CISA normally does stuff like this. The shady part is them being told not to release any findings to the voting machine manufacturer.