MDITS and SOS; require to establish minimum cybersecurity standards for SEMS., the official text

MISSISSIPPI LEGISLATURE

2026 Regular Session

To: Elections

By: Senator(s) Williams, Blackmon

Senate Bill 2096

(As Sent to Governor)

AN ACT TO AMEND SECTION 23-15-165, MISSISSIPPI CODE OF 1972,
TO REQUIRE THE MISSISSIPPI DEPARTMENT OF INFORMATION AND TECHNOLOGY SERVICES TO
ESTABLISH MINIMUM CYBERSECURITY STANDARDS AND POLICIES IN CONJUNCTION WITH THE
SECRETARY OF STATE FOR COUNTY REGISTRARS AND ELECTION COMMISSIONERS; TO
STIPULATE THAT SUCH STANDARDS AND POLICIES AIM TO ENSURE THE INTEGRITY OF
MISSISSIPPI'S VOTER REGISTRATION AND ELECTION DATA IN THE STATEWIDE ELECTIONS
MANAGEMENT SYSTEM; TO REQUIRE SUCH POLICIES TO BE ESTABLISHED NO LATER THAN
JANUARY 1, 2027; TO PROVIDE FOR ASSESSMENTS OF ADHERENCE TO THE POLICIES; TO
REQUIRE CONFIDENTIALITY OF INFORMATION; TO GRANT THE STATE AUDITOR'S OFFICE
AUTHORITY TO USE SUCH INFORMATION FOR AUDITING PURPOSES; TO ALLOW MDITS AND THE
SECRETARY OF STATE TO REQUEST RESULTS OF INTERNAL ASSESSMENTS; TO PROVIDE FOR
FAILURE TO MEET THE ESTABLISHED CYBERSECURITY STANDARDS; AND FOR RELATED
PURPOSES.

BE IT ENACTED BY THE
LEGISLATURE OF THE STATE OF MISSISSIPPI:

SECTION 1.  Section
23-15-165, Mississippi Code of 1972, is amended as follows:

23-15-165.  (1)  The Office
of the Secretary of State, in cooperation with the county registrars and
election commissioners, shall procure, implement and maintain an
electronic information processing system and programs capable of maintaining a
centralized database of all registered voters in the state.  The system shall
encompass software and hardware, at both the state and county level, software
development training, conversion and support and maintenance for the system.
The Secretary of State shall equip the Statewide Elections Management System
with appropriate security measures to protect private information of the
registered voter and the integrity of Mississippi elections.  This system shall
be known as the "Statewide Elections Management System" and shall
constitute the official record of registered voters in every county of the
state.

(2)  The Office of the
Secretary of State shall develop and implement the Statewide Elections
Management System so that the registrar and election commissioners of each
county shall:

(a)  Verify that an
applicant that is registering to vote in that county is not registered to vote
in another county;

(b)  Be notified
automatically that a registered voter in its county has registered to vote in
another county;

(c)  Receive regular
reports of death, changes of address and convictions for disenfranchising
crimes that apply to voters registered in the county;

(d)  Retain all present
functionality related to, but not limited to, the use of voter roll data and to
implement such other functionality as the law requires to enhance the
maintenance of accurate county voter records and related jury selection and
redistricting programs; and

(e)  When evidence
exists that a registered voter may not be a citizen of the United States as
provided in Section 23-15-15, send notification to the registrar of the
location where the person is registered to vote.

(3)  As a part of the
procurement and implementation of the system, the Office of the Secretary of
State shall, with the assistance of the advisory committee, procure services
necessary to convert current voter registration records in the counties into a
standard, industry accepted file format that can be used on the Statewide
Elections Management System.  Thereafter, all official voter information shall
be maintained on the Statewide Elections Management System.  The standard
industry accepted format of data  was reviewed and approved by a majority of
the advisory committee created in subsection (5) of this section after
consultation with the Circuit Clerks Association and the format may not be
changed without consulting the Circuit Clerks Association.

