRETARY OF STATE STATE OF INDIANA CONNIE LAWSON SECRETARY OF STATE voting systems so the systems can only be sold or resold for official use preventing hackers' access to machines and permitting a county election board to apply to for reimbursement of expenditures to schre and monitor facilities where voting systems and electronic poll books are stored Planned Actions for Preparation of the 2019 Midterm Election Because Indiana was already working to harden the election infrastructure current investment costs total $558 961 which exceeds Indiana's state match requirement by $279 207 We fully understand that lndiana's expenditure of $658 961 exceeds the amount required for the 5% match and no additional federal funding will be available as a result of our additional qualifying expenditures The following actions are planned or undenivay we will 1 2 tap Partner with the lndiana National Guard and Incident Response Cybersecurity Committee to establish incident response plans through table-top exercises and incident response plan testing Continue partnership with DHS to evaluate additional Albert Sensor installations at the county or state level and evaluate DHS Risk and Vulnerability Assessment findings in order to implement improvement opportunities Assess technology and timing options to expand the Indiana multifactor authentication pilot project to all 92 counties after piloting a token authentication project for ten counties In the 2018 Primary Election Evaluate election purposed computers laptops or desktops or virtual machines to harden election system network cannections and replace unsupported operating systems or internet browsers Evaluate electronic poll book vendor controls software and patch updates and security protocols Evaluate election night reporting systems to identify improvement opportunities for data entry authentication data backups and intrusion detection Conduct third-party penetration testing of SVRS electronic poll books and other related election system infrastructure Implement SVRS security scans for le uploads for all users and implement email and digital signatures forfile transfers and transmission of election data Planned Usage of the 2018 HAVA Elections Security Grant Funds in 2019 lndiana will implement the following projects based on the system and evaluation outcomes identified in 2018 and the availability of the 2019 HAVA Elections Security Grant Funds 1 hf-t Statewide multifactor authentication expansion Replacement or additional purchases of computers with supported operating systems and internet browsers for county usage to election systems Implementation of electronic poll book vendor network security enhancements Deployment of auditable voting systems and Election night reporting security enhancements The State House 200 West Washington Street Room 201 Indianapolis Indiana 46204 3 17 232-6531 FAX 3127 233-3283 W sos l'N gDv SECRETARY 0F STATE STATE OF INDIANA CONNIE LAWSON Secesmev 01- STATE The Secretary of State's office will develop a grant funding program to fund opportunities for local election officials for election systems upgrades and additional security needs These funds can be used to Enhance election technology and security by purchasing or upgrading election systems Reimburse counties for physical security improvements Facilitate cybersecurity training to state and county officials and Contract with cyber navigators who can conduct cybersecurity assessments and Identify recommendations to counties far security improvements The Secretary of State s of ce will coordinate and plan with the Indiana General Assembly for future replacement of voting equipment since the required budget to replace direct-recording electronic voting machines without a voter verified paper trail requires a larger amount than the available 2018 HAVA Elections Security Grant Funds If other funding is appropriated by Congress or the Indiana General Assembly Indiana plans to use a majority of the funds to replace or purchase election systems at the county level The plans described in this narrative are subject to change based on additional security assessments and evaluations and as funds for cybersecurity improvements are made available to Indiana counties Indiana will update the US Election Assistance Commission if project plans change and as the program develops Sincerely 1 Connie Lawson Indiana Secretary of State The State House 200 West Washington Street Room 201 Indianapnlia Indiana 46204 317 232-653 1 FAX 3 137 233-3233 2018 HAVA ELECTION SECURITY GRANT Budget Information Name of Organization Budget Period Start Budget Period End  Non‐Construction Program CFDA # 90 404 State of Indiana 3 23 2018 SECTION A ‐  BUDGET SUMMARY  Consolidated Budget for total project term‐‐ up to 5 years as defined by grantee FEDERAL   NON‐FEDERAL FUNDS  Match 5 3 2019 PROGRAM CATEGORIES BUDGET CATEGORIES a  Voting  Equipment c   Voter  Registration  Systems b  Election  Auditing d  Cyber Security e  Communications f  Other  ______________ g  Other  ______________ 1   PERSONNEL  including fringe 2   EQUIPMENT $            240 000 00 $             200 000 00 3   SUBGRANTS‐ to local voting jurisdictions 4   TRAINING $             400 000 00 5   All OTHER COSTS 6   TOTAL DIRECT COSTS  1‐6 $            125 000 00 $        6 630 088 00 $                           ‐ $                         ‐ $            365 000 00 $        6 630 088 00 $             600 000 00 $                           ‐ $                            ‐ $                           ‐ $                         ‐ 11  Non‐Federal Match $                           ‐ $            39 000 00 $            172 754 00 $           168 000 00 $                            ‐ 12  Total Program Budget $                           ‐ $            365 000 00 $        6 630 088 00 $             600 000 00 $                           ‐ $                           ‐ $            39 000 00 $            537 754 00 $        6 798 088 00 $             600 000 00 $                           ‐ 0% 5% A   Do you have an Indirect Cost Rate Agreement approved by the Federal government or  some other non‐federal entity   If yes  please provide the following information No Proposed State Match $                            ‐ 0% $             440 000 00 6% $                            ‐ 0% $             400 000 00 5% $          6 755 088 00 89% $                            ‐ 8   Total Federal Budget 0% 5 0% B   Period Covered by the Indirect Cost Rate Agreement   mm dd yyyy‐mm dd yyy N A C   Approving Federal agency N A D   If other than Federal agency  please specify N A E   The Indirect Cost Rate is   N A 87% 8% $                            ‐ $          7 595 088 00 $                            ‐ $             379 754 00 $                            ‐ 0%   % Fed Total   $          7 595 088 00 7   INDIRECT COSTS  if applied 13  Percentage By Category TOTALS $          7 974 842 00 0% 0%