; (B) provide for the vetting of cybersecurity researchers prior to their participation in the program, including the conduct of background checks; (C) establish terms of participation that— (i) describe the scope of testing permitted under the program; (ii) require researchers to— (I) notify the vendor, the Commission, and the Secretary of any cybersecurity vulnerability they identify with respect to an election system; and (II) otherwise keep such vulnerability confidential for 180 days after such notification; (iii) require the good-faith participation of all participants in the program; (iv) require an election system vendor, after receiving notification of a critical or high vulnerability (as defined by the National Institute of Standards and Technology) in an election system of the vendor, to— (I) send a patch or propound some other fix or mitigation for such vulnerability to the appropriate State and local election officials, in consultation with the researcher who discovered it; and (II) notify the Commission and the Secretary that such patch has been sent to such officials; (D) in the case where a patch or fix to address a vulnerability disclosed under subparagraph (C)(ii)(I) is intended to be applied to a system certified by the Commission, provide— (i) for the expedited review of such patch or fix within 90 days after receipt by the Commission; and (ii) if such review is not completed by the last day of such 90-day period, that such patch or fix shall be deemed to be certified by the Commission; and (E) 180 days after the disclosure of a vulnerability under subparagraph (C)(ii)(I), notify the Director of the Cybersecurity and Infrastructure Security Agency of the vulnerability for inclusion in the database of Common Vulnerabilities and Exposures. (4) Voluntary participation