; (B) provide for the vetting of cybersecurity researchers prior to their participation in the program, including the conduct of background checks; (C) establish terms of participation that— (i) describe the scope of testing permitted under the program; (ii) require researchers to— (I) notify the vendor, the Commission, and the Secretary of any cybersecurity vulnerability they identify with respect to an election system; and (II) otherwise keep such vulnerability confidential for 180 days after such notification; (iii) require the good faith participation of all participants in the program; and (iv) require an election system vendor, after receiving notification of a critical or high vulnerability (as defined by the National Institute of Standards and Technology) in an election system of the vendor, to— (I) send a patch or propound some other fix or mitigation for such vulnerability to the appropriate State and local election officials, in consultation with the researcher who discovered it; and (II) notify the Commission and the Secretary that such patch has been sent to such officials; (D) in the case where a patch or fix to address a vulnerability disclosed under subparagraph (C)(ii)(I) is intended to be applied to a system certified by the Commission, provide— (i) for the expedited review of such patch or fix within 90 days after receipt by the Commission; and (ii) if such review is not completed by the last day of such 90 day period, that such patch or fix shall be deemed to be certified by the Commission; and (E) 180 days after the disclosure of a vulnerability under subparagraph (C)(ii)(I), notify the Director of the Cybersecurity and Infrastructure Security Agency of the vulnerability for inclusion in the database of Common Vulnerabilities and Exposures. (4) Voluntary participation