(4)  The Secretary of State
may, with the assistance of the advisory committee, adopt rules and regulations
necessary to administer the Statewide Elections Management System.  The rules
and regulations shall at least:

(a)  Provide for the
establishment and maintenance of a centralized database for all voter
registration information in the state;

(b)  Provide procedures
for integrating data into the centralized database;

(c)  Provide security
to ensure that only the registrar, or his or her designee or other appropriate
official, as the law may require, can add information to, delete information
from and modify information in the system;

(d)  Provide the
registrar or his or her designee or other appropriate official, as the law may
require, access to the system at all times, including the ability to download
copies of the industry standard file, for all purposes related to their
official duties, including, but not limited to, exclusive access for the
purpose of printing all local pollbooks;

(e)  Provide security
and protection of all information in the system and monitor the system to ensure
that unauthorized access is not allowed;

(f)  Provide a
procedure that will allow the registrar, or his or her designee or other
appropriate official, as the law may require, to identify the precinct to which
a voter should be assigned; and

(g)  Provide a
procedure for phasing in or converting existing manual and computerized voter
registration systems in counties to the Statewide Elections Management System.

(5)  The Secretary of State
established an advisory committee to assist in developing system
specifications, procurement, implementation and maintenance of the Statewide
Elections Management System.  The committee included two (2) representatives
from the Circuit Clerks Association, appointed by the association; two (2)
representatives from the Election Commissioners Association of Mississippi,
appointed by the association; one (1) member of the Mississippi Association of
Supervisors, or its staff, appointed by the association; the Director of the
Stennis Institute of Government at Mississippi State University, or his or her
designee; the Executive Director of the Department of Information Technology
Services, or his or her designee; two (2) persons knowledgeable about elections
and information technology appointed by the Secretary of State; and the
Secretary of State, who shall serve as the chair of the advisory committee.

(6)  (a)  Social security
numbers, telephone numbers, email addresses, and date of birth and age
information in statewide, district, county and municipal voter registration files
shall be exempt from and shall not be subject to inspection, examination,
copying or reproduction under the Mississippi Public Records Act of 1983.

(b)  Copies of
statewide, district, county or municipal voter registration files, excluding
social security numbers, telephone numbers, email addresses, and date of birth
and age information, shall be provided to any person in accordance with the
Mississippi Public Records Act of 1983 at a cost not to exceed the actual cost
of production.

(7)  The Department of
Information and Technology Services, in consultation with the Secretary of
State, shall establish mandatory minimum cybersecurity standards and policies
for county registrars and election commissioners to ensure the integrity of
Mississippi's voter registration and election data when accessing or exporting
information from the Statewide Elections Management System.

(a)  The Department
of Information and Technology Services shall establish such minimum
cybersecurity standards and policies no later than January 1, 2027.  Such
cybersecurity standards and policies shall also include assessments of the
county registrar and election commissioners of adherence to the cybersecurity
standards and policies.

(b)  The results of
the assessments are confidential and exempt from public inspection, except that
the information must be available to the Office of the State Auditor in
performing auditing duties.  The results of the internal assessments must also
be made available to the Department of Information and Technology Services and
the Secretary of State upon request.

(c)  (i)
Until January 1, 2028, if an internal assessment finds the county registrar or
election commissioners have failed to meet the established cybersecurity
standards and procedures, the county registrar or election commissioners shall
have a period of six (6) months to resolve the issues and become compliant.
After the expiration of the period of six (6) months, the county registrar or
election commissioners shall undergo a new internal assessment to determine if
the issues have been resolved.  If the second internal assessment finds the
county registrar or election commissioners remain noncompliant with the
established cybersecurity standards and procedures, the county shall have its
use of monies from the Election Support Fund established in Section 23-15-5
limited in the same manner as provided in subparagraph (ii) of this paragraph
(c).

(ii)  Beginning
on January 1, 2028, any county in which an internal assessment finds the
county registrar or election commissioners fail to meet the established
cybersecurity standards and procedures shall have their use of Election Support
Fund monies limited to ensuring compliance with the established cybersecurity
standards and procedures.  The Secretary of State shall notify the Board of
Supervisors of the limitation placed on the county's Election Support Fund
monies and shall provide the Office of the State Auditor with a copy of the
notice.  Once compliance with the established cybersecurity standards and
procedures has been determined, the Secretary of State shall notify the Board
of Supervisors and the Office of the State Auditor that the limitation of
Election Support Fund monies is no longer in effect.

SECTION 2.  This act
shall take effect and be in force from and after July 1, 2026.