funds provided under this part, of any sourcing outside the United States for parts of the election infrastructure. (C) The vendor agrees to ensure that the election infrastructure will be developed and maintained in a manner that is consistent with the cybersecurity best practices issued by the Technical Guidelines Development Committee. (D) The vendor agrees to maintain its information technology infrastructure in a manner that is consistent with the cybersecurity best practices issued by the Technical Guidelines Development Committee. (E) The vendor agrees to meet the requirements of paragraph (3) with respect to any known or suspected cybersecurity incidents involving any of the goods and services provided by the vendor pursuant to a grant under this part. (F) The vendor agrees to permit independent security testing by the Commission (in accordance with section 231(a)) and by the Secretary of the goods and services provided by the vendor pursuant to a grant under this part. (3) Cybersecurity incident reporting requirements (A) In general A vendor meets the requirements of this paragraph if, upon becoming aware of the possibility that an election cybersecurity incident has occurred involving any of the goods and services provided by the vendor pursuant to a grant under this part— (i) the vendor promptly assesses whether or not such an incident occurred, and submits a notification meeting the requirements of subparagraph (B) to the Secretary and the Chairman of the assessment as soon as practicable (but in no case later than 3 days after the vendor first becomes aware of the possibility that the incident occurred)