180 East Broad Street 16th Floor Columbus OH 43215 877 767-6446 614 466-2655 info@OhEOSecretaryofState gov JUN HUSTED Ohio Secretory of State As a part of its Consolidated Appropriations Act of 2018 1 Congress appropriated additional funds to states to be used to improve the administration of federal elections for federal of ce including enhancing election technology and making election security improvements Ohio s share of the appropriated funds is $12 186 021 As a part of the statutory scheme the state must provide a $609 301 match by March 23 2020 In order to draw down its allocation of federal funding Ohio must submit a plan for how it intends to expend these newly appropriated resources to improve the administration of federal elections in this state The expected timeline for completion ofthese priorities is December 31 2020 With the understanding that the next Secretary of State may have additional priorities and may amend Ohio s plan upon taking of ce in January 2019 Ohio Secretary of State Jon Husted submits the following Statewide Voter Registration System Database Ohio s is a bottom-up system each county selects its own county voter registration system CVRS that communicates with a centralized real-time statewide database Several security improvements and technology enhancements are planned for the CVRS communications network and other elections-related information technology systems hosted by the Secretary of State s Office election night reporting systems Anticipated enhancements include the introduction of multi-factor authentication increased hardening of communications lines enhanced techniques replacement of personal computing hardware and related operating systems and long-term planning for the future security and functionality ofthe In all service providers for the and CVRS hardware and software purchases and consultants for this multi faceted initiative are expected to cost as much as $3 9 million Path nders Secretary Husted is requiring each county board of elections to join the Election Infrastructure Information Sharing and Analysis Center engage US Department of Homeland Security DI-IS for free resources including the phishing campaign assessment and vulnerability scanning and use the Center for Internet Security CIS Elections In astructure Playbook as a guide for identifying and mitigating risks within the local elections information technology environment As in most states Ohio s local elections officials have varying levels of IT 1 115 141 132 Stat 348 2018 Enacted HR 1625 115 Enacted HR 1625 training and experience and disparate access to resources This priority reserves $4 9 million in grants to Ohio s 88 county boards of elections to contract for Path nder support Path nders for purposes of this priority will help the local election of cial with setting up the EI-ISAC and DHS resources and assist them in conducting the CIS assessment The Path nders will also help in developing a plan for mitigating vulnerabilities identi ed in the assessments and may even participate in completing tasks necessary in that mitigation Enhanced bersecuri Service CS ECS utilizes classi ed information sourced by US government intelligence organizations to detect and prevent malicious Simple Mail Transfer Protocol SMTP and Domain Name Service DNS traf c This plan sets aside $100 000 to provide ECS for email accounts through 2020 Table-top Exercises TTX Training This initiative allocates $186 021 for the Secretary of State to host regional table-top exercises for local elections of cials in 2018 modeled after the elections-speci c TTX recently run by the Kennedy School of Government s Belfer Center for Science and International Affairs at Harvard University Funding for this initiative will also support travel and attendance costs for cybersecurity experts to serve as speakers at the regional elections conferences within Ohio and support online and other cybersecurity courses including phishing awareness training for state and local election of cials IT Email Support Pilot Project Funding in the amount of $1 million within this initiative provides the Secretary of State with the additional human and technical resources to conduct a pilot program to bring a limited number of local election of ce s IT and email functions inside of the Secretary of State s network and system Under this pilot program the board of elections would still select its CVRS system and own the CVRS-related hardware and be responsible for all inctions related to its voting system but the Secretary of State s of ce would become the local network and intemet service provider and the networked board of elections IT functions would sit behind the Secretary of State s rewalls and other cybersecurity systems and monitors Local workstations would be owned by the board of elections but must meet ongoing standards established by the Secretary of State s of ce Additionally a separate pilot program will enable county boards of elections to rely on the Secretary of State s IT department and its Outlook 365 enterprise agreement for its email service and support the local election of ce would maintain a form of its local email domain name Post-Election Audits Secretary Husted requires by permanent directive all county boards of elections to conduct a post-election audit following each presidential primary election and regular federal general election Boards of elections may choose their auditing method Both major party candidates for Secretary of State in 2018 have separately introduced legislation to place Secretary Husted s post-election audit requirement into state law and to require boards of elections to use a risk- limiting audit methodology This plan sets aside $2 1 million to help offset costs for state and local election of cials in conducting post-election audits through 2020 Contingencies In the event that the funding allocation for the priorities listed above is greater than the actual costs associated with achieving the intended outcome that other funding sources are identi ed for a priority or that the priority falls in relative importance the Secretary of State s office has identi ed the following contingent priorities 0 Content Management Systems Cloud Hosting Support This contingent initiative would provide funding to assist counties or their managed service providers in replacing open source website content management systems WordPress with systems that are secured more robustly against common defacing attacks and other cyberattacks Funding would also be available to assist counties with moving their online functions dynamic election night reporting to secure government clouds during high traffic time periods to mitigate risks of distributed denial of service and other cybersecurity threats 0 Enhanced Cybersecurity Services for Counties This contingent initiative would provide funding to extend ECS to county election of cials outside of the Secretary of State s email system 2018 HAVA ELECTION SECURITY GRANT Budget Information Name of Organization CFDA II 90 404 Non-Construction Program Secretary of State I FEDERAL 8 NON-FEDERAL FUNDS Match Budget Period Start Consolidated Budget for total project term- up to 5 years as de ned by grantee Budget Period End 12 3112020 PROGRAM CATEGORIES Voter Ii hi i t RiagiIstration Cyber Security Communications If Other Other TOTALS Fed Total BUDGET CATEGORIES Systems 1 PERSONNEL lincluding fringe 500 000 00 500 000 00 1 000 000 00 8% 2 EQUIPMENT 5 2 000 000 00 2 000 000 00 16% 3 to local voting jurisdictions 2 100 000 00 4 900 000 00 7 000 000 00 57% 4 TRAINING 286 021 00 5 286 021 00 2% 5 All OTHER COSTS 1 900 000 00 1 900 000 00 16% 6 TOTAL DIRECT COSTS 3 - 2 100 000 00 4 400 000 00 5 686 021 00 5 - - 12 186 021 00 7 INDIRECT COSTS if applied 5 - 0% 8 Total Federal Budget 5 2 100 000 00 4 400 000 00 5 686 021 00 - 12 186 021 00 11 Non-Federal Match 5 - 12 Total Program Budget 5 - 2 100 000 00 4 400 000 00 5 686 021 00 - - 12 186 021 00 13 Percentage By Category 0% 17% 36% 47% 0% 0% Proposed State Match 0 0% A Do you have an Indirect Cost Rate Agreement approved by the Federal government or some other non-federal entity No If yes please provide the following information B Period Covered by the Indirect Cost Rate Agreement C Approving Federal agency D If other than Federal agency please specify E The Indirect Cost Rate is