EMS OS and Antivirus Unpatched Since August 2019 – Contradictory CISA Guidance (AZ)

The Cyber Ninjas audit documented as an established fact that neither the EMS operating system nor its antivirus software had been patched or updated since August 2019 – the date of Dominion’s software installation – meaning Maricopa ran a presidential election on a system with 15+ months of unaddressed CVEs. Maricopa County contended that patching would have “invalidated EAC certification.” EAC Notice of Clarification 19.01 expressly contradicted this: security patches qualify for de minimis approval, and CISA has explicitly recommended such patching. The county’s defense was therefore factually false, while the unpatched system remained exposed to documented critical vulnerabilities.