A. The State Board shall promulgate regulations and standards necessary to ensure the security and integrity of the Virginia voter registration system and the supporting technologies utilized by the counties and cities to maintain and record registrant information. The State Board shall, in consultation with representatives of local government information technology professionals and general registrars, update the security standards at least annually. Such review shall be completed by November 30 each year.

B. The electoral board of each county and city that utilizes supporting technologies to maintain and record registrant information shall develop and annually update written plans and procedures to ensure the security and integrity of those supporting technologies. All plans and procedures shall be in compliance with the security standards established by the State Board pursuant to subsection A. Each electoral board shall report annually by March 1 to the Department of Elections on its security plans and procedures. The general registrar and the Department of Elections shall provide assistance to the electoral board, upon request by the electoral board.

C. In accordance with the process prescribed by the State Board, the Department of Elections may limit access to the Virginia voter registration system by any county or city that has failed to comply with the provisions of subsection B or the security standards established by the State Board pursuant to subsection A. Such access shall be limited as necessary in order to address and resolve any security risks or to enforce compliance with the provisions of subsection B or the security standards established by the State Board. Prior to restricting access to Virginia voter registration system by any county or city, the Department of Elections shall provide notice to the county or city of the failure to comply with the provisions of subsection A or B and the county or city shall have seven days to correct any deficiencies. The Department of Elections may provide technical assistance to any county or city upon request by the county or city.

D. Records of the State Board or of a local electoral board, to the extent such records describe protocols for maintaining the security of the Virginia voter registration system and the supporting technologies utilized to maintain and record registrant information, the release of which would compromise the security of the Virginia voter registration system, shall be confidential and excluded from inspection and copying under the Virginia Freedom of Information Act (§ 2.2-3700 et seq.).

E. The State Board or a local electoral board may hold a closed meeting pursuant to the provisions of the Virginia Freedom of Information Act (§ 2.2-3700 et seq.) for the purpose of discussing protocols for maintaining the security of the Virginia voter registration system and the supporting technologies utilized to maintain and record registrant information, where discussion of such matters in open meeting would compromise the security of the Virginia voter registration system. Nothing in this subsection shall be construed to authorize a closed meeting to discuss any breach of security of the Virginia voter registration system.

F. Nothing in this section shall be construed to prohibit the release of information concerning any breach of security of the Virginia voter registration system.

2019, c. 426.