Senate Bill 2096

AN ACT TO AMEND SECTION 23-15-165, MISSISSIPPI CODE OF 1972, TO REQUIRE THE MISSISSIPPI DEPARTMENT OF INFORMATION AND TECHNOLOGY SERVICES TO ESTABLISH MINIMUM CYBERSECURITY STANDARDS AND POLICIES IN CONJUNCTION WITH THE SECRETARY OF STATE FOR COUNTY REGISTRARS AND ELECTION COMMISSIONERS; TO STIPULATE THAT SUCH STANDARDS AND POLICIES AIM TO ENSURE THE INTEGRITY OF MISSISSIPPI'S VOTER REGISTRATION AND ELECTION DATA IN THE STATEWIDE ELECTIONS MANAGEMENT SYSTEM; TO REQUIRE SUCH POLICIES TO BE ESTABLISHED NO LATER THAN JANUARY 1, 2027; TO PROVIDE FOR ASSESSMENTS OF ADHERENCE TO THE POLICIES; TO REQUIRE CONFIDENTIALITY OF INFORMATION; TO GRANT THE STATE AUDITOR'S OFFICE AUTHORITY TO USE SUCH INFORMATION FOR AUDITING PURPOSES; TO ALLOW MDITS AND THE SECRETARY OF STATE TO REQUEST RESULTS OF INTERNAL ASSESSMENTS; TO PROVIDE FOR FAILURE TO MEET THE ESTABLISHED CYBERSECURITY STANDARDS; AND FOR RELATED PURPOSES.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MISSISSIPPI:

SECTION 1. Section 23-15-165, Mississippi Code of 1972, is amended as follows:

23-15-165. (1) The Office of the Secretary of State, in cooperation with the county registrars and election commissioners, shall procure, implement and maintain an electronic information processing system and programs capable of maintaining a centralized database of all registered voters in the state. The system shall encompass software and hardware, at both the state and county level, software development training, conversion and support and maintenance for the system. The Secretary of State shall equip the Statewide Elections Management System with appropriate security measures to protect private information of the registered voter and the integrity of Mississippi elections. This system shall be known as the "Statewide Elections Management System" and shall constitute the official record of registered voters in every county of the state.

(2) The Office of the Secretary of State shall develop and implement the Statewide Elections Management System so that the registrar and election commissioners of each county shall:

(a) Verify that an applicant that is registering to vote in that county is not registered to vote in another county;

(b) Be notified automatically that a registered voter in its county has registered to vote in another county;

(c) Receive regular reports of death, changes of address and convictions for disenfranchising crimes that apply to voters registered in the county;

(d) Retain all present functionality related to, but not limited to, the use of voter roll data and to implement such other functionality as the law requires to enhance the maintenance of accurate county voter records and related jury selection and redistricting programs; and

(e) When evidence exists that a registered voter may not be a citizen of the United States as provided in Section 23-15-15, send notification to the registrar of the location where the person is registered to vote.

(3) As a part of the procurement and implementation of the system, the Office of the Secretary of State shall, with the assistance of the advisory committee, procure services necessary to convert current voter registration records in the counties into a standard, industry accepted file format that can be used on the Statewide Elections Management System. Thereafter, all official voter information shall be maintained on the Statewide Elections Management System. The standard industry accepted format of data was reviewed and approved by a majority of the advisory committee created in subsection (5) of this section after consultation with the Circuit Clerks Association and the format may not be changed without consulting the Circuit Clerks Association.

(4) The Secretary of State may, with the assistance of the advisory committee, adopt rules and regulations necessary to administer the Statewide Elections Management System. The rules and regulations shall at least:

(a) Provide for the establishment and maintenance of a centralized database for all voter registration information in the state;

(b) Provide procedures for integrating data into the centralized database;

(c) Provide security to ensure that only the registrar, or his or her designee or other appropriate official, as the law may require, can add information to, delete information from and modify information in the system;

(d) Provide the registrar or his or her designee or other appropriate official, as the law may require, access to the system at all times, including the ability to download copies of the industry standard file, for all purposes related to their official duties, including, but not limited to, exclusive access for the purpose of printing all local pollbooks;

(e) Provide security and protection of all information in the system and monitor the system to ensure that unauthorized access is not allowed;

(f) Provide a procedure that will allow the registrar, or his or her designee or other appropriate official, as the law may require, to identify the precinct to which a voter should be assigned; and

(g) Provide a procedure for phasing in or converting existing manual and computerized voter registration systems in counties to the Statewide Elections Management System.

(5) The Secretary of State established an advisory committee to assist in developing system specifications, procurement, implementation and maintenance of the Statewide Elections Management System. The committee included two (2) representatives from the Circuit Clerks Association, appointed by the association; two (2) representatives from the Election Commissioners Association of Mississippi, appointed by the association; one (1) member of the Mississippi Association of Supervisors, or its staff, appointed by the association; the Director of the Stennis Institute of Government at Mississippi State University, or his or her designee; the Executive Director of the Department of Information Technology Services, or his or her designee; two (2) persons knowledgeable about elections and information technology appointed by the Secretary of State; and the Secretary of State, who shall serve as the chair of the advisory committee.

(6) (a) Social security numbers, telephone numbers, email addresses, and date of birth and age information in statewide, district, county and municipal voter registration files shall be exempt from and shall not be subject to inspection, examination, copying or reproduction under the Mississippi Public Records Act of 1983.

(b) Copies of statewide, district, county or municipal voter registration files, excluding social security numbers, telephone numbers, email addresses, and date of birth and age information, shall be provided to any person in accordance with the Mississippi Public Records Act of 1983 at a cost not to exceed the actual cost of production.

(7) The Department of Information and Technology Services, in consultation with the Secretary of State, shall establish mandatory minimum cybersecurity standards and policies for county registrars and election commissioners to ensure the integrity of Mississippi's voter registration and election data when accessing or exporting information from the Statewide Elections Management System.

(a) The Department of Information and Technology Services shall establish such minimum cybersecurity standards and policies no later than January 1, 2027. Such cybersecurity standards and policies shall also include assessments of the county registrar and election commissioners of adherence to the cybersecurity standards and policies.

(b) The results of the assessments are confidential and exempt from public inspection, except that the information must be available to the Office of the State Auditor in performing auditing duties. The results of the internal assessments must also be made available to the Department of Information and Technology Services and the Secretary of State upon request.

(c) After January 1, 2028, any county in which an internal assessment finds the county registrar or election commissioners fail to meet the established cybersecurity standards and procedures shall have their use of Election Support Fund monies limited to ensuring compliance with the established cybersecurity standards and procedures. The Secretary of State shall notify the Board of Supervisors of the limitation placed on the county's Election Support Fund monies and shall provide the Office of the State Auditor with a copy of the notice. Once compliance with the established cybersecurity standards and procedures has been determined, the Secretary of State shall notify the Board of Supervisors and the Office of the State Auditor that the limitation of Election Support Fund monies is no longer in effect.

SECTION 2. This act shall take effect and be in force from and after July 1, 2026.