; (2) provide for the vetting of cybersecurity researchers prior to their participation in the program, including the conduct of background checks; (3) establish terms of participation that— (A) describe the scope of testing permitted under the program; (B) require researchers to— (i) notify the vendor, the Commission, and the Secretary of any cybersecurity vulnerability they identify with respect to an election system; and (ii) otherwise keep such vulnerability confidential for 180 days after such notification; (C) require the good faith participation of all participants in the program; and (D) require an election system vendor, after receiving notification of a critical or high vulnerability (as defined by the National Institute of Standards and Technology) in an election system of the vendor, to— (i) send a patch or propound some other fix or mitigation for such vulnerability to the appropriate State and local election officials, in consultation with the researcher who discovered it; and (ii) notify the Commission and the Secretary that such patch has been sent to such officials; (4) in the case where a patch or fix to address a vulnerability disclosed under paragraph (3)(B)(i) is intended to be applied to a system certified by the Commission, provide— (A) for the expedited review of such patch or fix within 90 days after receipt by the Commission; and (B) if such review is not completed by the last day of such 90-day period, that such patch or fix shall be deemed to be certified by the Commission; and (5) 180 days after the disclosure of a vulnerability under paragraph (3)(B)(i), notify the Director of the Cybersecurity and Infrastructure Security Agency of the vulnerability for inclusion in the database of Common Vulnerabilities and Exposures. (d) Voluntary participation